828e641c40cd0f0206068b9a53f80478_JaffaCakes118

General

Target

828e641c40cd0f0206068b9a53f80478_JaffaCakes118
Size

1.5MB
MD5

828e641c40cd0f0206068b9a53f80478
SHA1

e19a98f18842a09dfe1096c129667f33380f9de7
SHA256

2d0076279cbe4a18201b99f344adaca524cd5bb1faa6472266e4983e64beb05c
SHA512

e7b5271b893d8bc789085e3dc687c75cf97f007e0205a26b11219f23a1531b4431bd9855e7850c3146de8582bc50dc5ae69111dd48fd3ecebbb6266d51c5cf27
SSDEEP

24576:39nO4ygKQ2QtabDL+3m+pOUwbPbd7YMWBl3jZaWzQi8aaW/BKl43Gui+X:39nOr1umeO19krlzMni8fEEC3mm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
828e641c40cd0f0206068b9a53f80478_JaffaCakes118

Files

828e641c40cd0f0206068b9a53f80478_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a3458061802c54e63910f66bbe7a0181

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
GetFileAttributesA
GetCommandLineA
GetModuleFileNameA
GetProcessHeap
InitializeCriticalSectionAndSpinCount
CreateThread
CreateFileA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
Sleep
FormatMessageA
SetFilePointer
ReadFile
WriteFile
WaitForSingleObject
LeaveCriticalSection
RemoveDirectoryA
DeleteFileA
MoveFileExA
ExitProcess
TerminateProcess
SetEvent
SetEnvironmentVariableA
GetEnvironmentVariableA
WideCharToMultiByte
GetCurrentProcess
GetSystemDirectoryA
GetDriveTypeA
QueryDosDeviceA
GetDiskFreeSpaceA
GetSystemTime
SystemTimeToFileTime
GetCurrentDirectoryA
CreateProcessA
DeleteCriticalSection
GetExitCodeProcess
CloseHandle
HeapAlloc
HeapFree
EnterCriticalSection

user32

SetParent
ShowWindow
EndDialog
SendDlgItemMessageA
LoadStringA
MessageBoxA
SendMessageA
DialogBoxParamA

comctl32

ord17

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
GetLengthSid
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
OpenProcessToken
AllocateAndInitializeSid

shell32

SHGetPathFromIDListA
SHBrowseForFolderA

ntdll

strstr
_strlwr
strncpy
_allmul
sprintf

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124.9MB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3458061802c54e63910f66bbe7a0181

Headers

File Characteristics

Imports

kernel32

user32

comctl32

advapi32

shell32

ntdll

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 66KB

.rsrc Size: 124.9MB - Virtual size: 1KB

.text
Size: 20KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 66KB

.rsrc
Size: 124.9MB - Virtual size: 1KB