jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2[.]bin

General

Target
jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.bin
Size 290KB
Sample260910-y2zagsee85
SHA256 2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2
MD5 42c699ee0e1854621e265cfb9a2d2b96
SHA1 41f8b339d27687961bebf58db37d3eec88787445
SHA512 0b84181756a8f6938a5ff0285c10d85382040821f6e9f35596589cb31f0513836e26109c6b089f46f02c507436ffecf0e1077fc6603512992b7e3929652ee1d9
SSDEEP 3072:bfRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlOCxFUB:bfRbGY6EDNNAuHe28Pl2ncxl1IR2O
TLSH
T125548D15AAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.bin

File Explorer

jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.bin

.exe 290KB

jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.bin

IMPHASH 53e19d5243b4f25d48df742c8d94ac9c
SHA256 2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2
MD5 42c699ee0e1854621e265cfb9a2d2b96
SHA1 41f8b339d27687961bebf58db37d3eec88787445
SHA512 0b84181756a8f6938a5ff0285c10d85382040821f6e9f35596589cb31f0513836e26109c6b089f46f02c507436ffecf0e1077fc6603512992b7e3929652ee1d9
SSDEEP 3072:bfRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlOCxFUB:bfRbGY6EDNNAuHe28Pl2ncxl1IR2O
TLSH
T125548D15AAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

61492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW SHGetKnownFolderPath ord680 ShellExecuteA

ole32

CoInitialize CoUninitialize CoTaskMemFree

urlmon

URLDownloadToFileW

kernel32

GetCurrentProcessId WriteConsoleW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CloseHandle GetLastError Sleep CreateProcessA GetSystemDirectoryA GetModuleFileNameW WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwind GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetACP RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateFileW GetConsoleMode SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx HeapReAlloc IsValidCodePage

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.bin

shell32

ole32

urlmon

kernel32

generic