78cbd0214822662d6336e6bd5046d115_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

78cbd0214822662d6336e6bd5046d115_JaffaCakes118
Size

28KB
MD5

78cbd0214822662d6336e6bd5046d115
SHA1

e7f33f1489578b93d100a80a3fc35bf3c6092a7f
SHA256

28ebf623506dc72d0b34a52c20981af0e0f8c525206ccf9b04022829d0d9e85e
SHA512

f08466dd7c9b00e0b58b0c4c144866b0fb3874971924632b3963e8f3bf66b875825c92f03b22ca7a4808977e3efeeb34fa987b62591a5866a90e3f25d2e9df4c
SSDEEP

384:Ak6g4jZ3yNNOOxiFO0Ss3QPT+WYy24vFPfOvnNMBddTUIwxK8mKdA1UsCmLWTn/5:ALrt3yNNDiFOQtklCGtTUzDdTW+/x/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
78cbd0214822662d6336e6bd5046d115_JaffaCakes118

Files

78cbd0214822662d6336e6bd5046d115_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f03459d7fab13b5192448cdcb96abd43

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
GetUserNameA
RegCloseKey

user32

CharNextA
LoadStringA
CharUpperA
wvsprintfA
CharLowerA

kernel32

GetModuleFileNameW
lstrcpyW
SystemTimeToFileTime
GetFileTime
GetSystemTime
DisableThreadLibraryCalls
GetTickCount
GetVersionExA
VirtualFree
WaitForSingleObject
IsBadReadPtr
GetModuleFileNameA
InterlockedIncrement
lstrlenA
lstrlenW
InterlockedDecrement
GetStringTypeExA
GetThreadLocale
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetCurrentProcess
GetProcAddress
GetModuleHandleA
VirtualAlloc
LoadLibraryA
VirtualProtect
lstrcmpA
Sleep
MoveFileExA
GetVolumeInformationA
FreeLibrary
GetComputerNameA
CreateThread
FreeLibraryAndExitThread

wininet

InternetGetConnectedState
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
InternetCheckConnectionA

msvcrt

??2@YAPAXI@Z
realloc
??3@YAXPAX@Z
memset
_except_handler3
_adjust_fdiv
malloc
_initterm
free
memcpy

Exports

Exports

TSPI_lineAnswer
TSPI_lineClose
TSPI_lineDial
TSPI_lineDrop
TSPI_lineGetAddressCaps
TSPI_lineGetAddressID
TSPI_lineGetAddressStatus
TSPI_lineGetCallInfo
TSPI_lineGetCallStatus
TSPI_lineGetDevCaps
TSPI_lineGetDevConfig
TSPI_lineGetID
TSPI_lineGetIcon
TSPI_lineGetLineDevStatus
TSPI_lineGetNumAddressIDs
TSPI_lineMakeCall
TSPI_lineNegotiateTSPIVersion
TSPI_lineOpen
TSPI_lineSetAppSpecific
TSPI_lineSetDevConfig
TSPI_lineSetStatusMessages
TSPI_phoneNegotiateTSPIVersion
TSPI_providerEnumDevices
TSPI_providerGenericDialogData
TSPI_providerInit
TSPI_providerInstall
TSPI_providerShutdown
TSPI_providerUIIdentify
TUISPI_lineConfigDialog
TUISPI_lineConfigDialogEdit
TUISPI_providerInstall

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f03459d7fab13b5192448cdcb96abd43

Headers

File Characteristics

Imports

advapi32

user32

kernel32

wininet

msvcrt

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 224B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 684B

.text
Size: 20KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 224B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 684B