883008a9b5bff94a153d99dba54cb5c1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

883008a9b5bff94a153d99dba54cb5c1_JaffaCakes118
Size

354KB
MD5

883008a9b5bff94a153d99dba54cb5c1
SHA1

a697e3eff93d720cbda509edae34400c7e8ae676
SHA256

9ef1dbccca4603a44d07e676870df71e0b5b9b1ba1abf70c09ee4e661cfe0537
SHA512

ff90a5d2580e2bbe0282adb5d1b51fa03870a908c56f1a25c155732897c8065983bac0c3c350121e9ac3006467ac71fe11e072a02b55d7081a5aa904233d5731
SSDEEP

3072:iqPNr0oP62QxL5HjLSn/oLRK8xMphjOltXd+u59Vm6pbp/lvwyoOPT:xFr0Nl5qn/QLxGeVt+O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
883008a9b5bff94a153d99dba54cb5c1_JaffaCakes118

Files

883008a9b5bff94a153d99dba54cb5c1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3ff357ae16544c40b9d4015b4372c165

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Hudson\AlternateWS\GrandPrix\GrandPrix_Test\Grand_Prix\distributables\bin\hpqgpc01.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msvcr90

wcscpy
wcslen
wcscmp
swprintf_s
sprintf_s
memcpy_s
_ltow
_recalloc
__CxxFrameHandler3
??_V@YAXPAX@Z
free
??3@YAXPAX@Z
memset
??_U@YAPAXI@Z
memcmp
calloc
wcscat_s
wcscat
??2@YAPAXI@Z
_except_handler3
malloc
_resetstkoflw
wcsncpy_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_itow
_wtol
iswspace
wcstok
_wcsicmp
wcsstr
wcsnlen
fprintf
_vscwprintf
fflush
_swprintf
wcsncpy
fclose
fopen
wcscpy_s
vswprintf_s
memmove_s

mfc90u

ord1248
ord1250
ord1254
ord3589
ord1243
ord462
ord4455
ord6723
ord710
ord338
ord2337
ord2771
ord2983
ord3112
ord4728
ord2966
ord2774
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4681
ord614
ord3993
ord4905
ord3773
ord3959
ord3966
ord3082
ord6822
ord5778
ord1707
ord2084
ord2571
ord258
ord6811
ord5767

kernel32

GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
SetLastError
GetCurrentProcess
FlushInstructionCache
GetPrivateProfileStringW
GetPrivateProfileIntW
FindFirstFileW
FindClose
GetSystemDefaultLangID
lstrlenA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WideCharToMultiByte
MultiByteToWideChar
GetVersionExW
LoadLibraryW
FreeLibrary
GetCurrentProcessId
SetEvent
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
CreateEventW
CreateThread
Sleep
InterlockedDecrement
InterlockedIncrement
CreateMutexW
WaitForSingleObject
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
CreateProcessW
GetLastError
FormatMessageW
LocalFree
GetModuleFileNameW
lstrlenW
GetUserDefaultLCID
FindResourceExW
FindResourceW
LoadResource
LockResource
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetCommandLineW
GetLocalTime

user32

GetClassInfoExW
LoadCursorA
GetClassInfoExA
UnregisterClassA
LoadCursorW
RegisterClassExA
RegisterClassExW
KillTimer
SetTimer
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
CharNextW
CharUpperW
CallWindowProcW
GetWindowLongW
DefWindowProcW
CreateWindowExW
ShowWindow
SetWindowTextW
SetWindowLongW
CharUpperBuffW
LoadStringW
MessageBoxW
UnregisterClassW

winspool.drv

EnumJobsW
OpenPrinterW
SetJobW
ClosePrinter
SetPrinterW

advapi32

RegCloseKey
RegOpenKeyW
RegQueryValueExW

shell32

SHGetFolderPathW
SHCreateDirectoryExW

shlwapi

PathAppendW
PathRemoveFileSpecW
PathStripPathW
PathFindExtensionW
PathFileExistsW

ole32

CoCreateInstance
CoInitialize
StringFromCLSID
CLSIDFromString
CoTaskMemFree
CoUninitialize
StringFromGUID2
CoTaskMemAlloc

oleaut32

UnRegisterTypeLi
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
SysAllocString
SysFreeString
SysAllocStringLen
SysAllocStringByteLen
BSTR_UserFree
SysStringByteLen
VariantInit
VarBstrCmp
VarBstrCat
SafeArrayPutElement
SafeArrayCreateEx
GetRecordInfoFromTypeInfo
LoadRegTypeLi
SysStringLen
LoadTypeLi
VariantClear
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserUnmarshal
LPSAFEARRAY_UserMarshal
LPSAFEARRAY_UserSize
RegisterTypeLi

atl90

ord58
ord67
ord43
ord30
ord49
ord31
ord32
ord11
ord10
ord23
ord61
ord56
ord68
ord64
ord20
ord17
ord44

rpcrt4

CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrStubCall2
NdrStubForwardingFunction
NdrOleFree
NdrOleAllocate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrCStdStubBuffer2_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy

Sections

.text
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ff357ae16544c40b9d4015b4372c165

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

msvcr90

mfc90u

kernel32

user32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

atl90

rpcrt4

Sections

.text Size: 183KB - Virtual size: 182KB

.orpc Size: 4KB - Virtual size: 4KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 11KB - Virtual size: 17KB

.idata Size: 9KB - Virtual size: 8KB

.rsrc Size: 17KB - Virtual size: 16KB

.text
Size: 183KB - Virtual size: 182KB

.orpc
Size: 4KB - Virtual size: 4KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 11KB - Virtual size: 17KB

.idata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 17KB - Virtual size: 16KB