JaffaCakes118_cec9cc21d4b9780c8fe2b0119e2b4150

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_cec9cc21d4b9780c8fe2b0119e2b4150
Size 802KB
Sample250119-wc7jfsymew
SHA256 4ffaf94b49834cc9a9d0efb4e991e6c2cb8d0844d690bcaa694ae1226f8c3b1c
MD5 cec9cc21d4b9780c8fe2b0119e2b4150
SHA1 81f42e5333638fcba4ef45aa353f1d5551068d0b
SHA512 c984eecb71d9c15b160ace282960cf495fcdf4ad6b7bfc36b70103d9e0c07d44d109405da0e941a71785ff4f073d2143f632f0c74883aa8c44d5b3df4b2a1c56
SSDEEP 12288:MCpmByfmiZsmNIGHT2LT61hmw0m+e7UlTvubV8BJ/mSyRxJE4V6/VZ/fVEHC:M2sFiZ7hHT9DmwHOVvuOOxS4Y3f6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_cec9cc21d4b9780c8fe2b0119e2b4150

File Explorer

JaffaCakes118_cec9cc21d4b9780c8fe2b0119e2b4150

.exe 802KB

JaffaCakes118_cec9cc21d4b9780c8fe2b0119e2b4150

IMPHASH f049ccac3c52251cf94e7007de89df8a
SHA256 4ffaf94b49834cc9a9d0efb4e991e6c2cb8d0844d690bcaa694ae1226f8c3b1c
MD5 cec9cc21d4b9780c8fe2b0119e2b4150
SHA1 81f42e5333638fcba4ef45aa353f1d5551068d0b
SHA512 c984eecb71d9c15b160ace282960cf495fcdf4ad6b7bfc36b70103d9e0c07d44d109405da0e941a71785ff4f073d2143f632f0c74883aa8c44d5b3df4b2a1c56
SSDEEP 12288:MCpmByfmiZsmNIGHT2LT61hmw0m+e7UlTvubV8BJ/mSyRxJE4V6/VZ/fVEHC:M2sFiZ7hHT9DmwHOVvuOOxS4Y3f6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

547866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\not\cryptor\xstubexe\Release\xstubexe.pdb

Name

.text

Size

733KB

Virtual Size

733KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.oiu

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bdsh

Size

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

JaffaCakes118_cec9cc21d4b9780c8fe2b0119e2b4150

kernel32

shell32

crypt32

iphlpapi

secur32

generic