jaffacakes118_a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52.bin
Size 115KB
Sample260922-j9danabf87
SHA256 a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52
MD5 ad4d96f9c70c3a61a46827cc7c6ab60d
SHA1 5e52f3299cb8b50cc71f18aba6b7d9a6056437c7
SHA512 e5ad9a6023fcdf90d291ee56dc79a0665709224319b0cb6e778325613735d807f112e0c46ecf88c5cf49768eff9e54a97d755dad5ddf71af92ad6559dfb8e653
SSDEEP 1536:v9BBMjmlw+7HTqZzFSHonSel5DqH01sREhnsoikYISudpYb6/2D20VpT:1BBuITqZzFSHony0hn2kvIS2D20
TLSH
T1C4B3D850F9A382F5CC9421BAE75AB9174B43F9142428CFDED5AB2C1BDE13277430E686
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52.bin

File Explorer

jaffacakes118_a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52.bin

.dll 115KB

jaffacakes118_a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52.bin

IMPHASH 59291c367e1f0addf085b94ad7aa5026
SHA256 a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52
MD5 ad4d96f9c70c3a61a46827cc7c6ab60d
SHA1 5e52f3299cb8b50cc71f18aba6b7d9a6056437c7
SHA512 e5ad9a6023fcdf90d291ee56dc79a0665709224319b0cb6e778325613735d807f112e0c46ecf88c5cf49768eff9e54a97d755dad5ddf71af92ad6559dfb8e653
SSDEEP 1536:v9BBMjmlw+7HTqZzFSHonSel5DqH01sREhnsoikYISudpYb6/2D20VpT:1BBuITqZzFSHony0hn2kvIS2D20
TLSH
T1C4B3D850F9A382F5CC9421BAE75AB9174B43F9142428CFDED5AB2C1BDE13277430E686
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcr90

__dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock abort calloc free fwrite malloc memcpy strlen strncmp vfprintf

python27

PyBaseObject_Type PyCFunction_NewEx PyCFunction_Type PyCapsule_New PyCode_New PyDict_GetItem PyDict_New PyDict_Next PyDict_SetItem PyDict_SetItemString PyDict_Size PyDict_Type PyErr_Clear PyErr_Format PyErr_GivenExceptionMatches PyErr_NormalizeException PyErr_Occurred PyErr_Restore PyErr_SetString PyErr_WarnEx PyExc_AttributeError PyExc_BaseException PyExc_ImportError PyExc_NameError PyExc_NotImplementedError PyExc_RuntimeError PyExc_StopIteration PyExc_SystemError PyExc_TypeError PyExc_ValueError PyFloat_FromDouble PyFloat_FromString PyFloat_Type PyFrame_New PyImport_AddModule PyInt_FromLong PyInt_FromSsize_t PyInt_Type PyIter_Next PyList_Append PyList_New PyList_Type PyLong_AsLong PyMem_Malloc PyMem_Realloc PyMethod_Type PyModule_AddObject PyModule_GetDict PyNumber_Add PyNumber_Divide PyNumber_InPlaceAdd PyNumber_InPlaceMultiply PyNumber_InPlaceSubtract PyNumber_Int PyNumber_Long PyNumber_Subtract PyOS_snprintf PyObject_Call PyObject_CallFunctionObjArgs PyObject_ClearWeakRefs PyObject_GetAttr PyObject_GetAttrString PyObject_GetItem PyObject_GetIter PyObject_IsTrue PyObject_RichCompare PyObject_SetAttr PyObject_SetAttrString PyObject_Size PyString_AsString PyString_Format PyString_FromFormat PyString_FromString PyString_FromStringAndSize PyString_InternFromString PyString_Type PyTraceBack_Here PyTraceBack_Type PyTuple_New PyTuple_Pack PyTuple_Type PyType_IsSubtype PyType_Ready PyUnicodeUCS2_Compare PyUnicodeUCS2_DecodeUTF8 PyUnicode_Type Py_GetVersion Py_InitModule4 _PyString_Eq _PyThreadState_Current _Py_CheckRecursionLimit _Py_CheckRecursiveCall _Py_NoneStruct _Py_TrueStruct _Py_ZeroStruct

Name

.text

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_a3a3163f8c8011e52cc182b82ce93342813e28f0e41c95bee3cefc2b314d9c52.bin

kernel32

msvcr90

python27

generic