General

  • Target

    2b094aa11baa06a72a5dd6096747d994_JaffaCakes118

  • Size

    1.4MB

  • MD5

    2b094aa11baa06a72a5dd6096747d994

  • SHA1

    971eec1fe4cd4fc41b3f81539a26a8ce0e62a8db

  • SHA256

    56657e84b4b120dbf97ed7cf20cbfdb6f622f004f16264b26216b8d808cf1418

  • SHA512

    04986f9ba35bc88b1332625aa331419245843c97bc7cf3a91faa8b3cab715f4763475ba4c2332364beb38f9c54b135fcf391dbf2a4d8f6af20c61fb16f005461

  • SSDEEP

    24576:+gemwUCr6UspcfN3BHGbPnaD1cvrV9M08hi4PNuwmpB4uM35ZbFGPYww8ve4D4:+7mOrlsC1xHz1mN8htEtpB4N5ZbFGPYb

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 2b094aa11baa06a72a5dd6096747d994_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • IEPasswordRecovery.exe
    .exe windows:5 windows x86 arch:x86

    a695b6c784297a1019a1c5725f0324a4


    Headers

    Imports

    Sections

  • Internet Explorer Password Recovery Help.chm
    .chm
  • License.txt
  • image/AboutIE.bmp
  • image/Bottom.bmp
  • image/ButtonBuyNow.bmp
  • image/ButtonCancel.bmp
  • image/ButtonClose.bmp
  • image/ButtonEvaluate.bmp
  • image/ButtonExit.bmp
  • image/ButtonMin.bmp
  • image/ButtonOK.bmp
  • image/ButtonRecovery.bmp
  • image/Left.bmp
  • image/Right.bmp
  • image/Thumbs.db
  • image/Top.bmp
  • image/TopAbout.bmp
  • image/TopBuyNow.bmp
  • image/TopFound.bmp
  • image/TopRegistration.bmp
  • image/about.bmp
  • image/buynow.bmp
  • image/help.bmp
  • image/left_panel.bmp
  • image/list_hearder.bmp
  • image/register.bmp
  • image/top_panel.bmp
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections