103aec136558e670f2f0665c33f3a3cf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

103aec136558e670f2f0665c33f3a3cf_JaffaCakes118
Size

464KB
MD5

103aec136558e670f2f0665c33f3a3cf
SHA1

1797c9e0cabf83ad58b1f1ac6902c775a8e009c6
SHA256

e2315c9181d838a903771895e0756d3a790328526e065e1687a41d0c78f3a871
SHA512

43ce9c04873878404da95bd027c1f68196127de5ff4960c41ec25569f48907bba4adf7317461492f79e75edb6b1c0960c28e4231120c1faa4cc7c30968de969a
SSDEEP

12288:rqMDAn/vgv7LISL8NOS09UA2k1OO0Wt1C+YoagO8iND3K:0nXgM06A2WO0cdNu

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/204618311/Examples/MyDll.dll
unpack001/204618311/Examples/MyProg.exe
unpack001/204618311/Files/isbunzip.dll
unpack001/204618311/Files/isbzip.dll
unpack001/204618311/Files/islzma.dll
unpack001/204618311/Files/isunzlib.dll
unpack001/204618311/Files/iszlib.dll

Files

103aec136558e670f2f0665c33f3a3cf_JaffaCakes118
.rar
204618311/Components/.cvsignore
204618311/Components/BitmapImage.pas
204618311/Components/DropListBox.pas
204618311/Components/FolderTreeView.pas
204618311/Components/NewCheckListBox.pas
204618311/Components/NewNotebook.pas
204618311/Components/NewNotebookReg.pas
204618311/Components/NewProgressBar.pas
204618311/Components/NewStaticText.pas
204618311/Components/PasswordEdit.pas
204618311/Components/PathFunc.pas
204618311/Components/RichEditViewer.pas
204618311/Components/SynHighlighterISXCode.pas
204618311/Components/SynHighlighterInno.pas
204618311/Components/TmSchemaISX.pas
204618311/Components/UxThemeISX.pas
204618311/Examples/CodeAutomation.iss
204618311/Examples/CodeClasses.iss
204618311/Examples/CodeDlg.iss
204618311/Examples/CodeDll.iss
204618311/Examples/CodeExample1.iss
204618311/Examples/Components.iss
204618311/Examples/Example1.iss
204618311/Examples/Example2.iss
204618311/Examples/Example3.iss
204618311/Examples/ISPPExample1.iss
204618311/Examples/ISPPExample1License.txt
204618311/Examples/Languages.iss
204618311/Examples/MyDll.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

MyDllFunc

Sections

CODE
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 610B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 70B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
204618311/Examples/MyDll/C/MyDll.c
204618311/Examples/MyDll/C/MyDll.def
204618311/Examples/MyDll/C/MyDll.dsp
204618311/Examples/MyDll/Delphi/MyDll.dpr
204618311/Examples/MyProg.exe
.exe windows:1 windows x86 arch:x86

a96d166ab17e011e8049d87211158ae5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

Sections

code
Size: 198B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IMPORTS
Size: 6B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

imports
Size: 82B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

relocs
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

resource
Size: 944B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
204618311/Examples/MyProg.hlp
204618311/Examples/Readme-Dutch.txt
204618311/Examples/Readme-German.txt
204618311/Examples/UninstallCodeExample1.iss
204618311/Files/.cvsignore
204618311/Files/Default.isl
204618311/Files/Languages/Catalan.isl
204618311/Files/Languages/Czech.isl
204618311/Files/Languages/Dutch.isl
204618311/Files/Languages/French.isl
204618311/Files/Languages/German.isl
204618311/Files/Languages/Norwegian.isl
204618311/Files/Languages/Polish.isl
204618311/Files/Languages/PortugueseStd.isl
204618311/Files/Languages/Russian.isl
204618311/Files/Languages/Slovenian.isl
204618311/Files/WizModernImage.bmp
204618311/Files/WizModernImage2.bmp
204618311/Files/WizModernSmallImage.bmp
204618311/Files/WizModernSmallImage2.bmp
204618311/Files/isbunzip.dll
.dll windows:4 windows x86 arch:x86

6c8408bb5d7d5a5b75b9314f94e68763

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls

Exports

Exports

BZ2_bzDecompress
BZ2_bzDecompressEnd
BZ2_bzDecompressInit

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 253B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 206B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
204618311/Files/isbzip.dll
.dll windows:4 windows x86 arch:x86

6c8408bb5d7d5a5b75b9314f94e68763

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls

Exports

Exports

BZ2_bzCompress
BZ2_bzCompressEnd
BZ2_bzCompressInit

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 245B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
204618311/Files/islzma.dll
.dll windows:4 windows x86 arch:x86

ad32499abddd762cbf2be2f7b8cc8f00

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateThread
WaitForSingleObject
SetEvent
ResetEvent
WaitForMultipleObjects
GetLastError
CreateEventA
VirtualFree
VirtualAlloc
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
InitializeCriticalSection
InterlockedExchange
VirtualQuery
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

oleaut32

SysFreeString
SysAllocString

Exports

Exports

LZMA_Encode
LZMA_End
LZMA_Init
LZMA_SetProps

Sections

.text
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
204618311/Files/isunzlib.dll
.dll windows:4 windows x86 arch:x86

6c8408bb5d7d5a5b75b9314f94e68763

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\zlib\Release\isunzlib.pdb

Imports

kernel32

DisableThreadLibraryCalls

Exports

Exports

inflate
inflateEnd
inflateInit_
inflateReset

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
204618311/Files/iszlib.dll
.dll windows:4 windows x86 arch:x86

6c8408bb5d7d5a5b75b9314f94e68763

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\zlib\Release\iszlib.pdb

Imports

kernel32

DisableThreadLibraryCalls

Exports

Exports

deflate
deflateEnd
deflateInit_

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
204618311/Projects/.cvsignore
204618311/Projects/ArcFour.pas
.js
204618311/Projects/CallOptimizer.pas
204618311/Projects/CmnFunc.pas
204618311/Projects/CmnFunc2.pas
204618311/Projects/CompFileAssoc.pas
.js
204618311/Projects/CompForm.dfm
204618311/Projects/CompForm.dfm.txt
204618311/Projects/CompForm.pas
.js
204618311/Projects/CompImages.res
204618311/Projects/CompInt.pas
.js
204618311/Projects/CompMsgs.pas
204618311/Projects/CompOptions.dfm
204618311/Projects/CompOptions.dfm.txt
204618311/Projects/CompOptions.pas
204618311/Projects/CompResUpdate.pas
204618311/Projects/CompStartup.dfm
204618311/Projects/CompStartup.dfm.txt
204618311/Projects/CompStartup.pas
204618311/Projects/CompWizard.dfm
204618311/Projects/CompWizard.dfm.txt
204618311/Projects/CompWizard.pas
204618311/Projects/CompWizardFile.dfm
204618311/Projects/CompWizardFile.dfm.txt
204618311/Projects/CompWizardFile.pas
204618311/Projects/Compil32.dof
204618311/Projects/Compil32.dpr
204618311/Projects/Compil32.res
204618311/Projects/Compile.pas
.js
204618311/Projects/Compress.pas
.js
204618311/Projects/DebugClient.pas
204618311/Projects/DebugStruct.pas
204618311/Projects/Extract.pas
204618311/Projects/FileClass.pas
204618311/Projects/ISCC.dof
204618311/Projects/ISCC.dpr
204618311/Projects/ISCC.res
204618311/Projects/ISCmplr.dof
204618311/Projects/ISCmplr.dpr
204618311/Projects/ISCmplr.res
204618311/Projects/Images.res
204618311/Projects/InstFnc2.pas
.js
204618311/Projects/InstFunc.pas
.js
204618311/Projects/Install.pas
204618311/Projects/Int64Em.pas
204618311/Projects/LZMA.pas
.js
204618311/Projects/Logging.pas
204618311/Projects/LzmaDecode/LzmaDecode.c
204618311/Projects/LzmaDecode/LzmaDecode.h
204618311/Projects/LzmaDecode/LzmaDecode.obj
204618311/Projects/LzmaDecode/compiling.txt
204618311/Projects/LzmaDecode/copying.txt
204618311/Projects/LzmaDecode/license-LZMA.txt
204618311/Projects/MD5.pas
204618311/Projects/Main.dfm
204618311/Projects/Main.dfm.txt
204618311/Projects/Main.pas
204618311/Projects/MsgIDs.pas
204618311/Projects/Msgs.pas
204618311/Projects/NewDisk.dfm
204618311/Projects/NewDisk.dfm.txt
204618311/Projects/NewDisk.pas
204618311/Projects/RegSvr.pas
204618311/Projects/ScriptClasses_C.pas
204618311/Projects/ScriptClasses_R.pas
204618311/Projects/ScriptCompiler.pas
.js
204618311/Projects/ScriptDlg.pas
204618311/Projects/ScriptFunc.pas
.js
204618311/Projects/ScriptFunc_C.pas
204618311/Projects/ScriptFunc_R.pas
.js
204618311/Projects/ScriptRunner.pas
204618311/Projects/SelFolderForm.dfm
204618311/Projects/SelFolderForm.dfm.txt
204618311/Projects/SelFolderForm.pas
204618311/Projects/SelLangForm.dfm
204618311/Projects/SelLangForm.dfm.txt
204618311/Projects/SelLangForm.pas
204618311/Projects/Setup.dof
204618311/Projects/Setup.dpr
204618311/Projects/Setup.res
204618311/Projects/SetupEnt.pas
.js
204618311/Projects/SetupForm.pas
204618311/Projects/SetupLdr.dof
204618311/Projects/SetupLdr.dpr
204618311/Projects/SetupLdr.res
204618311/Projects/SetupTypes.pas
204618311/Projects/SimpleExpression.pas
.js
204618311/Projects/Struct.pas
204618311/Projects/UIStateForm.pas
204618311/Projects/Undo.pas
204618311/Projects/UninstProgressForm.dfm
204618311/Projects/UninstProgressForm.dfm.txt
204618311/Projects/UninstProgressForm.pas
204618311/Projects/UninstSharedFileForm.dfm
204618311/Projects/UninstSharedFileForm.dfm.txt
204618311/Projects/UninstSharedFileForm.pas
204618311/Projects/Uninstall.pas
204618311/Projects/VerInfo.pas
204618311/Projects/Version.inc
204618311/Projects/Wizard.dfm
204618311/Projects/Wizard.dfm.txt
204618311/Projects/Wizard.pas
204618311/Projects/XPTheme.manifest
.xml
204618311/Projects/XPTheme.pas
204618311/Projects/XPTheme.rc
204618311/Projects/XPTheme.res
204618311/Projects/_shfoldr.rc
204618311/Projects/_shfoldr.res
204618311/Projects/bzlib.pas
.js
204618311/Projects/zlib.pas
.js
204618311/compile.bat
.bat .vbs
204618311/license.txt
204618311/setup.iss
204618311/whatsnew.htm
.html
204618311/下载说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 3KB - Virtual size: 3KB

DATA Size: 512B - Virtual size: 128B

BSS Size: - Virtual size: 1KB

.idata Size: 1024B - Virtual size: 610B

.edata Size: 512B - Virtual size: 70B

.reloc Size: 512B - Virtual size: 296B

.rsrc Size: 512B - Virtual size:

a96d166ab17e011e8049d87211158ae5

Headers

File Characteristics

Imports

user32

Sections

code Size: 198B - Virtual size: 4KB

IMPORTS Size: 6B - Virtual size: 4KB

imports Size: 82B - Virtual size: 4KB

relocs Size: - Virtual size: 4KB

resource Size: 944B - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 4KB

6c8408bb5d7d5a5b75b9314f94e68763

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 13KB

.rdata Size: 4KB - Virtual size: 253B

.data Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 206B

6c8408bb5d7d5a5b75b9314f94e68763

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 245B

.data Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 216B

ad32499abddd762cbf2be2f7b8cc8f00

Headers

File Characteristics

Imports

kernel32

oleaut32

Exports

Exports

Sections

.text Size: 79KB - Virtual size: 78KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 8KB

.reloc Size: 6KB - Virtual size: 5KB

6c8408bb5d7d5a5b75b9314f94e68763

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 142B

6c8408bb5d7d5a5b75b9314f94e68763

CODE
Size: 3KB - Virtual size: 3KB

DATA
Size: 512B - Virtual size: 128B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1024B - Virtual size: 610B

.edata
Size: 512B - Virtual size: 70B

.reloc
Size: 512B - Virtual size: 296B

.rsrc
Size: 512B - Virtual size:

code
Size: 198B - Virtual size: 4KB

IMPORTS
Size: 6B - Virtual size: 4KB

imports
Size: 82B - Virtual size: 4KB

relocs
Size: - Virtual size: 4KB

resource
Size: 944B - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 4KB

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 4KB - Virtual size: 253B

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 206B

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 245B

.data
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 216B

.text
Size: 79KB - Virtual size: 78KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 8KB

.reloc
Size: 6KB - Virtual size: 5KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 142B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 60B

.reloc
Size: 512B - Virtual size: 212B