JaffaCakes118_430ed5d816c63e0f4f016a295416abad

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_430ed5d816c63e0f4f016a295416abad
Size 85KB
Sample250127-ye2gbstmdm
SHA256 38929d98822063ef15ea05aef14eefe65bb982927721ff4bd5802523a73f1670
MD5 430ed5d816c63e0f4f016a295416abad
SHA1 f848726933542fec77f942f6b51d23386b2f420f
SHA512 382b2be984a10a7c7aebabf0b9bcd6b3270850f2013b8a2bf907d34a3fbb01c32366a3cb34fef8214af10cb2456d1520f3ae4fe2db9fcbe52cfcbba68a39b184
SSDEEP 1536:d/lzBrR4uibG9lex2fXoi2RRINMeFwG/cY+8IXV+7Aal0s:PB+7MXaZ96cfXc7Aal0s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_430ed5d816c63e0f4f016a295416abad

File Explorer

JaffaCakes118_430ed5d816c63e0f4f016a295416abad

.exe 85KB

JaffaCakes118_430ed5d816c63e0f4f016a295416abad

IMPHASH 0b0c1723eb8806e2a575eb1fe650e3bc
SHA256 38929d98822063ef15ea05aef14eefe65bb982927721ff4bd5802523a73f1670
MD5 430ed5d816c63e0f4f016a295416abad
SHA1 f848726933542fec77f942f6b51d23386b2f420f
SHA512 382b2be984a10a7c7aebabf0b9bcd6b3270850f2013b8a2bf907d34a3fbb01c32366a3cb34fef8214af10cb2456d1520f3ae4fe2db9fcbe52cfcbba68a39b184
SSDEEP 1536:d/lzBrR4uibG9lex2fXoi2RRINMeFwG/cY+8IXV+7Aal0s:PB+7MXaZ96cfXc7Aal0s
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45127

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

recv closesocket send WSAGetLastError htons inet_addr socket connect WSAStartup gethostname gethostbyname WSACleanup

kernel32

OpenEventA CreateEventA WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA Sleep CloseHandle WriteFile GetFileSize GetLastError CreateFileA GetFileAttributesA FindClose FindNextFileA QueryPerformanceCounter GetPrivateProfileStringA DeleteFileA SetFileAttributesA SetFileTime GetVersionExA CreateProcessA GetFileTime GetSystemDirectoryA GetTempFileNameA GetTempPathA WaitForSingleObject FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA CreateThread GetComputerNameA GetLocaleInfoA IsBadCodePtr GetTickCount GetCurrentProcessId SetEndOfFile CompareStringA CompareStringW FindFirstFileA RaiseException IsBadReadPtr FlushFileBuffers SetStdHandle InterlockedExchange HeapReAlloc HeapAlloc HeapSize HeapFree RtlUnwind SetEnvironmentVariableA GetSystemTimeAsFileTime ExitProcess TerminateProcess GetCurrentProcess GetTimeFormatA GetDateFormatA GetStartupInfoA GetCommandLineA GetACP GetOEMCP GetCPInfo TlsAlloc SetLastError GetCurrentThreadId TlsFree TlsSetValue TlsGetValue DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr ReadFile SetUnhandledExceptionFilter SetFilePointer SetHandleCount GetStdHandle GetFileType LCMapStringA LCMapStringW GetTimeZoneInformation VirtualProtect GetSystemInfo VirtualQuery UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetStringTypeA GetStringTypeW InitializeCriticalSection

user32

MessageBoxA

advapi32

RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameA

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_430ed5d816c63e0f4f016a295416abad

ws2_32

kernel32

user32

advapi32

shell32

generic