facf023cb14e1347dcb37c386c852863_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

facf023cb14e1347dcb37c386c852863_JaffaCakes118
Size

140KB
MD5

facf023cb14e1347dcb37c386c852863
SHA1

42440e47944e0597116430c069d6689374542e93
SHA256

a52aaf75db92b3922fc761042d568009ffb946bc67a0b9352a71da04aa770208
SHA512

fffd06d1e645a2fe1f3030b7248e0e8f40733597c0066bbe9a5dc52eece5c3aaec238c0a87019739fe28f96088df11c49eaab266d07f6d881267a9d77051a316
SSDEEP

3072:Bn2lLf4i6WGcgrIioLuXUhNdW9wGSCWKneQyFJqnhTlP0:Bn2pLqcgrbUhNdWGhCxeHqnFl0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
facf023cb14e1347dcb37c386c852863_JaffaCakes118

Files

facf023cb14e1347dcb37c386c852863_JaffaCakes118
.exe windows:5 windows x86 arch:x86

17d69a75e72b6a69fda27d39130304f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalAlloc
GetTempFileNameW
WriteFile
OutputDebugStringA
MultiByteToWideChar
FileTimeToLocalFileTime
DeleteVolumeMountPointW
WriteConsoleW
ExitThread
FindNextFileW
GetModuleHandleA
LoadLibraryW
SetEndOfFile
VerifyVersionInfoW
CloseHandle
GetCurrentProcessId
VirtualAlloc
GetPrivateProfileStringA
SetFilePointer
CreateFileA
InterlockedDecrement
VirtualProtect
LCMapStringW
VirtualFree
GetModuleHandleW
lstrcmpA
GetProcAddress
GetStartupInfoA

msvcrt

memset
_adjust_fdiv
malloc
swscanf
wcsrchr
wcslen
_purecall
_wcsnicmp
_wcsicmp
calloc
fflush
_snwprintf
wcscat
_ftol
__dllonexit
strpbrk
wcschr
__getmainargs
time
wcsncat
toupper
__initenv
__p__commode
exit

user32

GetDlgItemInt
DispatchMessageW
IsWindowEnabled
UnhookWindowsHookEx
SystemParametersInfoW
DefWindowProcW
CharNextW
SetCursor
LoadCursorA
SetActiveWindow
PostQuitMessage
MsgWaitForMultipleObjects
DialogBoxParamW
PostThreadMessageW
DrawMenuBar
DestroyMenu
PtInRect
SetProcessWindowStation
SetWindowLongW
GetWindowLongA
SetDlgItemTextA
SetCapture
GetKeyState
GetWindowTextLengthW
SetRectEmpty

gdi32

StretchBlt
SelectPalette
CreateSolidBrush
CreatePalette
SaveDC
SetWindowExtEx
SetPixel
SetStretchBltMode
CreateRoundRectRgn
CreateCompatibleDC
BitBlt
MoveToEx
GetStockObject
GetRegionData
GetObjectW
SetBkColor
CreateFontIndirectW
GetDeviceCaps

tapi32

lineSetupConferenceA
lineDrop
lineGetID
lineSetAgentStateEx
lineInitializeExW
lineAddProviderA
lineAddProvider
lineGetProviderListW
lineGetDevConfigW
phoneConfigDialogA
lineUnparkA
MMCGetProviderList
lineSetLineDevStatus
lineSetAgentSessionState
phoneGetDisplay

Exports

Exports

GetFullDescInfo
ProvidePath

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17d69a75e72b6a69fda27d39130304f2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

gdi32

tapi32

Exports

Exports

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 3KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 36B

.data Size: 50KB - Virtual size: 49KB

.edata Size: 39KB - Virtual size: 38KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 512B - Virtual size: 108B

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 3KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 36B

.data
Size: 50KB - Virtual size: 49KB

.edata
Size: 39KB - Virtual size: 38KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 512B - Virtual size: 108B