07d9d1a74fca2a745e352d7861f92162_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

07d9d1a74fca2a745e352d7861f92162_JaffaCakes118
Size

91KB
MD5

07d9d1a74fca2a745e352d7861f92162
SHA1

863ce9096c59186f93609c1b2f1b593088f144f0
SHA256

a38fc798fecf2403afa06bf397a53d7335dd06c9199374f78a724c155727c23e
SHA512

7b2786647601c012ffc2fb183f3ff44e0ee6be42ba5d55b706e2f82658ae967686218e14a51978fecc147ff1ab03ef0aa37dd3e3cc369195ee63ad86ee206740
SSDEEP

1536:dTAdW5W53IwqNQl+vuuXS4FDk6P1TB7FXhXbUzXAbBDBGUkGO2NlQR7cUD4:ZAdW5s2NM+uuXvBBX9bUzX8DBGTGOwQF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07d9d1a74fca2a745e352d7861f92162_JaffaCakes118

Files

07d9d1a74fca2a745e352d7861f92162_JaffaCakes118
.dll windows:5 windows x86 arch:x86

d14df585f0c6dabac5bb38fbe3643787

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

o:\OOO320\src\registry\wntmsci12.pro\bin\reg3.pdb

Imports

sal3

rtl_string_newFromStr
rtl_str_getLength
rtl_uString_new
rtl_string_new
rtl_string_acquire
rtl_uString2String
rtl_string_release
rtl_string_assign
rtl_uString_release
rtl_ustr_getLength
rtl_copyMemory
rtl_uString_getLength
rtl_uString_acquire
rtl_uString_assign
rtl_freeMemory
rtl_uString_newFromString
rtl_allocateZeroMemory
rtl_uStringbuffer_newFromStr_WithLength
rtl_ustr_reverseCompare_WithLength
osl_getThreadTextEncoding
rtl_allocateMemory
osl_getSystemPathFromFileURL
rtl_uStringbuffer_insert
rtl_uString_new_WithLength
rtl_uString_getToken
rtl_uString_newFromStr_WithLength
rtl_ustr_lastIndexOfChar_WithLength
rtl_ustr_hashCode_WithLength
rtl_ustr_compare_WithLength
rtl_uString_newConcat
rtl_uString_newFromStr
rtl_string_newConcat
rtl_string2UString
osl_releaseMutex
osl_acquireMutex
osl_destroyMutex
osl_createMutex

store3

store_releaseHandle
store_flushFile
store_closeFile
store_createMemoryFile
store_openFile
store_findNext
store_findFirst
store_openDirectory
store_acquireHandle
store_writeStream
store_readStream
store_openStream
store_flushStream
store_remove

msvcr90

??2@YAPAXI@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
fprintf
__iob_func
printf
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
??1exception@std@@UAE@XZ
_unlink
??3@YAXPAX@Z
__CxxFrameHandler3
??_V@YAXPAX@Z
memcpy
??_U@YAPAXI@Z

kernel32

GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
InterlockedExchange
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep

stlport_vc7145

?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@ABV?$allocator@PAX@1@@Z
?get_allocator@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QBE?AV?$allocator@PAX@2@XZ
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@IABQAXABV?$allocator@PAX@1@@Z
?swap@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXAAV12@@Z
??1?$allocator@PAX@_STL@@QAE@XZ
?reserve@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXI@Z
?_M_fill_insert@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXPAPAXIABQAX@Z
??1?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@XZ
?_Rebalance@?$_Rb_global@_N@_STL@@SAXPAU_Rb_tree_node_base@2@AAPAU32@@Z
?_M_decrement@?$_Rb_global@_N@_STL@@SAPAU_Rb_tree_node_base@2@PAU32@@Z
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z

Exports

Exports

GetVersionInfo
initRegistryTypeReader_Api
initRegistryTypeWriter_Api
initRegistry_Api
reg_closeKey
reg_closeRegistry
reg_closeSubKeys
reg_createKey
reg_createLink
reg_createRegistry
reg_deleteKey
reg_deleteLink
reg_destroyRegistry
reg_dumpRegistry
reg_freeValueList
reg_getKeyName
reg_getKeyType
reg_getLinkTarget
reg_getLongListValue
reg_getName
reg_getResolvedKeyName
reg_getStringListValue
reg_getUnicodeListValue
reg_getValue
reg_getValueInfo
reg_isReadOnly
reg_loadKey
reg_mergeKey
reg_openKey
reg_openRegistry
reg_openRootKey
reg_openSubKeys
reg_saveKey
reg_setLongListValue
reg_setStringListValue
reg_setUnicodeListValue
reg_setValue
typereg_reader_acquire
typereg_reader_create
typereg_reader_getDocumentation
typereg_reader_getFieldCount
typereg_reader_getFieldDocumentation
typereg_reader_getFieldFileName
typereg_reader_getFieldFlags
typereg_reader_getFieldName
typereg_reader_getFieldTypeName
typereg_reader_getFieldValue
typereg_reader_getFileName
typereg_reader_getMethodCount
typereg_reader_getMethodDocumentation
typereg_reader_getMethodExceptionCount
typereg_reader_getMethodExceptionTypeName
typereg_reader_getMethodFlags
typereg_reader_getMethodName
typereg_reader_getMethodParameterCount
typereg_reader_getMethodParameterFlags
typereg_reader_getMethodParameterName
typereg_reader_getMethodParameterTypeName
typereg_reader_getMethodReturnTypeName
typereg_reader_getReferenceCount
typereg_reader_getReferenceDocumentation
typereg_reader_getReferenceFlags
typereg_reader_getReferenceSort
typereg_reader_getReferenceTypeName
typereg_reader_getSuperTypeCount
typereg_reader_getSuperTypeName
typereg_reader_getTypeClass
typereg_reader_getTypeName
typereg_reader_getVersion
typereg_reader_isPublished
typereg_reader_release
typereg_writer_create
typereg_writer_destroy
typereg_writer_getBlob
typereg_writer_setFieldData
typereg_writer_setMethodData
typereg_writer_setMethodExceptionTypeName
typereg_writer_setMethodParameterData
typereg_writer_setReferenceData
typereg_writer_setSuperTypeName

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d14df585f0c6dabac5bb38fbe3643787

Headers

File Characteristics

PDB Paths

Imports

sal3

store3

msvcr90

kernel32

stlport_vc7145

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB