JaffaCakes118_3c76e12084f57410323212b79c24a4ad

General

Target
JaffaCakes118_3c76e12084f57410323212b79c24a4ad
Size 7.2MB
Sample251221-vb1h3sdw4d
SHA256 42e369c8a08e42bb7ca81f3b4598b1352766fd602c32adc21cd5f1afab85f7f3
MD5 3c76e12084f57410323212b79c24a4ad
SHA1 c2663a2189440deae7a3826109bceacaea3a99d9
SHA512 e0cfc3ac8407426902e08851db8fa3e75142de3d927ed091e12c4603a896c581a182b9069d04ce4032f974064e66db9a68a83d48ed1982934f6203a7b08964dd
SSDEEP 98304:LH7CgqLPRPYv7cZuwYx72XPo0+XH6zVLexfY+/1P6w0UYv6M0kMfRG1DOUYeixTA:b+gqLKB2pUca6+NP6yYbUGbYemTENFZ3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned binary was signed by an untrusted entity.

resource
JaffaCakes118_3c76e12084f57410323212b79c24a4ad

File Explorer

JaffaCakes118_3c76e12084f57410323212b79c24a4ad

.exe 7.2MB

JaffaCakes118_3c76e12084f57410323212b79c24a4ad

IMPHASH 0ab020de3096b6aafb4fadfac4d16825
SHA256 42e369c8a08e42bb7ca81f3b4598b1352766fd602c32adc21cd5f1afab85f7f3
MD5 3c76e12084f57410323212b79c24a4ad
SHA1 c2663a2189440deae7a3826109bceacaea3a99d9
SHA512 e0cfc3ac8407426902e08851db8fa3e75142de3d927ed091e12c4603a896c581a182b9069d04ce4032f974064e66db9a68a83d48ed1982934f6203a7b08964dd
SSDEEP 98304:LH7CgqLPRPYv7cZuwYx72XPo0+XH6zVLexfY+/1P6w0UYv6M0kMfRG1DOUYeixTA:b+gqLKB2pUca6+NP6yYbUGbYemTENFZ3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned binary was signed by an untrusted entity.

PE Signature issue

Digest

cc:67:39:73:55:66:c1:49:8a:f5:90:0a:03:0e:29:3b:68:61:08:53:79:76:c8:3d:70:a6:4e:03:40:26:d6:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DusanRodina_LanManagement

Chains

Sep 27, 2021

Minor OS version

0

Major OS version

6

Entry point

1239649

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW RemoveDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW MoveFileW GetLastError EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW FindFirstFileW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SystemTimeToFileTime FindClose MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetSystemInfo WaitForMultipleObjects ReadConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetEnvironmentStringsW FormatMessageW LocalFree InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread GetConsoleOutputCP FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW GetSystemTime GetDateFormatW GetTimeFormatW CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree QueryPerformanceCounter QueryPerformanceFrequency LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetFileType GetTimeZoneInformation LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_3c76e12084f57410323212b79c24a4ad

PE Signature issue

kernel32

generic