09e13865b85996a845d0f3e9e24ad238_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

09e13865b85996a845d0f3e9e24ad238_JaffaCakes118
Size

105KB
MD5

09e13865b85996a845d0f3e9e24ad238
SHA1

897fae2fca0da35cc118e78276d6c19ea454641a
SHA256

a973a812500ee8567f41a8615c746c0999dc648763c4e42cf7bdb338b1a69503
SHA512

c532932fb8ab49b8e3654e0164e46501cf56f1b79092f400ea9ff797354aecada3ebc0fc021d190d5d2bf31ac4a28d6533fe6fcd1fdaa36ca85b12025f54186c
SSDEEP

3072:VLNTzzH1p0qbZoQlAuSBQl/YEtdyB5VtG62OXP3:VlzHrZFFXl/YE8Vt92OX/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09e13865b85996a845d0f3e9e24ad238_JaffaCakes118

Files

09e13865b85996a845d0f3e9e24ad238_JaffaCakes118
.dll windows:5 windows x86 arch:x86

df2ab948fad630fe2cae9e47c07d249e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\master\clone\ure\jvmfwk\wntmsci12.pro\bin\jvmfwk3.pdb

Imports

cppuhelper3msc

?bootstrap_expandUri@cppu@@YA?AVOUString@rtl@@ABV23@@Z

sal3

osl_searchFileURL
osl_getExecutableFile
rtl_uriConvertRelToAbs
rtl_bootstrap_get
osl_getModuleURLFromFunctionAddress
rtl_ustr_lastIndexOfChar_WithLength
rtl_ustr_indexOfChar_WithLength
rtl_string_newFromStr_WithLength
osl_getSystemTime
osl_createDirectoryPath
osl_getFileStatus
osl_releaseDirectoryItem
osl_setFileSize
osl_setFilePos
osl_closeFile
osl_openFile
rtl_fillMemory
rtl_byte_sequence_reference2One
rtl_byte_sequence_constructFromArray
rtl_byte_sequence_assign
rtl_byte_sequence_construct
rtl_ustr_valueOfInt64
rtl_str_toInt64
rtl_str_getLength
osl_getSystemPathFromFileURL
rtl_bootstrap_get_from_handle
rtl_bootstrap_args_open
osl_getFileURLFromSystemPath
osl_getAbsoluteFileURL
rtl_uStringbuffer_insert_ascii
rtl_uStringbuffer_insert
rtl_uString_new_WithLength
rtl_uString_newFromAscii
rtl_ustr_valueOfInt32
rtl_uString_newFromStr_WithLength
rtl_ustr_toInt64
rtl_uString_getToken
rtl_uString_newTrim
rtl_uString_newConcat
rtl_uString_assign
osl_getThreadTextEncoding
osl_loadModule
rtl_allocateMemory
rtl_copyMemory
rtl_freeMemory
osl_getGlobalMutex
osl_releaseMutex
osl_acquireMutex
osl_destroyMutex
osl_createMutex
osl_getFunctionSymbol
osl_unloadModule
rtl_byte_sequence_equals
rtl_byte_sequence_release
rtl_byte_sequence_acquire
rtl_ustr_reverseCompare_WithLength
rtl_ustr_compare_WithLength
rtl_uString_release
rtl_string2UString
rtl_uString_acquire
rtl_uString_new
rtl_string_newConcat
rtl_str_reverseCompare_WithLength
rtl_str_compare_WithLength
rtl_string_assign
rtl_string_release
rtl_uString2String
rtl_string_newFromStr
rtl_string_acquire
rtl_string_new
osl_getDirectoryItem

libxml2

xmlStrcmp
xmlNodeSetContent
xmlSaveFormatFile
xmlNewDoc
xmlNewDocComment
xmlNewDocNode
xmlNewNs
xmlDocSetRootElement
xmlNewComment
xmlAddPrevSibling
xmlSaveFormatFileEnc
xmlSetProp
xmlUnlinkNode
xmlXPathFreeObject
xmlXPathFreeContext
xmlFreeDoc
xmlCharStrdup
xmlFree
xmlNodeListGetString
xmlXPathEvalExpression
xmlXPathRegisterNs
xmlXPathNewContext
xmlParseFile
xmlFreeNode
xmlGetProp
xmlAddChild
xmlNewText
xmlSetNsProp
xmlNewTextChild
xmlSearchNsByHref
xmlDocGetRootElement
xmlGetNsProp
xmlNodeSetContentLen
xmlNewChild

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

msvcr90

_except_handler4_common
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_crt_debugger_hook
_encode_pointer
getenv
??_U@YAPAXI@Z
__iob_func
fprintf
??2@YAPAXI@Z
_invalid_parameter_noinfo
??_V@YAXPAX@Z
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_malloc_crt
__CppXcptFilter

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent
GetCurrentThreadId

Exports

Exports

GetVersionInfo
jfw_addJRELocation
jfw_areEqualJavaInfo
jfw_existJRE
jfw_findAllJREs
jfw_findAndSelectJRE
jfw_freeJavaInfo
jfw_getEnabled
jfw_getJRELocations
jfw_getJavaInfoByPath
jfw_getSelectedJRE
jfw_getUserClassPath
jfw_getVMParameters
jfw_isVMRunning
jfw_lock
jfw_setEnabled
jfw_setJRELocations
jfw_setSelectedJRE
jfw_setUserClassPath
jfw_setVMParameters
jfw_startVM
jfw_unlock

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df2ab948fad630fe2cae9e47c07d249e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

cppuhelper3msc

sal3

libxml2

advapi32

msvcr90

msvcp90

kernel32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 68KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 68KB - Virtual size: 68KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB