0b3a16fa9b2511477c7ffafd94b5605c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0b3a16fa9b2511477c7ffafd94b5605c_JaffaCakes118
Size

168KB
MD5

0b3a16fa9b2511477c7ffafd94b5605c
SHA1

b98e3e52580ec45206f7d746c18b4464d7ecb44d
SHA256

89c6daf653ddca0d04d1ee4d4e307014417b3457fe029d4c29e68cea39dcc2a0
SHA512

094bc6b5004c4758a0aac617619175e42b43435f0c8509045106e8d4937253c02b5556f61d5a2b3a73d70b747e6e3c86fb71735ccf9cdc59246abf16904025b2
SSDEEP

3072:7xqTXmkpJ2SUztkgBsNQ4WrDsmmII2KRgXDszGmQ:7xqSGRgQQ4Wj5q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b3a16fa9b2511477c7ffafd94b5605c_JaffaCakes118

Files

0b3a16fa9b2511477c7ffafd94b5605c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

21fa4560601d2977ebf3b51662847646

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WaitForSingleObject
CreateEventA
SetEvent
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
SetCommMask
PurgeComm
SetupComm
SetCommState
SetCommTimeouts
GetCommState
CreateFileA
WaitCommEvent
ReadFile
GetOverlappedResult
WriteFile
GetLastError
ResetEvent
ClearCommError
DeviceIoControl
GetProcAddress
LoadLibraryA
Sleep
ReleaseMutex
MapViewOfFile
CreateFileMappingA
CreateMutexA
UnmapViewOfFile
GetTickCount
CreateThread
ReleaseSemaphore
CreateSemaphoreA
CompareStringW
CompareStringA
FlushFileBuffers
GetStringTypeW
GetStringTypeA
GetDriveTypeA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetCurrentDirectoryW
GetTimeZoneInformation
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
RtlUnwind
UnhandledExceptionFilter
TlsGetValue
SetLastError
TlsFree
TlsAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetCurrentProcess
TerminateProcess
ExitProcess
GetStartupInfoA
GetStdHandle
SetHandleCount
SetFilePointer
SetEndOfFile
SetStdHandle
GetCurrentDirectoryA
SetEnvironmentVariableA
GetFullPathNameW
InterlockedIncrement
InterlockedDecrement
GetVersion
GetCommandLineA
HeapReAlloc
ExitThread
TlsSetValue
GetCurrentThreadId
HeapFree
HeapAlloc
CreateDirectoryW
FindNextFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetFileType
CreateFileW
DeleteFileW
MoveFileW

ws2_32

inet_addr
sendto
bind
listen
WSAStartup
select
closesocket
__WSAFDIsSet
accept
recv
htons
htonl
ntohs
ntohl
WSAGetLastError
socket
send
WSACleanup
recvfrom

winmm

timeSetEvent

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA

libobex

LGOBEX_Terminate
OBEX_Init
LGOBEX_Initialize
OBEX_TransportDisconnect
OBEX_Request
OBEX_ObjectAddHeader
OBEX_ObjectNew
OBEX_Cleanup
LGOBEX_Abort
LGOBEX_RfcTransportConnect
LGOBEX_Disconnect
LGOBEX_ReservedRequest
OBEX_ObjectReadStream
OBEX_ObjectSetNonHdrData
OBEX_ObjectGetNextHeader
OBEX_ResponseToString
OBEX_CancelRequest

liblgbtconipc

LGBTCON_IPC_InitializePCBT
LGBTCON_IPC_Terminate
LGBTCON_IPC_SetTrace
LGBTCON_IPC_GetTransportInfo
LGBTCON_IPC_SearchCancel
LGBTCON_IPC_Search
LGBTCON_IPC_PairRequest
LGBTCON_IPC_Unpair
LGBTCON_IPC_GetDeviceInfo
LGBTCON_IPC_RfcSend
LGBTCON_IPC_CreateAppID
LGBTCON_IPC_DestroyAppID
LGBTCON_IPC_RfcDisconnect
LGBTCON_IPC_RfcConnect
LGBTCON_IPC_RfcRecv
LGBTCON_IPC_IsInitialized
LGBTCON_IPC_RfcEnableService
LGBTCON_IPC_RfcDisableService
LGBTCON_IPC_GetLastError

Exports

Exports

BAP_AAS_CheckConnection
BAP_AAS_Connect
BAP_AAS_Disconnect
BAP_AAS_Final
BAP_AAS_GetItemServerPath
BAP_AAS_Init
BAP_AAS_SetExportFileType
BAP_AAS_SetItem
BAP_AAS_SetItemServerPath
BAP_AAS_SetServerType
BAP_AAS_SetTempFolder
BAP_AAS_StartTransfer
BAP_AAS_StopTransfer
BAP_AT_CMD_Final
BAP_AT_CMD_Init
BAP_AT_Disc
BAP_AT_SendCMD
BAP_DUN_Connect
BAP_DUN_Disconnect
BAP_GetDeviceInfo
BAP_GetStackVersion
BAP_Initialize
BAP_PairRequest
BAP_Search
BAP_SearchCancel
BAP_SetTrace
BAP_Terminate
BAP_Unpair
BAP_VDP_Disable
BAP_VDP_Enable
BAP_VDP_SetCodec
BAP_VDP_SetDebug
BAP_VDP_TEST_SetLayer
BAP_VPH_Disable
BAP_VPH_Disc
BAP_VPH_Enable
BAP_VPH_GetGSMCharLen
BAP_VPH_GetGlobalPeriod
BAP_VPH_Pause
BAP_VPH_ReadSMS
BAP_VPH_Resume
BAP_VPH_SearchPBInfo
BAP_VPH_SendSMS
BAP_VPH_SetGlobalPeriod

Sections

.text
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 197.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

21fa4560601d2977ebf3b51662847646

Headers

File Characteristics

Imports

kernel32

ws2_32

winmm

setupapi

libobex

liblgbtconipc

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 86KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 16KB - Virtual size: 197.4MB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 48KB - Virtual size: 47KB

.text
Size: 88KB - Virtual size: 86KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 16KB - Virtual size: 197.4MB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 48KB - Virtual size: 47KB