jaffacakes118_5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7.bin
Size 64KB
Sample260922-kbaybasanf
SHA256 5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7
MD5 997db3ef235ed381356c99cc777e6949
SHA1 a7fb8cf98f46aefb11d67ad61885be44d7ba1f8b
SHA512 1095d67970d1fb452cc250530ae9efc5c166ec3138d934c307dc2515a5ce999a9c4affff03953902c1fccb7536825a5d9616cbc35e1995aad0521f42f5ee4dd2
SSDEEP 1536:s75yFVPa5rRuXcdzuFbvivhyOnQTUMU2QDpvaULZvHepr:s75H5rRGcdzh2QD9aULZvH
TLSH
T13753B800FAD2EA32CD865C77DA42DB7A4B53F840482BCFDAF2D554B39D850B99B5A403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7.bin

File Explorer

jaffacakes118_5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7.bin

.dll 64KB

jaffacakes118_5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7.bin

IMPHASH 621c43cea8d22b2227d0bd8e69c6ecab
SHA256 5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7
MD5 997db3ef235ed381356c99cc777e6949
SHA1 a7fb8cf98f46aefb11d67ad61885be44d7ba1f8b
SHA512 1095d67970d1fb452cc250530ae9efc5c166ec3138d934c307dc2515a5ce999a9c4affff03953902c1fccb7536825a5d9616cbc35e1995aad0521f42f5ee4dd2
SSDEEP 1536:s75yFVPa5rRuXcdzuFbvivhyOnQTUMU2QDpvaULZvHepr:s75H5rRGcdzh2QD9aULZvH
TLSH
T13753B800FAD2EA32CD865C77DA42DB7A4B53F840482BCFDAF2D554B39D850B99B5A403
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcr90

__dllonexit _amsg_exit _decode_pointer _encode_pointer _initterm _iob _lock _onexit _unlock abort calloc free fwrite malloc memcpy strlen strncmp vfprintf

python27

PyCFunction_Type PyCapsule_GetName PyCapsule_GetPointer PyCapsule_IsValid PyCode_New PyDict_GetItem PyDict_GetItemString PyDict_New PyDict_SetItem PyErr_ExceptionMatches PyErr_Format PyErr_Occurred PyErr_SetString PyErr_WarnEx PyExc_AttributeError PyExc_ImportError PyExc_NameError PyExc_RuntimeError PyExc_SystemError PyExc_TypeError PyExc_ValueError PyFloat_FromDouble PyFrame_New PyImport_AddModule PyImport_Import PyInt_FromLong PyInt_FromSsize_t PyList_New PyList_Type PyMem_Malloc PyMem_Realloc PyMethod_Type PyModule_GetDict PyModule_GetName PyOS_snprintf PyObject_Call PyObject_CallFunctionObjArgs PyObject_GetAttr PyObject_GetAttrString PyObject_GetItem PyObject_SetAttrString PyString_FromFormat PyString_FromString PyString_FromStringAndSize PyString_InternFromString PyTraceBack_Here PyTuple_New PyTuple_Type PyUnicodeUCS2_DecodeUTF8 Py_GetVersion Py_InitModule4 _PyThreadState_Current _Py_CheckRecursionLimit _Py_CheckRecursiveCall _Py_TrueStruct

Name

.text

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

126B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_5253bccff17fdb14bdd12f4b806ae5f0dd6d0fb937ec4d270cf8c6d36255f6b7.bin

kernel32

msvcr90

python27

generic