43bdb0c1d44d7976db44a5906871ebde_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

43bdb0c1d44d7976db44a5906871ebde_JaffaCakes118
Size

20KB
MD5

43bdb0c1d44d7976db44a5906871ebde
SHA1

3f866841488b7dae22b6d1ba4f12249689033530
SHA256

0b1e16f8f7dd32ab721b9026a0bd0fc8609e85588b3e409ddb8393dcb88aeed4
SHA512

dc06c54c4853a2bb55f4793fc9c64fc6efc0efbc871b628e935dbab8012166911997dffc2285e33554f9cea5ed1016ca4fc28933781a9f48a4ac91f03c3494de
SSDEEP

384:q+3MGxk+7eWES4HMJ7Z1wAgbC0TTbDuw5KZuaSfJCbV1PdiyiAei:00VrES+czJgpTzuwgZuV87PdiyiAei

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/IncomingFax.scr

Files

43bdb0c1d44d7976db44a5906871ebde_JaffaCakes118
.zip
IncomingFax.scr
.exe windows:4 windows x86 arch:x86

9f9e95f9db59de9e95416835d48a17dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateWindowExA
GetWindowTextA
PostQuitMessage
EndPaint
GetClientRect
BeginPaint
DefWindowProcA
SetFocus
LoadAcceleratorsA
LoadStringA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
SendMessageA
ShowWindow
UpdateWindow

kernel32

GetModuleHandleA
GetStartupInfoA
SetLastError
GetCurrentDirectoryA
Sleep
GetLastError
LoadLibraryA

gdi32

TextOutA

msvcrt

wcslen
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
fgetc
fflush
fputc
memcpy
memset
wcsncmp

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ