JaffaCakes118_6a3cd01b05bbd017aaa95cffb1a19103

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_6a3cd01b05bbd017aaa95cffb1a19103
Size 415KB
Sample250103-e4cpqazjb1
SHA256 0529371523f4ec63644199b7b4362e3bd8e749f6314c3c1534598f143d649977
MD5 6a3cd01b05bbd017aaa95cffb1a19103
SHA1 713e266612e75a9f2112e1d09b96f9b9133161c5
SHA512 4c4ea357ece63d42deaba2762b215a78ada9e6edfabdc0eef54b099db1dc1fbd2e1150f8f6f48ba4f439fb46107b7ddf615d14e712af63774bcf7fb82c98d025
SSDEEP 12288:jrOyKsibTJqA01KGE8xvrJbTKJeX0qr6gmNfxYqJYP8ibJwVL:jrOyKsihqAyhxvrpTcurLmtxYqo8ibJa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6a3cd01b05bbd017aaa95cffb1a19103

File Explorer

JaffaCakes118_6a3cd01b05bbd017aaa95cffb1a19103

.exe 415KB

JaffaCakes118_6a3cd01b05bbd017aaa95cffb1a19103

IMPHASH 58e185299ecca757fe68ba83a6495fde
SHA256 0529371523f4ec63644199b7b4362e3bd8e749f6314c3c1534598f143d649977
MD5 6a3cd01b05bbd017aaa95cffb1a19103
SHA1 713e266612e75a9f2112e1d09b96f9b9133161c5
SHA512 4c4ea357ece63d42deaba2762b215a78ada9e6edfabdc0eef54b099db1dc1fbd2e1150f8f6f48ba4f439fb46107b7ddf615d14e712af63774bcf7fb82c98d025
SSDEEP 12288:jrOyKsibTJqA01KGE8xvrJbTKJeX0qr6gmNfxYqJYP8ibJwVL:jrOyKsihqAyhxvrpTcurLmtxYqo8ibJa
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

msvcrt

__wgetmainargs _exit _XcptFilter exit _initterm _amsg_exit __setusermatherr memcpy _controlfp _except_handler4_common ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _cexit

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentProcess OpenProcessToken GetCurrentProcessId GetCurrentThreadId

kernel32

LocalAlloc CloseHandle DelayLoadFailureHook GetProcAddress GetLastError FreeLibrary InterlockedCompareExchange LoadLibraryExA InterlockedExchange Sleep SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime UnhandledExceptionFilter DeactivateActCtx LoadLibraryExW ActivateActCtx LeaveCriticalSection lstrcmpW EnterCriticalSection RegCloseKey RegOpenKeyExW HeapSetInformation lstrcmpiW lstrlenW LCMapStringW RegQueryValueExW ReleaseActCtx CreateActCtxW ExpandEnvironmentStringsW GetCommandLineW ExitProcess SetProcessAffinityUpdateMode RegDisablePredefinedCacheEx InitializeCriticalSection GetProcessHeap SetErrorMode RegisterWaitForSingleObjectEx LocalFree HeapFree WideCharToMultiByte HeapAlloc

ntdll

RtlAllocateHeap RtlLengthRequiredSid RtlSubAuthoritySid RtlInitializeSid RtlCopySid RtlSubAuthorityCountSid RtlInitializeCriticalSection RtlSetProcessIsCritical RtlImageNtHeader RtlUnhandledExceptionFilter EtwEventWrite EtwEventEnabled EtwEventRegister RtlFreeHeap

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl AddAccessAllowedAce SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetTokenInformation InitializeSecurityDescriptor GetLengthSid InitializeAcl

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

rpcrt4

RpcMgmtSetServerStackSize I_RpcMapWin32Status RpcServerUnregisterIf RpcMgmtWaitServerListen RpcMgmtStopServerListening RpcServerUnregisterIfEx RpcServerRegisterIf RpcServerUseProtseqEpW RpcServerListen

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_6a3cd01b05bbd017aaa95cffb1a19103

msvcrt

api-ms-win-core-processthreads-l1-1-0

kernel32

ntdll

api-ms-win-security-base-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

rpcrt4

generic