facf889a46495eed13a59381a60cc079_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

facf889a46495eed13a59381a60cc079_JaffaCakes118
Size

141KB
MD5

facf889a46495eed13a59381a60cc079
SHA1

4f8c4272f62608da534285b69b4e2b5ff74255ee
SHA256

2ce54622a2964a36435d34d1cc8800dacb43b980b540dac64f5636de286759ce
SHA512

8ad8d007d6e2df545420d7934015af1afa45dd314f651778ab45a6576cb8388aedd444ed514c9f350365c180587fab2b90c101079a314b08e284a32653754a8e
SSDEEP

3072:Eomy9OVf/YYEezo8usyBoUvYYYD3zKneQygZgC0Pgs:Eo5GYYS8usMfYYO3TcZgCEg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
facf889a46495eed13a59381a60cc079_JaffaCakes118

Files

facf889a46495eed13a59381a60cc079_JaffaCakes118
.dll windows:5 windows x86 arch:x86

17d69a75e72b6a69fda27d39130304f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalAlloc
GetTempFileNameW
WriteFile
OutputDebugStringA
MultiByteToWideChar
FileTimeToLocalFileTime
DeleteVolumeMountPointW
WriteConsoleW
ExitThread
FindNextFileW
GetModuleHandleA
LoadLibraryW
SetEndOfFile
VerifyVersionInfoW
CloseHandle
GetCurrentProcessId
VirtualAlloc
GetPrivateProfileStringA
SetFilePointer
CreateFileA
InterlockedDecrement
VirtualProtect
LCMapStringW
VirtualFree
GetModuleHandleW
lstrcmpA
GetProcAddress
GetStartupInfoA

msvcrt

memset
_adjust_fdiv
malloc
swscanf
wcsrchr
wcslen
_purecall
_wcsnicmp
_wcsicmp
calloc
fflush
_snwprintf
wcscat
_ftol
__dllonexit
strpbrk
wcschr
__getmainargs
time
wcsncat
toupper
__initenv
__p__commode
exit

user32

GetDlgItemInt
DispatchMessageW
IsWindowEnabled
UnhookWindowsHookEx
SystemParametersInfoW
DefWindowProcW
CharNextW
SetCursor
LoadCursorA
SetActiveWindow
PostQuitMessage
MsgWaitForMultipleObjects
DialogBoxParamW
PostThreadMessageW
DrawMenuBar
DestroyMenu
PtInRect
SetProcessWindowStation
SetWindowLongW
GetWindowLongA
SetDlgItemTextA
SetCapture
GetKeyState
GetWindowTextLengthW
SetRectEmpty

gdi32

StretchBlt
SelectPalette
CreateSolidBrush
CreatePalette
SaveDC
SetWindowExtEx
SetPixel
SetStretchBltMode
CreateRoundRectRgn
CreateCompatibleDC
BitBlt
MoveToEx
GetStockObject
GetRegionData
GetObjectW
SetBkColor
CreateFontIndirectW
GetDeviceCaps

tapi32

lineSetupConferenceA
lineDrop
lineGetID
lineSetAgentStateEx
lineInitializeExW
lineAddProviderA
lineAddProvider
lineGetProviderListW
lineGetDevConfigW
phoneConfigDialogA
lineUnparkA
MMCGetProviderList
lineSetLineDevStatus
lineSetAgentSessionState
phoneGetDisplay

Exports

Exports

GetFullDescInfo
ProvidePath

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17d69a75e72b6a69fda27d39130304f2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

gdi32

tapi32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 36B

.data Size: 50KB - Virtual size: 49KB

.edata Size: 39KB - Virtual size: 38KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 512B - Virtual size: 108B

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 36B

.data
Size: 50KB - Virtual size: 49KB

.edata
Size: 39KB - Virtual size: 38KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 108B