6273c9f4480dbbfc8441ae89f06536ca_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6273c9f4480dbbfc8441ae89f06536ca_JaffaCakes118
Size

175KB
MD5

6273c9f4480dbbfc8441ae89f06536ca
SHA1

7cdbaccfea8536d0a41b816cf6b0515f80dfb3b1
SHA256

c7824c7a66d34606edd9621b21f9218ac363ef18071050dafc4275f2fc059612
SHA512

9c325987afa7ea67c0834fa61827b8d3d0d959815edddbd5a32a24b23fe433a2fb4fabf09d277f269a73a52ae0b8ca7dad3c3cbe59ed1465fbf9e94966188e94
SSDEEP

3072:cGofarkkZSnctAq4qvKuVeyBjRujH5nBHecdWg8t40d8e2oJJqqjoTz2OUMMnMMq:cTiHZtAZeJ1W5pPk40d8e2oHgz2RMMnD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6273c9f4480dbbfc8441ae89f06536ca_JaffaCakes118

Files

6273c9f4480dbbfc8441ae89f06536ca_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8f3f0e6de1633461315198b698893bca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msi

MsiDatabaseExportW

shell32

ShellExecuteA

cfgmgr32

CM_Get_Child

user32

GetDlgItem
GetDlgItemTextA
SetDlgItemTextA
LoadCursorA
GetDC
SetCursor
ShowWindow
SetFocus
GetParent
SendDlgItemMessageA
ReleaseDC
WinHelpA
MessageBeep
DialogBoxIndirectParamW
DialogBoxParamW
DialogBoxParamA
LoadImageA
SendMessageA
LoadBitmapA
SendMessageW
LoadStringA
EnableWindow
GetWindowLongA
CallMsgFilterA
EndDialog
DialogBoxIndirectParamA
SetWindowLongA
GetWindowRect
GetSysColor

kernel32

CompareFileTime
LeaveCriticalSection
HeapAlloc
SetProcessWorkingSetSize
lstrlenA
InitializeCriticalSection
WinExec
GetCurrentProcessId
GetDateFormatA
GetCurrentProcess
GetSystemTimeAsFileTime
lstrlenW
HeapReAlloc
VirtualAlloc
FileTimeToSystemTime
GetCommandLineA
lstrcmpiA
QueryPerformanceCounter
GetLastError
HeapFree
GetCurrentThreadId
GetProcAddress
InterlockedCompareExchange
ExitProcess
EnterCriticalSection
TerminateProcess
SetUnhandledExceptionFilter
GetTickCount

shlwapi

StrCatBuffW

gdi32

GetTextMetricsA
DeleteObject
GetTextMetricsW
SelectObject
GetTextExtentPointA
GetTextExtentPointW

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WintrustAddActionID
WintrustRemoveActionID
WTHelperCertIsSelfSigned
WinVerifyTrust

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f3f0e6de1633461315198b698893bca

Headers

DLL Characteristics

File Characteristics

Imports

msi

shell32

cfgmgr32

user32

kernel32

shlwapi

gdi32

wintrust

Sections

.text Size: 2KB - Virtual size: 2KB

.data Size: 76KB - Virtual size: 752KB

.rdata Size: 15KB - Virtual size: 15KB

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 28B

.rsrc Size: 77KB - Virtual size: 77KB

.text
Size: 2KB - Virtual size: 2KB

.data
Size: 76KB - Virtual size: 752KB

.rdata
Size: 15KB - Virtual size: 15KB

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 28B

.rsrc
Size: 77KB - Virtual size: 77KB