JaffaCakes118_0050e4a92ebade2e92e78d785a7b4f69

General

Target
JaffaCakes118_0050e4a92ebade2e92e78d785a7b4f69
Size 212KB
Sample250120-177vxsslbz
SHA256 9a05b07f87c522569eb70b4f2e0cd77285f0958013563b3974cdef40d183ea7c
MD5 0050e4a92ebade2e92e78d785a7b4f69
SHA1 2460212b3d514d21bd71e8f90effd5bef4e0b98f
SHA512 1d6570a18d6d94253b79375f1dbaa1057b44430a8b2ac5700522a7575bb18447237fbde355966084ca5c75913e58e28a66fd329ad257f688846cfc21501639f4
SSDEEP 3072:wgKKuiX63bw5dNjDh8pWVgTlFIYaQhLw77x+mwRzFCVbSX+8slAdqCxA3wWT:hKZp3KNjVGvaeLwXxKRe8Ucq93RT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_0050e4a92ebade2e92e78d785a7b4f69

File Explorer

JaffaCakes118_0050e4a92ebade2e92e78d785a7b4f69

.dll 212KB

JaffaCakes118_0050e4a92ebade2e92e78d785a7b4f69

IMPHASH a68d51a78b7115c1573487ba15fe0cde
SHA256 9a05b07f87c522569eb70b4f2e0cd77285f0958013563b3974cdef40d183ea7c
MD5 0050e4a92ebade2e92e78d785a7b4f69
SHA1 2460212b3d514d21bd71e8f90effd5bef4e0b98f
SHA512 1d6570a18d6d94253b79375f1dbaa1057b44430a8b2ac5700522a7575bb18447237fbde355966084ca5c75913e58e28a66fd329ad257f688846cfc21501639f4
SSDEEP 3072:wgKKuiX63bw5dNjDh8pWVgTlFIYaQhLw77x+mwRzFCVbSX+8slAdqCxA3wWT:hKZp3KNjVGvaeLwXxKRe8Ucq93RT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

122880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\perforce\Gep\HelpClient\1.0\Source\lib\windows\AdobeHelpLib\Release\AdobeHelpLib.pdb

kernel32

MultiByteToWideChar GetFileAttributesExW CloseHandle CreateProcessW InterlockedIncrement InterlockedDecrement RtlUnwind RaiseException ExitProcess HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA GetVersionExA TlsAlloc SetLastError GetLastError TlsFree TlsSetValue TlsGetValue GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc TerminateProcess GetCurrentProcess HeapSize HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr WriteFile FlushFileBuffers SetFilePointer SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr GetACP GetOEMCP GetCPInfo LoadLibraryA InterlockedExchange VirtualQuery InitializeCriticalSection SetStdHandle ReadFile CreateFileW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetEndOfFile VirtualProtect GetSystemInfo GetLocaleInfoW

shell32

ShellExecuteExW SHGetFolderPathW

Name

.text

Size

76KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_0050e4a92ebade2e92e78d785a7b4f69

kernel32

shell32

generic