JaffaCakes118_40bc14d737b1c6ba7b2c9dfef4b32ea9

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_40bc14d737b1c6ba7b2c9dfef4b32ea9
Size 25KB
Sample250127-sbb5davjgj
SHA256 00eb8ac495ee1968b8cc6396d78ea17eaf89bbb490493af0fb12c82d9c1525e6
MD5 40bc14d737b1c6ba7b2c9dfef4b32ea9
SHA1 a3bf41fcda59fe529d35b8aa775e59430822e182
SHA512 4996a7148762c7e7848d58abc3829d18377c72002b78a9cf7405744255ac1cfa58f263bcef4c58c05a120f5cc9057460eb7b20bcc6ec5a0a12e826cea2fea461
SSDEEP 384:qMw9N4N+AXeo3KolWjI+kGaRLuSqI77D8zL/ZFNaYN72Y5EaRZhfOk:qM+AXeebpGaR9N7MzL//0YN73JRzfOk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_40bc14d737b1c6ba7b2c9dfef4b32ea9

File Explorer

JaffaCakes118_40bc14d737b1c6ba7b2c9dfef4b32ea9

.dll 25KB

JaffaCakes118_40bc14d737b1c6ba7b2c9dfef4b32ea9

IMPHASH a177ee257c97838ace8d49bc7f7fbc26
SHA256 00eb8ac495ee1968b8cc6396d78ea17eaf89bbb490493af0fb12c82d9c1525e6
MD5 40bc14d737b1c6ba7b2c9dfef4b32ea9
SHA1 a3bf41fcda59fe529d35b8aa775e59430822e182
SHA512 4996a7148762c7e7848d58abc3829d18377c72002b78a9cf7405744255ac1cfa58f263bcef4c58c05a120f5cc9057460eb7b20bcc6ec5a0a12e826cea2fea461
SSDEEP 384:qMw9N4N+AXeo3KolWjI+kGaRLuSqI77D8zL/ZFNaYN72Y5EaRZhfOk:qM+AXeebpGaR9N7MzL//0YN73JRzfOk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileA DeleteFileA GetSystemDirectoryA Sleep CreateThread ReadFile SetFilePointer GetLastError CreateEventA GetTempPathA GetWindowsDirectoryA SetFileAttributesA CreateMutexA LoadLibraryA GlobalAlloc VirtualProtect GetCommandLineA ExitProcess WideCharToMultiByte VirtualAllocEx WriteProcessMemory CreateRemoteThread WaitForSingleObject VirtualFreeEx GetCurrentProcess GetModuleHandleA GetProcAddress OpenProcess GetModuleFileNameA CloseHandle

user32

GetParent GetWindowThreadProcessId EnumWindows wsprintfA GetWindowTextA

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA

msvcrt

_access strrchr strcat memset strchr atoi free __dllonexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev _onexit strncpy strstr sprintf malloc ??2@YAPAXI@Z memcpy __CxxFrameHandler strcmp strcpy strlen

netapi32

Netbios

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_40bc14d737b1c6ba7b2c9dfef4b32ea9

kernel32

user32

advapi32

msvcp60

ws2_32

wininet

msvcrt

netapi32

generic