jaffacakes118__2e1e3d8c66da5856344634a79d847fd0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__2e1e3d8c66da5856344634a79d847fd0
Size 46KB
Sample260919-2tb2rsvs2p
SHA256 d382e96c3ef3b68a9f86443225903ece90cace0252c236e13b16c7627b57c451
MD5 2e1e3d8c66da5856344634a79d847fd0
SHA1 ca6593747e07fce3835786e213bd696b1fd71414
SHA512 059f16725d521a880b8b45888edb005b7e779f9d398317b20ad2a58eaf3855a00c4b7999a44e2bb0faea349c29fc117b22496e3725177107c4e20fad04bb8ddf
SSDEEP 768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ43cq:Yyx9mkr0G+hGYVj9wbcqZe3
TLSH
T1FF23E14BEFBA1482E2B55B724CB2D918FFEB60290526D3A387104D1E9D336A7C934243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__2e1e3d8c66da5856344634a79d847fd0

File Explorer

jaffacakes118__2e1e3d8c66da5856344634a79d847fd0

.exe 46KB

jaffacakes118__2e1e3d8c66da5856344634a79d847fd0

IMPHASH 20e41ce01f80755f4eea7fc12deb3017
SHA256 d382e96c3ef3b68a9f86443225903ece90cace0252c236e13b16c7627b57c451
MD5 2e1e3d8c66da5856344634a79d847fd0
SHA1 ca6593747e07fce3835786e213bd696b1fd71414
SHA512 059f16725d521a880b8b45888edb005b7e779f9d398317b20ad2a58eaf3855a00c4b7999a44e2bb0faea349c29fc117b22496e3725177107c4e20fad04bb8ddf
SSDEEP 768:Yz1wV+XS+k9ylkrzLMQIjQExSO4+FDtL2lw7z3Fj9wbPk54ZJ43cq:Yyx9mkr0G+hGYVj9wbcqZe3
TLSH
T1FF23E14BEFBA1482E2B55B724CB2D918FFEB60290526D3A387104D1E9D336A7C934243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9961

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

ZwReadFile ZwQueryInformationFile strrchr ZwCreateFile ZwWriteFile ZwQueryVolumeInformationFile ZwQueryDirectoryFile wcslen ZwSetInformationFile RtlAdjustPrivilege RtlIpv4StringToAddressA ZwOpenThreadTokenEx _wcsicmp strcmp strcpy sprintf memcmp strchr ZwSetSecurityObject LdrAccessResource wcsrchr swprintf strlen RtlDestroyQueryDebugBuffer RtlQueryProcessDebugInformation RtlCreateQueryDebugBuffer RtlEqualUnicodeString ZwQuerySystemInformation ZwSuspendThread ZwQueryInformationThread ZwOpenThread _stricmp RtlNtStatusToDosError RtlIpv4AddressToStringA ZwClose ZwEnumerateKey ZwOpenKey ZwQueryKey ZwResumeThread ZwLoadDriver ZwCreateSymbolicLinkObject ZwUnmapViewOfSection ZwFlushVirtualMemory RtlImageNtHeader ZwMapViewOfSection ZwCreateSection ZwFsControlFile ZwOpenFile ZwSetValueKey ZwCreateKey LdrFindResource_U RtlInitUnicodeString ZwAdjustPrivilegesToken memset RtlIpv4StringToAddressW ZwQueryValueKey ZwImpersonateThread memcpy

kernel32

DeleteTimerQueueTimer Sleep GetVersion ExitProcess GetTickCount CreateTimerQueueTimer VirtualAlloc GetSystemTimeAsFileTime GetLastError BindIoCompletionCallback LocalFree LocalAlloc

advapi32

MD5Update MD5Final MD5Init

ws2_32

WSACleanup WSARecvFrom WSASendTo setsockopt WSASend WSARecv WSAIoctl bind closesocket WSAGetLastError WSASocketW WSAStartup

cabinet

ord20 ord22 ord23

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__2e1e3d8c66da5856344634a79d847fd0

ntdll

kernel32

advapi32

ws2_32

cabinet

generic