b7e5841194901b9d67ef7922d625af5c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b7e5841194901b9d67ef7922d625af5c_JaffaCakes118
Size

400KB
MD5

b7e5841194901b9d67ef7922d625af5c
SHA1

75128e6aa8e2801573b2a59dd66164506096e70e
SHA256

8a427e4eff5d890955f4c4d70686c58b0314cc98bb734580f32cb9b8add0b18d
SHA512

56f96b4d9a4e2e8caea57ef963a443dcc14566384ced5b16b2523efd4f528c21f6c9c8d5c94a18f240a95d457f6d01633ec593b660aa08d304122aeec81d9563
SSDEEP

6144:DkX0BF74RFSRn1xDcSd89q4Y5HycDh2nr3I8OcCAWzU7ATWGzDE3fZsf4v8mTX7r:D10R0JSqrByctgYDcXWDvvAY4HTXkM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7e5841194901b9d67ef7922d625af5c_JaffaCakes118

Files

b7e5841194901b9d67ef7922d625af5c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fcf1400771ae5452d1502bfd4ba5ef49

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrCatBuffA
wnsprintfA
StrCatBuffW
StrCpyNW

ntdll

RtlUnwind

gdi32

GetTextExtentPointA
DeleteObject
GetTextExtentPointW
GetTextMetricsW
GetTextMetricsA
SelectObject

wintrust

WTHelperCertIsSelfSigned
WintrustRemoveActionID
WTHelperGetProvSignerFromChain
WinVerifyTrust
WintrustAddActionID
WTHelperGetProvCertFromChain

samlib

SamRemoveMultipleMembersFromAlias

user32

SetFocus
WinHelpA
GetWindowRect
GetSysColor
SetDlgItemTextA
DialogBoxParamW
LoadStringA
SendMessageW
GetDlgItemTextA
EnableWindow
LoadCursorA
GetDC
GetDlgItem
SendDlgItemMessageA
CreateWindowExW
GetWindowLongA
CallMsgFilterA
SetWindowLongA
DialogBoxIndirectParamW
ShowWindow
SetCursor
MessageBeep
EndDialog
GetParent
LoadImageA
DialogBoxParamA
LoadBitmapA
SendMessageA
ReleaseDC

crypt32

CryptEnumOIDInfo

kernel32

GetLastError
lstrlenW
GetDateFormatA
HeapReAlloc
DeleteCriticalSection
GetCurrentThreadId
LeaveCriticalSection
GetCommandLineA
HeapAlloc
lstrlenA
SetProcessWorkingSetSize
GetTickCount
QueryPerformanceCounter
GetCurrentProcess
SetUnhandledExceptionFilter
VirtualAlloc
FileTimeToSystemTime
InterlockedCompareExchange
Sleep
EnterCriticalSection
GetProcAddress
GetSystemTimeAsFileTime
UnhandledExceptionFilter
InitializeCriticalSection
CompareFileTime
lstrcmpiA
TerminateProcess
HeapFree

shell32

ShellExecuteA

Sections

.text
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fcf1400771ae5452d1502bfd4ba5ef49

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

ntdll

gdi32

wintrust

samlib

user32

crypt32

kernel32

shell32

Sections

.text Size: 1024B - Virtual size: 972B

.reloc Size: 512B - Virtual size: 28B

.rsrc Size: 345KB - Virtual size: 345KB

.data Size: 38KB - Virtual size: 1.2MB

.idata Size: 2KB - Virtual size: 2KB

.rdata Size: 11KB - Virtual size: 11KB

.text
Size: 1024B - Virtual size: 972B

.reloc
Size: 512B - Virtual size: 28B

.rsrc
Size: 345KB - Virtual size: 345KB

.data
Size: 38KB - Virtual size: 1.2MB

.idata
Size: 2KB - Virtual size: 2KB

.rdata
Size: 11KB - Virtual size: 11KB