7c4012b9a554fdbed01f5b100972e78a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7c4012b9a554fdbed01f5b100972e78a_JaffaCakes118
Size

503KB
MD5

7c4012b9a554fdbed01f5b100972e78a
SHA1

e36f19b804163be8e4746b2a5c7d017ae49898bf
SHA256

2a9bf659640245cbe4bc8055b1aecedeb8238f8a068145ad06db09bca64bceca
SHA512

d339b27be7ffe5b25081232b9f09cee273f5a11b9a9e1cacb58f23564d1fc17054bba5efe450e833295bfd06cf0ccc79c7e7e5aa66cf4f8de8211d167962a816
SSDEEP

12288:BExgMeurTME/kTze6p5GZe2tBH8VmjSaetDThH6jPpYtM+vd4Ws:axgduXM7B7G7tBHiQktvhajPjWs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/faktura_nr_8863633951836638556551425870497281.exe

Files

7c4012b9a554fdbed01f5b100972e78a_JaffaCakes118
.zip
faktura_nr_886363395183663855655142587049728.zip
.zip
faktura_nr_8863633951836638556551425870497281.exe
.exe windows:4 windows x86 arch:x86

1e82c970de8d1fd58010f5a854cbe2b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

cmpbk32

PhoneBookEnumCountries
PhoneBookLoad

clusapi

CloseCluster
CloseClusterGroup
ClusterControl
ClusterEnum

user32

wsprintfA
LoadBitmapA
IsDialogMessageA
DispatchMessageW
PostMessageA
CharToOemA
LoadIconA
CreateWindowExA
DialogBoxParamA
MessageBoxW
GetClassLongA
DrawStateA
PeekMessageA
InsertMenuW

dsprop

ErrMsg
CrackName

kernel32

GetCommandLineA
OpenThread
CreateMutexW
GetEnvironmentVariableW
WaitForSingleObject
SetLocalTime
CreateProcessA
QueryDosDeviceW
FindClose
FindResourceExA
OpenProcess
GlobalAddAtomA
GetConsoleTitleW
GetPriorityClass
FindNextFileA
CreateFileMappingW
FindFirstFileW
FormatMessageA
TlsGetValue
GetLogicalDriveStringsA
GetProcAddress
GetPrivateProfileStringW
CreateDirectoryA
CreateSemaphoreW
LoadLibraryA
SetEnvironmentVariableA
GetModuleHandleA

shlwapi

UrlGetPartW
PathCompactPathW
UrlCreateFromPathW
UrlCombineW
UrlEscapeA
UrlCompareA
UrlUnescapeW
PathIsRootW
UrlHashA
UrlIsNoHistoryW
UrlGetLocationA
PathCommonPrefixW
UrlIsA
PathCombineA

untfs

Extend
Format

crypt32

CertAddStoreToCollection
CertAlgIdToOID
CertFindExtension
CertCloseStore
CertRemoveStoreFromCollection
CryptEnumOIDInfo
CertFindAttribute
CertDeleteCRLFromStore
CertFindChainInStore
CertControlStore

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.inc
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e82c970de8d1fd58010f5a854cbe2b6

Headers

DLL Characteristics

File Characteristics

Imports

cmpbk32

clusapi

user32

dsprop

kernel32

shlwapi

untfs

crypt32

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 21KB - Virtual size: 20KB

.inc Size: 481KB - Virtual size: 481KB

.rsrc Size: 108KB - Virtual size: 108KB

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 21KB - Virtual size: 20KB

.inc
Size: 481KB - Virtual size: 481KB

.rsrc
Size: 108KB - Virtual size: 108KB