JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad
Size 1.8MB
Sample250207-s8ab2sykdk
SHA256 0ed404720a42ff3549edc52886f04cea167c27febcb709588f9cf269ebd7d268
MD5 b8bab4c121e42017b8d18eb03ecc6aad
SHA1 5e4a416cc651b7046c60413ffb4d6bf9b9a30c12
SHA512 040196d015b54008d69e42576a31a4d99543aeda2bc86b1b583c69b3c7c6b25e5232db925d6e850dc09e7ab0aaf997188272d626633ba83940da63152130e871
SSDEEP 49152:8NmIOoOOT9BsyjhpKQ1mdVy3I+XWmBroax9:omqBsaQWmQhXWqrLx9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad

File Explorer

JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad

.exe 1.8MB

JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad

IMPHASH a215b529a6426ad298ca393c7a359bd2
SHA256 0ed404720a42ff3549edc52886f04cea167c27febcb709588f9cf269ebd7d268
MD5 b8bab4c121e42017b8d18eb03ecc6aad
SHA1 5e4a416cc651b7046c60413ffb4d6bf9b9a30c12
SHA512 040196d015b54008d69e42576a31a4d99543aeda2bc86b1b583c69b3c7c6b25e5232db925d6e850dc09e7ab0aaf997188272d626633ba83940da63152130e871
SSDEEP 49152:8NmIOoOOT9BsyjhpKQ1mdVy3I+XWmBroax9:omqBsaQWmQhXWqrLx9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1182015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

GetLastError CloseHandle CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW ExitProcess GetLocalTime MultiByteToWideChar SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA CreateFileA GetPrivateProfileStringA WritePrivateProfileStringA DeleteFileA VirtualProtectEx CreateProcessA GetStartupInfoA GetCommandLineA SetEvent CreateEventA GetSystemTimeAsFileTime GetCurrentThreadId ReadFile GetFileSize CompareStringA SetEndOfFile FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation HeapSize FreeLibrary SetConsoleCtrlHandler QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapReAlloc FatalAppExitA VirtualFree HeapCreate HeapDestroy GetStdHandle WriteFile TlsFree TlsSetValue TlsAlloc TlsGetValue CompareStringW IsValidCodePage GetOEMCP GetACP LCMapStringW LCMapStringA GetCPInfo GetDateFormatA GetTimeFormatA GetProcessHeap HeapAlloc HeapFree IsDebuggerPresent SetUnhandledExceptionFilter EnterCriticalSection ReadProcessMemory LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx MoveFileA GetModuleHandleA UnhandledExceptionFilter TerminateProcess RaiseException InterlockedIncrement InterlockedDecrement InterlockedExchange DeleteCriticalSection InterlockedCompareExchange GetFileAttributesA GetFileAttributesW GetFileAttributesExW CreateFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileAttributesExA GetCurrentDirectoryA SetCurrentDirectoryA FindClose GetFileTime SetFileTime GetDiskFreeSpaceExW GetFullPathNameW RemoveDirectoryW DeleteFileW CreateDirectoryW CreateHardLinkW GetDiskFreeSpaceExA GetFullPathNameA RemoveDirectoryA CreateDirectoryA CreateHardLinkA MoveFileW CopyFileW CopyFileA GetFileInformationByHandle FindFirstFileW FindNextFileW FindFirstFileA FindNextFileA LocalFree FormatMessageA RtlUnwind

user32

CreateWindowExA MessageBoxA DispatchMessageA BeginPaint EndPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA DialogBoxParamA GetWindowTextLengthA GetWindowTextA SetWindowTextA CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage UnpackDDElParam FreeDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA GetDlgItem GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow SendMessageA SetPropA EnumThreadWindows GetPropA WaitForInputIdle SetTimer GetMessageA TranslateMessage

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

comdlg32

GetSaveFileNameA GetOpenFileNameA

Name

.text

Size

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

47KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

52B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text1

Size

656KB

Virtual Size

704KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

116KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc1

Size

36KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

936KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_b8bab4c121e42017b8d18eb03ecc6aad

kernel32

user32

gdi32

comdlg32

generic