83639f5a63dad866771b3452644cd615_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

83639f5a63dad866771b3452644cd615_JaffaCakes118
Size

451KB
MD5

83639f5a63dad866771b3452644cd615
SHA1

818436f2ff1696c40e377225553d839d55c04b03
SHA256

406302dd5d2038a686f0ad1ef1cf8b2c979883f672d260c557f1e9645d7f9bd8
SHA512

8d2479c076c5449bcc26da1c67c528db513535bbc313136113a35e7f19ce3497c6222db470626b53b776e2e0ecb61a7fdf6eaef023bc368612ecab0e184eec67
SSDEEP

6144:tPM4kaGDLmknHZFoXz5oAHwfhyY29OE5oNFozsVta/uFZ1gf/zP+pU6g3Y1PhMM0:lIDL55oo1gO/ozsvBFSygaMMnMMMMM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83639f5a63dad866771b3452644cd615_JaffaCakes118

Files

83639f5a63dad866771b3452644cd615_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1e916d7463123dce6f6cde7daeb35471

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WintrustAddActionID
WTHelperGetProvSignerFromChain
WTHelperCertIsSelfSigned
WintrustRemoveActionID

cfgmgr32

CM_Get_Child

gdi32

GetTextExtentPointW
GetTextMetricsA
SelectObject
GetTextExtentPointA
DeleteObject
GetTextMetricsW

shlwapi

StrCatBuffW

user32

GetDlgItemTextA
GetWindowLongA
DialogBoxIndirectParamW
LoadCursorA
SendMessageA
CallMsgFilterA
EndDialog
SetFocus
ReleaseDC
SetCursor
SendMessageW
ShowWindow
EnableWindow
SetWindowLongA
LoadBitmapA
DialogBoxParamW
GetDC
SendDlgItemMessageA
SetDlgItemTextA
WinHelpA
GetWindowRect
GetDlgItem
LoadStringA
GetParent
DialogBoxIndirectParamA
GetSysColor
MessageBeep
DialogBoxParamA
LoadImageA

kernel32

WinExec
GetDateFormatA
GetCommandLineA
CompareFileTime
GetProcAddress
GetCurrentProcess
GetLastError
VirtualAlloc
ExitProcess
GetSystemTimeAsFileTime
LeaveCriticalSection
GetCurrentProcessId
GetTickCount
lstrcmpiA
HeapReAlloc
InterlockedCompareExchange
HeapFree
TerminateProcess
InitializeCriticalSection
SetProcessWorkingSetSize
SetUnhandledExceptionFilter
EnterCriticalSection
lstrlenW
UnhandledExceptionFilter
lstrlenA
HeapAlloc
FileTimeToSystemTime
DeleteCriticalSection

shell32

ShellExecuteA

msi

MsiDatabaseExportW

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 221KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e916d7463123dce6f6cde7daeb35471

Headers

DLL Characteristics

File Characteristics

Imports

wintrust

cfgmgr32

gdi32

shlwapi

user32

kernel32

shell32

msi

Sections

.text Size: 5KB - Virtual size: 5KB

.data Size: 221KB - Virtual size: 1.8MB

.rdata Size: 43KB - Virtual size: 42KB

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 28B

.rsrc Size: 181KB - Virtual size: 180KB

.text
Size: 5KB - Virtual size: 5KB

.data
Size: 221KB - Virtual size: 1.8MB

.rdata
Size: 43KB - Virtual size: 42KB

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 28B

.rsrc
Size: 181KB - Virtual size: 180KB