JaffaCakes118_89b67e77905a044b843c8e497643b9e3

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_89b67e77905a044b843c8e497643b9e3
Size 432KB
Sample250105-ee7tkasrck
SHA256 3b0a9525b0859bbea429747b942d8559e7c8249902b3b14efffcdc7995a2b47d
MD5 89b67e77905a044b843c8e497643b9e3
SHA1 2629055f0c0cf63f5e1ef834291e3249a44593b5
SHA512 21e75b86fd5e153e5dfe53c0142e2551e6da4b72d7b5afafdab769045d96b9cfc20c3e56c7e23380387fdab232242a06374e072b73fad9a2a97039505281cfe1
SSDEEP 12288:qUCmZiCcGLRvOazpj5frSbBJ2AeVvn7k:ACcKRGmlfkBJ0V/I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_89b67e77905a044b843c8e497643b9e3

File Explorer

JaffaCakes118_89b67e77905a044b843c8e497643b9e3

.exe 432KB

JaffaCakes118_89b67e77905a044b843c8e497643b9e3

IMPHASH 41721e0f933696d50ab32d544d64dcd3
SHA256 3b0a9525b0859bbea429747b942d8559e7c8249902b3b14efffcdc7995a2b47d
MD5 89b67e77905a044b843c8e497643b9e3
SHA1 2629055f0c0cf63f5e1ef834291e3249a44593b5
SHA512 21e75b86fd5e153e5dfe53c0142e2551e6da4b72d7b5afafdab769045d96b9cfc20c3e56c7e23380387fdab232242a06374e072b73fad9a2a97039505281cfe1
SSDEEP 12288:qUCmZiCcGLRvOazpj5frSbBJ2AeVvn7k:ACcKRGmlfkBJ0V/I
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

svchost.pdb

api-ms-win-core-crt-l2-1-0

_initterm _initterm_e __wgetmainargs

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken SetProcessAffinityUpdateMode ExitProcess GetCurrentThreadId GetCurrentProcess GetCurrentProcessId TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64 GetTickCount

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter SetErrorMode UnhandledExceptionFilter

api-ms-win-service-private-l1-1-3

I_RegisterSvchostNotificationCallback

api-ms-win-core-crt-l1-1-0

qsort_s memset memcpy _wcsicmp

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation HeapFree GetProcessHeap HeapAlloc

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive AcquireSRWLockShared InitializeSRWLock EnterCriticalSection LeaveCriticalSection ReleaseSRWLockShared

api-ms-win-service-winsvc-l1-1-0

RegisterServiceCtrlHandlerW

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus

api-ms-win-core-string-l1-1-0

CompareStringOrdinal MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegDisablePredefinedCacheEx RegQueryValueExW RegGetValueW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW ExpandEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy

api-ms-win-core-processthreads-l1-1-2

SetProtectedPolicy

rpcrt4

RpcServerUnregisterIfEx I_RpcMapWin32Status RpcServerUseProtseqEpW RpcMgmtSetServerStackSize RpcServerUnregisterIf RpcServerRegisterIf RpcMgmtStopServerListening RpcServerListen RpcMgmtWaitServerListen I_RpcServerDisableExceptionFilter

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl GetLengthSid AddAccessAllowedAce InitializeAcl GetTokenInformation InitializeSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventRegister EventWriteTransfer

api-ms-win-crt-utility-l1-1-0

bsearch_s

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx CreateActCtxW DeactivateActCtx ActivateActCtx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

ntdll

RtlQueryHeapInformation RtlImageNtHeader _vsnwprintf TpSetTimer TpReleaseTimer TpWaitForTimer TpSetTimerEx EtwEventWrite RtlRunOnceExecuteOnce RtlNtStatusToDosError EtwEventEnabled TpReleaseWait RtlNtStatusToDosErrorNoTeb TpSetWait TpAllocWait EtwEventRegister RtlUnhandledExceptionFilter NtSetInformationProcess RtlSetProcessIsCritical RtlInitializeCriticalSection RtlInitializeSid RtlAllocateHeap RtlSubAuthoritySid RtlGetDeviceFamilyInfoEnum RtlReleaseSRWLockExclusive RtlSubAuthorityCountSid RtlAcquireSRWLockExclusive RtlLengthRequiredSid RtlDeriveCapabilitySidsFromName RtlCopySid RtlFreeHeap TpAllocTimer NtQuerySystemInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

992KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_89b67e77905a044b843c8e497643b9e3

api-ms-win-core-crt-l2-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-service-private-l1-1-3

api-ms-win-core-crt-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-2

rpcrt4

api-ms-win-core-localization-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-core-sidebyside-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic