JaffaCakes118_79a6017bc97c4f6d71d9744d2ca9a8f2

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_79a6017bc97c4f6d71d9744d2ca9a8f2
Size 686KB
Sample250104-phqdss1ncl
SHA256 e12161ec8b6b0230750774df1d3341df61801fce636cb3959759aa7e2f80606e
MD5 79a6017bc97c4f6d71d9744d2ca9a8f2
SHA1 774d256ba9cbc02989461be8ff1a0aef81b963bb
SHA512 c63c7b02c70ea4359d5f475571c8975abc37eb0a2106613fb9a89f5432a643a4de6b9125a327c40baaf55263ec519ba61dd0ab08c93e68c099d7a4aee5ed3f7b
SSDEEP 12288:7uJ67K3upEAjYbKrSMXwgbaZyEheqiZUQ7SDQtf3HoVOm+rpn:NSVCYQSCweaZx0q8UQ7SDQtf3IVL+r1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_79a6017bc97c4f6d71d9744d2ca9a8f2

File Explorer

JaffaCakes118_79a6017bc97c4f6d71d9744d2ca9a8f2

.exe 686KB

JaffaCakes118_79a6017bc97c4f6d71d9744d2ca9a8f2

IMPHASH 0fea304f9ff4f7ac5a28ed57dade7fe7
SHA256 e12161ec8b6b0230750774df1d3341df61801fce636cb3959759aa7e2f80606e
MD5 79a6017bc97c4f6d71d9744d2ca9a8f2
SHA1 774d256ba9cbc02989461be8ff1a0aef81b963bb
SHA512 c63c7b02c70ea4359d5f475571c8975abc37eb0a2106613fb9a89f5432a643a4de6b9125a327c40baaf55263ec519ba61dd0ab08c93e68c099d7a4aee5ed3f7b
SSDEEP 12288:7uJ67K3upEAjYbKrSMXwgbaZyEheqiZUQ7SDQtf3HoVOm+rpn:NSVCYQSCweaZx0q8UQ7SDQtf3IVL+r1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23637

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\T28L10NSP10EP1\build\020p\maps\Release\atashost.pdb

shlwapi

PathAppendW PathFileExistsW

imagehlp

ImageEnumerateCertificates ImageGetCertificateHeader ImageGetCertificateData

crypt32

CryptVerifyMessageSignature CertFreeCertificateContext

advapi32

OpenSCManagerW RegQueryValueExW GetFileSecurityW ImpersonateSelf OpenThreadToken MapGenericMask AccessCheck RevertToSelf GetSecurityDescriptorSacl RegSetValueExW RegCreateKeyW RegCloseKey RegOpenKeyExW RegDeleteKeyW ChangeServiceConfig2W CreateServiceW CloseServiceHandle OpenServiceW SetServiceStatus SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW SetTokenInformation DuplicateTokenEx OpenProcessToken StartServiceCtrlDispatcherW SetNamedSecurityInfoW

kernel32

CreateFileA CompareStringA WriteFile CompareStringW GetLastError FreeLibrary CloseHandle CreateFileW GetProcAddress LoadLibraryW GetPrivateProfileIntW WaitForSingleObject CreateFileMappingW CreateEventW SetEvent GetModuleHandleW Sleep SetLastError OpenProcess GetCurrentProcessId CreateProcessW GetSystemDirectoryW GetShortPathNameW UnmapViewOfFile ProcessIdToSessionId MapViewOfFile GetCurrentDirectoryW GetModuleFileNameW OutputDebugStringW IsBadReadPtr LeaveCriticalSection EnterCriticalSection LocalFree GetCurrentThread GetTempPathW GetLocalTime GetTickCount OpenEventW FindClose FindNextFileW DeleteFileW FindFirstFileW WideCharToMultiByte ReleaseMutex QueryPerformanceFrequency InitializeCriticalSection VirtualQuery GetCurrentThreadId GetModuleFileNameA OpenFileMappingW CreateMutexW GetVersionExW QueryPerformanceCounter SetEnvironmentVariableA SetFilePointer DeleteCriticalSection GetSystemInfo MultiByteToWideChar GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle IsValidCodePage HeapAlloc HeapFree GetFileAttributesW GetTimeZoneInformation GetSystemTimeAsFileTime VirtualFree VirtualAlloc HeapReAlloc HeapCreate ExitProcess GetStdHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement RtlUnwind GetConsoleCP GetConsoleMode HeapSize GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryA GetCPInfo GetACP GetOEMCP

user32

GetSystemMetrics WaitForInputIdle

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

560KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_79a6017bc97c4f6d71d9744d2ca9a8f2

shlwapi

imagehlp

crypt32

advapi32

kernel32

user32

generic