jaffacakes118__2800f1c28277922afd4416664eeb9e9f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__2800f1c28277922afd4416664eeb9e9f
Size 871KB
Sample260920-1yta6seq2v
SHA256 68335e868c200d389640ecc4fe148d6d817e6dafa84c2d0829fc8777c4e22179
MD5 2800f1c28277922afd4416664eeb9e9f
SHA1 89801f323af3c334340821adb771c32735f7ffae
SHA512 023d8fa48327cfde67abd3f3612ce64bd431c09fe9d5f9264b8cb69e54f1fd558e3b9e469ad519bfe17abb801c410a39ebafa067f64815b3e2812ab1f832aefc
SSDEEP 24576:HiPL9UqUyA3njIi3mfEEmPZlMFhqoRdSU0aP3mOwQ:HiSVDnjhEmPZBobSU0ssQ
TLSH
T1D01523950A75E43BD21E0AF94C2471D6033B378B5F3600DB81C8976BAE656F22237B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__2800f1c28277922afd4416664eeb9e9f

File Explorer

jaffacakes118__2800f1c28277922afd4416664eeb9e9f

.exe 871KB

jaffacakes118__2800f1c28277922afd4416664eeb9e9f

IMPHASH 91847bf32f8ce5d23bcde0ef7b322860
SHA256 68335e868c200d389640ecc4fe148d6d817e6dafa84c2d0829fc8777c4e22179
MD5 2800f1c28277922afd4416664eeb9e9f
SHA1 89801f323af3c334340821adb771c32735f7ffae
SHA512 023d8fa48327cfde67abd3f3612ce64bd431c09fe9d5f9264b8cb69e54f1fd558e3b9e469ad519bfe17abb801c410a39ebafa067f64815b3e2812ab1f832aefc
SSDEEP 24576:HiPL9UqUyA3njIi3mfEEmPZlMFhqoRdSU0aP3mOwQ:HiSVDnjhEmPZBobSU0ssQ
TLSH
T1D01523950A75E43BD21E0AF94C2471D6033B378B5F3600DB81C8976BAE656F22237B97
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

840920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetCPInfo IsDebuggerPresent InterlockedDecrement UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetACP GetOEMCP IsValidCodePage EncodePointer TlsGetValue TlsSetValue DecodePointer GetModuleHandleW SetLastError GetCurrentThreadId WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection HeapFree ExitProcess Sleep IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleFileNameW LoadLibraryW RtlUnwind GetProcAddress GetLastError HeapCreate GlobalAlloc HeapAlloc SetUnhandledExceptionFilter MulDiv

user32

ShowCaret UnregisterClassA RedrawWindow EmptyClipboard CharUpperBuffW GetKeyNameTextA MapVirtualKeyA DestroyWindow ModifyMenuA SetClassLongA CreateWindowExW GetLastActivePopup DrawTextA GetClassInfoW CharUpperBuffA GetForegroundWindow EnableScrollBar DefWindowProcA IsWindowEnabled GetCaretPos WaitForInputIdle FindWindowA GetClassInfoA SetTimer FlashWindow DeferWindowPos GetWindow CheckMenuItem EnumThreadWindows HideCaret SetForegroundWindow CreateIcon SetRect RegisterClassW PtInRect DrawTextExA ClientToScreen SetFocus IntersectRect GetSubMenu GetClipboardFormatNameA EnumWindows InvalidateRect SetMenuItemInfoA LoadBitmapA CharNextW IsClipboardFormatAvailable SetActiveWindow PeekMessageA GetWindowDC DestroyCursor DrawEdge CreateMenu GetIconInfo TabbedTextOutA GetClipboardData DefMDIChildProcA CreateWindowExA DialogBoxParamA DrawMenuBar TranslateMessage CallWindowProcA EnableWindow ShowWindow SystemParametersInfoA ReleaseDC ValidateRect SetKeyboardState RegisterWindowMessageA CallNextHookEx EqualRect UpdateWindow DrawIcon ShowScrollBar EndPaint IsZoomed EndDeferWindowPos DispatchMessageA DefWindowProcW GetTopWindow GetWindowTextLengthW DestroyCaret FrameRect GetKeyboardLayout GetPropA DeleteMenu BringWindowToTop IsCharAlphaA InvalidateRgn GetScrollRange SetWindowTextW MoveWindow SetMenu UnhookWindowsHookEx MessageBeep GetMessageA DefFrameProcA BeginDeferWindowPos LoadCursorA GetMenuCheckMarkDimensions DrawCaption IsWindow GetAsyncKeyState ToUnicode CloseClipboard PostMessageA DrawTextW RegisterClipboardFormatA WindowFromPoint OffsetRect GetScrollPos IsWindowVisible GetMessageTime CallWindowProcW OpenClipboard ToAscii GetActiveWindow IsChild LoadKeyboardLayoutA CreateDialogParamA GetKeyState SendNotifyMessageA OemToCharA GetMenuItemCount GetKeyboardLayoutList WinHelpA GetMenuItemID GetWindowTextA ScrollWindow ChildWindowFromPoint GetSysColor GetCapture PostThreadMessageA SetWindowRgn GetMenuState EnableMenuItem DestroyIcon SetParent RemoveMenu SetClipboardData CharNextA GetDlgItem CreateCaret BeginPaint GetTabbedTextExtentA MapWindowPoints GetDoubleClickTime RemovePropA TrackPopupMenu RegisterClassA SetWindowPos ActivateKeyboardLayout CharLowerBuffA LoadIconA GetMessagePos EndDialog SetWindowsHookExA ScreenToClient TranslateMDISysAccel GetSystemMetrics GetMenu GetCursorPos IsIconic CharUpperA SetScrollInfo DestroyMenu GetCursor DrawFrameControl SendMessageW InsertMenuItemA InsertMenuA GetUpdateRect GetDesktopWindow SetCapture SendDlgItemMessageA GetWindowThreadProcessId EnumClipboardFormats WaitMessage GetWindowLongA SetWindowLongW GetMenuItemInfoA InflateRect FindWindowExA LoadCursorFromFileA DrawTextExW ShowOwnedPopups IsWindowUnicode SetCursor CreatePopupMenu GetSystemMenu SetWindowTextA SetWindowPlacement SendMessageTimeoutA ReleaseCapture GetClassNameA IsCharAlphaNumericA DrawIconEx CopyImage GetSysColorBrush mouse_event SetWindowLongA PostQuitMessage InvertRect SubtractRect CopyRect AdjustWindowRectEx SetScrollPos LockWindowUpdate WindowFromDC IsDialogMessageA SetScrollRange GetFocus CharLowerA IsRectEmpty UnionRect wsprintfA GetParent MessageBoxA GetDCEx SendMessageA MsgWaitForMultipleObjects FillRect ShowCursor GetMenuStringA GetDC GetMenuItemRect DrawFocusRect SetRectEmpty CharPrevW GetWindowPlacement SetCaretPos ScrollWindowEx ScrollDC SetPropA GetKeyboardState GetClientRect KillTimer GetWindowRgn GetWindowTextW GetWindowRect GetScrollInfo

gdi32

GetRandomRgn

comdlg32

GetSaveFileNameA ChooseFontA PrintDlgA GetOpenFileNameA ChooseColorA

advapi32

RegEnumValueA RegQueryValueA RegQueryValueExA RegEnumKeyExA RegOpenKeyA RegCloseKey RegQueryInfoKeyA RegSetValueExA RegDeleteKeyA RegFlushKey RegOpenKeyExA RegDeleteValueA GetUserNameA RegCreateKeyExA

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder

ole32

OleUninitialize OleInitialize

oleaut32

VarCmp OleLoadPicture

comctl32

ImageList_Read ImageList_DragShowNolock ImageList_Write ImageList_DrawEx ImageList_DragEnter ImageList_GetDragImage ImageList_Add ImageList_GetIcon ImageList_SetIconSize ImageList_GetBkColor ImageList_SetDragCursorImage ImageList_GetIconSize ord17 ImageList_SetBkColor ImageList_DragLeave ImageList_Draw ImageList_Destroy ImageList_EndDrag ImageList_DragMove ImageList_GetImageCount ImageList_Replace ImageList_ReplaceIcon ImageList_Remove ImageList_Create ImageList_BeginDrag ImageList_GetImageInfo ImageList_LoadImageA

winmm

timeBeginPeriod timeGetTime timeEndPeriod mciSendCommandA mciGetErrorStringA

msimg32

AlphaBlend

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wsock32

WSAStartup gethostbyname recvfrom select listen connect WSACleanup getsockname getsockopt setsockopt WSAAsyncSelect socket closesocket accept ioctlsocket htons bind sendto gethostname inet_ntoa

mpr

WNetGetUniversalNameA WNetGetConnectionA WNetEnumResourceA WNetOpenEnumA WNetCloseEnum

imm32

ImmSetCompositionFontA ImmGetCompositionStringA ImmGetCompositionStringW ImmReleaseContext ImmSetCompositionWindow ImmGetContext

ws2_32

WSARecv WSAGetOverlappedResult WSAEventSelect WSAStringToAddressA WSAAddressToStringA WSASocketA WSASend

wldap32

ord16 ord88 ord17

Name

.text

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xyue

Size

761KB

Virtual Size

761KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

657KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__2800f1c28277922afd4416664eeb9e9f

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

winmm

msimg32

version

wsock32

mpr

imm32

ws2_32

wldap32

generic