09836461312a3781af6e1298c6b2c249_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

09836461312a3781af6e1298c6b2c249_JaffaCakes118
Size

32KB
MD5

09836461312a3781af6e1298c6b2c249
SHA1

ad23c33806a0d77ce9779f8560a8921f64964a95
SHA256

93f0a1fe486ad222b742e451f25f4c9219b1e0f5b4273a15ce08dd714827745a
SHA512

906f00fd41f0c0fac93ee6a73b5383d78d980fd77e056a2108fcac84b228854c2c8b0568c971ed3d439810a20baa9ed7e5bb45726756d07bb54ba55b4f823da2
SSDEEP

768:LPH+f3BnIl+SmwtyUjDoIFoBl/z2yMrpz/aA5rr9qwhaDC3ZXK:LwSmWZnfWBl/z2yMrpz/aA5rr9qhDCJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09836461312a3781af6e1298c6b2c249_JaffaCakes118

Files

09836461312a3781af6e1298c6b2c249_JaffaCakes118
.dll windows:5 windows x86 arch:x86

b7979a859ceaa2d1b5ac69eb5a7f4ae5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
RtlUnwind
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
OutputDebugStringA
GetCurrentProcess
UnhandledExceptionFilter

pcre-0

pcre_fullinfo
pcre_exec
pcre_config
pcre_compile
pcre_free

msvcp60

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

msvcrt

memcmp
isdigit
memcpy
isspace
strtol
strtoul
strtod
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
free
_CxxThrowException
malloc
_callnewh
_unlock
__dllonexit
_lock
_onexit
_XcptFilter
_initterm
_amsg_exit
_adjust_fdiv
??1type_info@@UAE@XZ
_errno
__CxxFrameHandler
strlen

Exports

Exports

??0Arg@pcrecpp@@QAE@PAD@Z
??0Arg@pcrecpp@@QAE@PADP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAE@Z
??0Arg@pcrecpp@@QAE@PAEP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAF@Z
??0Arg@pcrecpp@@QAE@PAFP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAG@Z
??0Arg@pcrecpp@@QAE@PAGP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAH@Z
??0Arg@pcrecpp@@QAE@PAHP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAI@Z
??0Arg@pcrecpp@@QAE@PAIP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAJ@Z
??0Arg@pcrecpp@@QAE@PAJP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAK@Z
??0Arg@pcrecpp@@QAE@PAKP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAM@Z
??0Arg@pcrecpp@@QAE@PAMP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAN@Z
??0Arg@pcrecpp@@QAE@PANP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Arg@pcrecpp@@QAE@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@P6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAVStringPiece@1@@Z
??0Arg@pcrecpp@@QAE@PAVStringPiece@1@P6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PAX@Z
??0Arg@pcrecpp@@QAE@PA_J@Z
??0Arg@pcrecpp@@QAE@PA_JP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@PA_K@Z
??0Arg@pcrecpp@@QAE@PA_KP6A_NPBDHPAX@Z@Z
??0Arg@pcrecpp@@QAE@XZ
??0RE@pcrecpp@@QAE@ABV01@@Z
??0RE@pcrecpp@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0RE@pcrecpp@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVRE_Options@1@@Z
??0RE@pcrecpp@@QAE@PBD@Z
??0RE@pcrecpp@@QAE@PBDABVRE_Options@1@@Z
??0RE@pcrecpp@@QAE@PBE@Z
??0RE@pcrecpp@@QAE@PBEABVRE_Options@1@@Z
??0RE_Options@pcrecpp@@QAE@H@Z
??0RE_Options@pcrecpp@@QAE@XZ
??0Scanner@pcrecpp@@QAE@ABV01@@Z
??0Scanner@pcrecpp@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0Scanner@pcrecpp@@QAE@XZ
??0StringPiece@pcrecpp@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0StringPiece@pcrecpp@@QAE@PBD@Z
??0StringPiece@pcrecpp@@QAE@PBDH@Z
??0StringPiece@pcrecpp@@QAE@PBE@Z
??0StringPiece@pcrecpp@@QAE@XZ
??1RE@pcrecpp@@QAE@XZ
??1Scanner@pcrecpp@@QAE@XZ
??4Arg@pcrecpp@@QAEAAV01@ABV01@@Z
??4RE@pcrecpp@@QAEABV01@ABV01@@Z
??4RE_Options@pcrecpp@@QAEAAV01@ABV01@@Z
??4Scanner@pcrecpp@@QAEAAV01@ABV01@@Z
??4StringPiece@pcrecpp@@QAEAAV01@ABV01@@Z
??8StringPiece@pcrecpp@@QBE_NABV01@@Z
??9StringPiece@pcrecpp@@QBE_NABV01@@Z
??AStringPiece@pcrecpp@@QBEDH@Z
??MStringPiece@pcrecpp@@QBE_NABV01@@Z
??NStringPiece@pcrecpp@@QBE_NABV01@@Z
??OStringPiece@pcrecpp@@QBE_NABV01@@Z
??PStringPiece@pcrecpp@@QBE_NABV01@@Z
?Cleanup@RE@pcrecpp@@AAEXXZ
?Compile@RE@pcrecpp@@AAEPAUreal_pcre@@W4Anchor@12@@Z
?Consume@RE@pcrecpp@@QBE_NPAVStringPiece@2@ABVArg@2@111111111111111@Z
?Consume@Scanner@pcrecpp@@QAE_NABVRE@2@ABVArg@2@11@Z
?ConsumeSkip@Scanner@pcrecpp@@AAEXXZ
?CopyToString@StringPiece@pcrecpp@@QBEXPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DisableSkip@Scanner@pcrecpp@@QAEXXZ
?DoMatch@RE@pcrecpp@@QBE_NABVStringPiece@2@W4Anchor@12@PAHPBQBVArg@2@H@Z
?DoMatchImpl@RE@pcrecpp@@ABE_NABVStringPiece@2@W4Anchor@12@PAHQBQBVArg@2@H2H@Z
?EnableSkip@Scanner@pcrecpp@@QAEXXZ
?Extract@RE@pcrecpp@@QBE_NABVStringPiece@2@0PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?FindAndConsume@RE@pcrecpp@@QBE_NPAVStringPiece@2@ABVArg@2@111111111111111@Z
?FullMatch@RE@pcrecpp@@QBE_NABVStringPiece@2@ABVArg@2@111111111111111@Z
?GetComments@Scanner@pcrecpp@@QAEXHHPAV?$vector@VStringPiece@pcrecpp@@V?$allocator@VStringPiece@pcrecpp@@@std@@@std@@@Z
?GetNextComments@Scanner@pcrecpp@@QAEXPAV?$vector@VStringPiece@pcrecpp@@V?$allocator@VStringPiece@pcrecpp@@@std@@@std@@@Z
?GlobalReplace@RE@pcrecpp@@QBEHABVStringPiece@2@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Init@RE@pcrecpp@@AAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBVRE_Options@2@@Z
?LineNumber@Scanner@pcrecpp@@QBEHXZ
?LookingAt@Scanner@pcrecpp@@QBE_NABVRE@2@@Z
?NumberOfCapturingGroups@RE@pcrecpp@@QBEHXZ
?Offset@Scanner@pcrecpp@@QBEHXZ
?Parse@Arg@pcrecpp@@QBE_NPBDH@Z
?PartialMatch@RE@pcrecpp@@QBE_NABVStringPiece@2@ABVArg@2@111111111111111@Z
?QuoteMeta@RE@pcrecpp@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVStringPiece@2@@Z
?Replace@RE@pcrecpp@@QBE_NABVStringPiece@2@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Rewrite@RE@pcrecpp@@ABE_NPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVStringPiece@2@1PAHH@Z
?SetSkipExpression@Scanner@pcrecpp@@QAEXPBD@Z
?Skip@Scanner@pcrecpp@@QAEXPBD@Z
?SkipCXXComments@Scanner@pcrecpp@@QAEXXZ
?TryMatch@RE@pcrecpp@@ABEHABVStringPiece@2@HW4Anchor@12@_NPAHH@Z
?all_options@RE_Options@pcrecpp@@QBEHXZ
?as_string@StringPiece@pcrecpp@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?caseless@RE_Options@pcrecpp@@QBE_NXZ
?clear@StringPiece@pcrecpp@@QAEXXZ
?compare@StringPiece@pcrecpp@@QBEHABV12@@Z
?data@StringPiece@pcrecpp@@QBEPBDXZ
?dollar_endonly@RE_Options@pcrecpp@@QBE_NXZ
?dotall@RE_Options@pcrecpp@@QBE_NXZ
?empty@StringPiece@pcrecpp@@QBE_NXZ
?error@RE@pcrecpp@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?extended@RE_Options@pcrecpp@@QBE_NXZ
?extra@RE_Options@pcrecpp@@QBE_NXZ
?match_limit@RE_Options@pcrecpp@@QBEHXZ
?match_limit_recursion@RE_Options@pcrecpp@@QBEHXZ
?multiline@RE_Options@pcrecpp@@QBE_NXZ
?no_arg@RE@pcrecpp@@2VArg@2@A
?no_auto_capture@RE_Options@pcrecpp@@QBE_NXZ
?parse_char@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_double@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_float@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_int@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_int_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_int_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_int_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_int_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_long@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_long_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_long_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_long_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_long_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_longlong@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_longlong_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_longlong_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_longlong_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_longlong_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_null@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_short@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_short_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_short_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_short_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_short_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_string@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_stringpiece@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_uchar@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_uint@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_uint_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_uint_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_uint_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_uint_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_ulong@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_ulong_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ulong_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ulong_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ulong_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_ulonglong@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_ulonglong_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ulonglong_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ulonglong_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ulonglong_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?parse_ushort@Arg@pcrecpp@@CA_NPBDHPAX@Z
?parse_ushort_cradix@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ushort_hex@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ushort_octal@Arg@pcrecpp@@SA_NPBDHPAX@Z
?parse_ushort_radix@Arg@pcrecpp@@CA_NPBDHPAXH@Z
?pattern@RE@pcrecpp@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?remove_prefix@StringPiece@pcrecpp@@QAEXH@Z
?remove_suffix@StringPiece@pcrecpp@@QAEXH@Z
?save_comments@Scanner@pcrecpp@@QAE_NXZ
?set@StringPiece@pcrecpp@@QAEXPBD@Z
?set@StringPiece@pcrecpp@@QAEXPBDH@Z
?set@StringPiece@pcrecpp@@QAEXPBXH@Z
?set_all_options@RE_Options@pcrecpp@@QAEAAV12@H@Z
?set_caseless@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_dollar_endonly@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_dotall@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_extended@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_extra@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_match_limit@RE_Options@pcrecpp@@QAEAAV12@H@Z
?set_match_limit_recursion@RE_Options@pcrecpp@@QAEAAV12@H@Z
?set_multiline@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_no_auto_capture@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_save_comments@Scanner@pcrecpp@@QAEX_N@Z
?set_ungreedy@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?set_utf8@RE_Options@pcrecpp@@QAEAAV12@_N@Z
?size@StringPiece@pcrecpp@@QBEHXZ
?starts_with@StringPiece@pcrecpp@@QBE_NABV12@@Z
?ungreedy@RE_Options@pcrecpp@@QBE_NXZ
?utf8@RE_Options@pcrecpp@@QBE_NXZ

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7979a859ceaa2d1b5ac69eb5a7f4ae5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pcre-0

msvcp60

msvcrt

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 1024B - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 1024B - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB