27ac005bb300fe5859b407689bb42d6e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

27ac005bb300fe5859b407689bb42d6e_JaffaCakes118
Size

164KB
MD5

27ac005bb300fe5859b407689bb42d6e
SHA1

21b08264ed4940b2d4cf23c24fa10ebeb24650c5
SHA256

c63f1b7896035b68c61cb17ec2e3c5badda027b543e379408d5b531e9df32c00
SHA512

d6f3d4ec63bdbbcfc2d93c98e3b4b67c953e939da11d2446f9e1c9312fc087e32f811e2a2d988207d910e6acb5dbb65823ca4c26e00b8ec008b7f39be8492580
SSDEEP

3072:I1UihNWD3sDxQSpgti83GnkzCa7aakoKWvPKgqgrzJv:IZciE3GkzCaGmvPKWXJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27ac005bb300fe5859b407689bb42d6e_JaffaCakes118

Files

27ac005bb300fe5859b407689bb42d6e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

78b4aaf7aecff0ff8db853ee46c16f7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

s:\mmjb\src\_bin\release\UPnPSvr.pdb

Imports

mm.intelupnp

?Start@@YAHPAUmsInstance@@@Z
?SetSystemUpdateID@@YAXI@Z
?End@@YAXXZ

eventmgr

??1mcEvent@@UAE@XZ
??0mcEvent@@QAE@W4eEventCategory@@PBG1H@Z
??0mcEvent@@QAE@W4eEventCategory@@PBG@Z
?AddParameter@mcEvent@@QAEXPBGH@Z
?InitEventMgr@@YAXXZ
?UnInitEventMgr@@YAXXZ
?GetEventMgr@@YAPAVmcIEventMgr@@XZ
?AddParameter@mcEvent@@QAEXPBGN@Z

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetFilePointer
GetLastError
ReadFile
CompareStringA
InterlockedExchange
FreeLibrary
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
FlushInstructionCache
VirtualQuery
GetVersion
SetLastError
WinExec
ExitProcess
RaiseException
LocalAlloc

licmgr

?Initialize@lm@@YAJXZ
?Terminate@lm@@YAJXZ
?IsProtected@lm@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z

trackutils

?GetFormatFromPath@mnTrackUtils@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV23@_N1@Z

mmvcp70

?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?str@?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??Bios_base@std@@QBEPAXXZ
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?setf@ios_base@std@@QAEHHH@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z

mmvcr70

malloc
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
__RTDynamicCast
_wtol
_itow
_wtoi
sprintf
wcsncpy
wcslen
_adjust_fdiv
_callnewh
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__security_error_handler
__dllonexit
_onexit
free
_initterm
_except_handler3

Exports

Exports

??0mcUPnPSvr@@QAE@XZ
??0miMMMSPlugin@@QAE@ABV0@@Z
??0miMMMSPlugin@@QAE@XZ
??1mcUPnPSvr@@UAE@XZ
??1miMMMSPlugin@@UAE@XZ
??4miMMMSPlugin@@QAEAAV0@ABV0@@Z
??_7mcUPnPSvr@@6B@
??_7miMMMSPlugin@@6B@
?ChangeState@mcUPnPSvr@@AAEXW4meState@miMMMSPlugin@@@Z
?DbProxy@mcUPnPSvr@@QAEAAVmiDbProxy@@XZ
?Directory@mcUPnPSvr@@QAEAAVmcCdsDirectory@@XZ
?Logger@mcUPnPSvr@@QAEAAVmcUPnPLogger@@XZ
?MakeStateString@mcUPnPSvr@@AAE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@W4meState@miMMMSPlugin@@@Z
?NotifyDbChanged@mcUPnPSvr@@UAEXXZ
?SetDbProxy@mcUPnPSvr@@UAEXPAVmiDbProxy@@@Z
?SetUiProxy@mcUPnPSvr@@UAEXPAVmiUiProxy@@@Z
?Start@mcUPnPSvr@@UAEXXZ
?Stop@mcUPnPSvr@@UAEXXZ
?UiProxy@mcUPnPSvr@@QAEAAVmiUiProxy@@XZ
?UpdateUiState@mcUPnPSvr@@UAEXXZ

Sections

.text
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78b4aaf7aecff0ff8db853ee46c16f7b

Headers

File Characteristics

PDB Paths

Imports

mm.intelupnp

eventmgr

kernel32

licmgr

trackutils

mmvcp70

mmvcr70

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 93KB

.rdata Size: 40KB - Virtual size: 37KB

.data Size: 4KB - Virtual size: 9KB

.reloc Size: 20KB - Virtual size: 16KB

.text
Size: 96KB - Virtual size: 93KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 4KB - Virtual size: 9KB

.reloc
Size: 20KB - Virtual size: 16KB