JaffaCakes118_2c98cb4e139ce5a1a21e668a8cd9feb1

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_2c98cb4e139ce5a1a21e668a8cd9feb1
Size 1.7MB
Sample250106-tb9lbaspfm
SHA256 7730c0e556bed612863399019d411fa1d03486d1fc32028ea0cad2f1a9a5ffc6
MD5 2c98cb4e139ce5a1a21e668a8cd9feb1
SHA1 9e079138fd276f7993bba2a62c9a27fd5e6c8607
SHA512 2ccf577f61d60f7e014d42f98d06f8d8f05d2928f65510d9fbb50df9e2d8586114a04b8a450c62cfe36585026c43ac7b511ff2a05b7b6fd694353c2ebb7f890a
SSDEEP 24576:o4pLEZif00JxEAXqCvRAQKNDmWEAeApxOGlFZ4h0pZB5v31rIyOlIM+SSZPU:oGYZifFEAXr6fraYp3Oy3Sc8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_2c98cb4e139ce5a1a21e668a8cd9feb1

File Explorer

JaffaCakes118_2c98cb4e139ce5a1a21e668a8cd9feb1

.dll 1.7MB

JaffaCakes118_2c98cb4e139ce5a1a21e668a8cd9feb1

IMPHASH 45bdaee93c33b77a7c1420580399cc20
SHA256 7730c0e556bed612863399019d411fa1d03486d1fc32028ea0cad2f1a9a5ffc6
MD5 2c98cb4e139ce5a1a21e668a8cd9feb1
SHA1 9e079138fd276f7993bba2a62c9a27fd5e6c8607
SHA512 2ccf577f61d60f7e014d42f98d06f8d8f05d2928f65510d9fbb50df9e2d8586114a04b8a450c62cfe36585026c43ac7b511ff2a05b7b6fd694353c2ebb7f890a
SSDEEP 24576:o4pLEZif00JxEAXqCvRAQKNDmWEAeApxOGlFZ4h0pZB5v31rIyOlIM+SSZPU:oGYZifFEAXr6fraYp3Oy3Sc8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

GetSecurityDescriptorSacl RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

CloseHandle CompareStringW CreateEventW CreateFileA CreateFileW CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection EnumCalendarInfoW EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileW FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCPInfoExW GetCommandLineW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceW GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoA GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemInfo GetThreadLocale GetThreadPriority GetTickCount GetUserDefaultLCID GetUserDefaultUILanguage GetVersion GetVersionExA GetVersionExW HeapAlloc HeapCreate HeapDestroy HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsValidLocale LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ResetEvent ResumeThread RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEvent SetFilePointer SetHandleCount SetLastError SetThreadLocale SetThreadPriority Sleep SuspendThread SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForSingleObject WideCharToMultiByte WriteFile lstrlenW InterlockedDecrement InterlockedExchange InterlockedIncrement HeapSize

user32

CharLowerBuffW CharNextW CharUpperBuffW CharUpperW EnumThreadWindows GetMenuCheckMarkDimensions GetSystemMetrics LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW wsprintfA GetTabbedTextExtentW

oleaut32

SafeArrayCreate SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantInit

Name

.text

Size

976KB

Virtual Size

976KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

591KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

82KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_2c98cb4e139ce5a1a21e668a8cd9feb1

advapi32

kernel32

user32

oleaut32

generic