0bb7b8a9d48ef98a7c3e6b6ca46352ef_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0bb7b8a9d48ef98a7c3e6b6ca46352ef_JaffaCakes118
Size

31KB
MD5

0bb7b8a9d48ef98a7c3e6b6ca46352ef
SHA1

67b23306b58a82ae7aa4b80d6039daf0c6ff81b1
SHA256

a4b355e64ac2ca822bf75d321bc485edb35881bab10255adcb68f82da9e7be69
SHA512

801e19127e13de77a70395e467d4edae281aa14ceb83e540008b79eddfdcc80ebce12b96fe951145588cb28b1f9e3197327528904a108d3a7467b25ae8fc7b22
SSDEEP

384:FmTVLaHXpXCdZ1uP8cDVUC6qu/vbsqL98ub7K4hEsoxnk9w/wzxB82Ol86qYsf6y:FAsSwkcDK/TpLyuXSxrwzxW2OlXsfB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bb7b8a9d48ef98a7c3e6b6ca46352ef_JaffaCakes118

Files

0bb7b8a9d48ef98a7c3e6b6ca46352ef_JaffaCakes118
.dll windows:5 windows x64 arch:x64

1d1a64ff799aa98d534cb79004054cfb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

qtgui4

?setDevice@QImageIOHandler@@QEAAXPEAVQIODevice@@@Z
?setFormat@QImageIOHandler@@QEAAXAEBVQByteArray@@@Z
??1QImageIOPlugin@@UEAA@XZ
?qt_metacall@QImageIOPlugin@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QImageIOPlugin@@UEAAPEAXPEBD@Z
?metaObject@QImageIOPlugin@@UEBAPEBUQMetaObject@@XZ
??0QImageIOPlugin@@QEAA@PEAVQObject@@@Z
?currentImageRect@QImageIOHandler@@UEBA?AVQRect@@XZ
?jumpToImage@QImageIOHandler@@UEAA_NH@Z
?jumpToNextImage@QImageIOHandler@@UEAA_NXZ
??0QImageIOHandler@@QEAA@XZ
??1QImageIOHandler@@UEAA@XZ
??4QImage@@QEAAAEAV0@AEBV0@@Z
?setFormat@QImageIOHandler@@QEBAXAEBVQByteArray@@@Z
?detach@QImage@@QEAAXXZ
?bytesPerLine@QImage@@QEBAHXZ
?isNull@QImage@@QEBA_NXZ
??0QImage@@QEAA@HHW4Format@0@@Z
??4QImage@@QEAAAEAV0@$$QEAV0@@Z
?byteCount@QImage@@QEBAHXZ
?width@QImage@@QEBAHXZ
?height@QImage@@QEBAHXZ
?bits@QImage@@QEAAPEAEXZ
?device@QImageIOHandler@@QEBAPEAVQIODevice@@XZ
?scanLine@QImage@@QEAAPEAEH@Z
??1QImage@@UEAA@XZ
??0QImage@@QEAA@XZ

qtcore4

?shared_null@QByteArray@@0UData@1@A
?shared_null@QString@@0UData@1@A
?free@QString@@CAXPEAUData@1@@Z
??4QByteArray@@QEAAAEAV0@$$QEAV0@@Z
??0QVariant@@QEAA@_N@Z
??1QVariant@@QEAA@XZ
??0QVariant@@QEAA@AEBV0@@Z
??0QVariant@@QEAA@XZ
??0QVariant@@QEAA@AEBVQSize@@@Z
?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXPEBD@Z
?disconnectNotify@QObject@@MEAAXPEBD@Z
?shared_null@QListData@@2UData@1@A
?removeGuard@QMetaObject@@SAXPEAPEAVQObject@@@Z
?changeGuard@QMetaObject@@SAXPEAPEAVQObject@@PEAV2@@Z
??0QString@@QEAA@AEBV0@@Z
?isReadable@QIODevice@@QEBA_NXZ
?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z
?detach@QListData@@QEAAPEAUData@1@H@Z
?append@QListData@@QEAAPEAPEAXXZ
?fromLatin1_helper@QString@@CAPEAUData@1@PEBDH@Z
?grow@QVectorData@@SAHHHH_N@Z
?read@QIODevice@@QEAA?AVQByteArray@@_J@Z
?append@QByteArray@@QEAAAEAV1@AEBV1@@Z
?qFree@@YAXPEAX@Z
?remove@QByteArray@@QEAAAEAV1@HH@Z
??1QByteArray@@QEAA@XZ
?reallocate@QVectorData@@SAPEAU1@PEAU1@HHH@Z
?allocate@QVectorData@@SAPEAU1@HH@Z
?qBadAlloc@@YAXXZ
?free@QVectorData@@SAXPEAU1@H@Z
?shared_null@QVectorData@@2U1@A
??0QByteArray@@QEAA@PEBD@Z
?qWarning@@YAXPEBDZZ
?peek@QIODevice@@QEAA_JPEAD_J@Z
??1QString@@QEAA@XZ

msvcr100

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
__CppXcptFilter
_amsg_exit
_encoded_null
free
_initterm_e
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
??2@YAPEAX_K@Z
memset
_CxxThrowException
__CxxFrameHandler3
memcpy
??3@YAXPEAX@Z
??_V@YAXPEAX@Z
strncmp
_initterm

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
DecodePointer
EncodePointer

Exports

Exports

qt_plugin_instance
qt_plugin_query_verification_data

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 194B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d1a64ff799aa98d534cb79004054cfb

Headers

DLL Characteristics

File Characteristics

Imports

qtgui4

qtcore4

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 194B

.text
Size: 15KB - Virtual size: 15KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 194B