a92b66664e45cf9157e36d5906fb83ef_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a92b66664e45cf9157e36d5906fb83ef_JaffaCakes118
Size

452KB
MD5

a92b66664e45cf9157e36d5906fb83ef
SHA1

c11de122e38bd157f0991a39258ad7e6583cbfcc
SHA256

0212e20b3261b6ab70fe8e856d88e2ce688dd1a29c53692233d138c5ae2321a7
SHA512

9c2607fa298e2666f44b7beae4c5defe70163598f40e5aeb50336a79501b960f92c9c9db79fe95fdf97c7406ce593e262d44f1242d8c15504454435a509d087e
SSDEEP

12288:NiPAWSLk1LQniiIEoFHRYteDasSWvRIfbE6ci8yqoMMnMMMMMG:YP8I5QifEoFIAqgWMMnMMMMM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a92b66664e45cf9157e36d5906fb83ef_JaffaCakes118

Files

a92b66664e45cf9157e36d5906fb83ef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f4b9988d02d79108d632cafaef8efe54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DialogBoxIndirectParamW
LoadCursorA
GetWindowLongA
LoadStringA
MessageBeep
SendMessageA
EnableWindow
SetFocus
SendMessageW
GetDlgItem
DialogBoxParamA
DialogBoxIndirectParamA
SetWindowLongA
EndDialog
GetDlgItemTextA
SendDlgItemMessageA
CallMsgFilterA
ReleaseDC
SetCursor
DialogBoxParamW
GetSysColor
CreateWindowExW
ShowWindow
GetWindowRect
WinHelpA
LoadImageA
SetDlgItemTextA
LoadBitmapA
GetDC

shell32

ShellExecuteA

shlwapi

StrCatBuffW
StrCatBuffA
wnsprintfA
StrCpyNW

ntdll

RtlUnwind

gdi32

GetTextExtentPointA
SelectObject
GetTextMetricsA
GetTextExtentPointW
DeleteObject
GetTextMetricsW

kernel32

GetSystemTimeAsFileTime
GetTickCount
TerminateProcess
WinExec
lstrlenW
InterlockedCompareExchange
GetProcAddress
HeapAlloc
SetUnhandledExceptionFilter
GetCurrentProcess
SetProcessWorkingSetSize
FileTimeToSystemTime
GetCurrentThreadId
HeapFree
LeaveCriticalSection
GetLastError
GetCommandLineA
HeapReAlloc
DeleteCriticalSection
lstrcmpiA
UnhandledExceptionFilter
VirtualAlloc
EnterCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
lstrlenA
CompareFileTime
GetDateFormatA

samlib

SamiEncryptPasswords
SamOpenAlias
SamRemoveMultipleMembersFromAlias

wintrust

WintrustAddActionID
WTHelperCertIsSelfSigned
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WintrustRemoveActionID

advapi32

CryptAcquireContextA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 410KB - Virtual size: 928KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4b9988d02d79108d632cafaef8efe54

Headers

DLL Characteristics

File Characteristics

Imports

user32

shell32

shlwapi

ntdll

gdi32

kernel32

samlib

wintrust

advapi32

Sections

.text Size: 1KB - Virtual size: 1KB

.data Size: 410KB - Virtual size: 928KB

.reloc Size: 512B - Virtual size: 56B

.rsrc Size: 32KB - Virtual size: 31KB

.idata Size: 2KB - Virtual size: 2KB

.rdata Size: 4KB - Virtual size: 4KB

.text
Size: 1KB - Virtual size: 1KB

.data
Size: 410KB - Virtual size: 928KB

.reloc
Size: 512B - Virtual size: 56B

.rsrc
Size: 32KB - Virtual size: 31KB

.idata
Size: 2KB - Virtual size: 2KB

.rdata
Size: 4KB - Virtual size: 4KB