jaffacakes118__2ab93031a7205c5760c7d1055b3f3352

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__2ab93031a7205c5760c7d1055b3f3352
Size 226KB
Sample260920-3lphkaea49
SHA256 4f0d7b3f0d9ba32f0fadd2afd5b48bfdb76281b1ec8eb41bc61e944e9a8522c4
MD5 2ab93031a7205c5760c7d1055b3f3352
SHA1 1f00db5685effb731d5dd74d674edebabc6e8167
SHA512 431650e32e5499a089ebd3320a67212749135ea4ea11b5acae494665acd26fda9307537e0226e87d31589278b57672c40408fd8f446816a07c3bd6ac22d1058b
SSDEEP 6144:D+gkqMhqX6I6FI9YJWxLZ8+0omKT5W75oIQrzRYo:lkRhS6IcdJWx9MoqoIQ/9
TLSH
T1FC347C217641C0F7E067017588FAAB799A29FC351B2912CF77C44BAA1F623D29E39353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__2ab93031a7205c5760c7d1055b3f3352

File Explorer

jaffacakes118__2ab93031a7205c5760c7d1055b3f3352

.exe 226KB

jaffacakes118__2ab93031a7205c5760c7d1055b3f3352

IMPHASH ed8a123f5634cb3ccce9a2b670ff01b1
SHA256 4f0d7b3f0d9ba32f0fadd2afd5b48bfdb76281b1ec8eb41bc61e944e9a8522c4
MD5 2ab93031a7205c5760c7d1055b3f3352
SHA1 1f00db5685effb731d5dd74d674edebabc6e8167
SHA512 431650e32e5499a089ebd3320a67212749135ea4ea11b5acae494665acd26fda9307537e0226e87d31589278b57672c40408fd8f446816a07c3bd6ac22d1058b
SSDEEP 6144:D+gkqMhqX6I6FI9YJWxLZ8+0omKT5W75oIQrzRYo:lkRhS6IcdJWx9MoqoIQ/9
TLSH
T1FC347C217641C0F7E067017588FAAB799A29FC351B2912CF77C44BAA1F623D29E39353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatA GetCurrentProcess LoadLibraryW GetProcAddress FreeLibrary OpenProcess GetExitCodeProcess GetLastError lstrcmpiW VirtualAlloc VirtualProtect VirtualFree CreateEventW WaitForSingleObject CreateThread lstrcpyA GetCurrentDirectoryA TerminateProcess GetModuleFileNameW lstrcpyW GetLongPathNameW TerminateThread GetCurrentThreadId GetTickCount InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetModuleFileNameA WinExec DeleteFileA ExpandEnvironmentStringsA Sleep SetFilePointer GetFileSize ReadFile WriteFile CloseHandle GetModuleHandleW CreateFileA GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidCodePage GetOEMCP GetACP GetStdHandle HeapReAlloc InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree ExitProcess RaiseException RtlUnwind LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo HeapAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate

advapi32

ControlService StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService

shell32

ShellExecuteA

psapi

EnumProcesses

ws2_32

WSAEnumNetworkEvents WSAWaitForMultipleEvents WSACloseEvent WSAEventSelect WSACreateEvent ntohl inet_ntoa WSARecv accept bind inet_addr htons closesocket shutdown WSASocketW WSACleanup WSAStartup WSAGetLastError send listen

shlwapi

StrCmpW StrCpyW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__2ab93031a7205c5760c7d1055b3f3352

kernel32

advapi32

shell32

psapi

ws2_32

shlwapi

generic