29f87b823ba28dbdc0e66ea19030dd71_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29f87b823ba28dbdc0e66ea19030dd71_JaffaCakes118
Size

252KB
MD5

29f87b823ba28dbdc0e66ea19030dd71
SHA1

cf43b895e77e58418f4b0347e88fe802cb409c80
SHA256

3d6d566b10f132c881eadf136d1ac78efa90c1979e61e051b345022115f38c40
SHA512

eb77c94ae95b02a0403a92cd479b26e19eb445119449b6f9a2a4d5ed412ee8f43a75d11a54e8439751617d74c88dbcaaddd7fe3ebe40f74b1554903ac49d66e3
SSDEEP

6144:MX7X9kFyo1Olc0S3NkimwwzcL4Z4j6LbaHCq:4CooIS9mp4j6I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29f87b823ba28dbdc0e66ea19030dd71_JaffaCakes118

Files

29f87b823ba28dbdc0e66ea19030dd71_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fe0184cd2a8474b360fa8a6eda4dfb1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\UI\RD\Sources\Connection Manager 2\Application\Output\Release_Unicode\ConnectionManager.pdb

Imports

ngscm

??0CNbuuWindowBackgroundSkin@@QAE@XZ
??0CNbuuComboBoxCtrl@@QAE@XZ
??1CNbuuComboBoxCtrl@@UAE@XZ
??1CNbuuWindowBackgroundSkin@@UAE@XZ
?Init@CNbuuLib@@SAXPAUHINSTANCE__@@0@Z
?PcsLoadFont@@YAXPAUtagLOGFONTW@@@Z
?SetTooltip@?$CNbuuButtonImpl@VCNbuuCommonButtonSkin@@@@QAEXPAG@Z
?PcsLoadColor@@YAKPAUHINSTANCE__@@I@Z
?SetTextColor@CNbuuStaticCtrl@@QAEXK@Z
??0CNbuuStaticCtrl@@QAE@XZ
??1CNbuuStaticCtrl@@UAE@XZ
?LoadBitmapW@CNbuuResourceManager@@SA_NPAPAVCNbuuBitmap@@PAUHINSTANCE__@@IHPBG@Z
?UnloadBitmap@CNbuuResourceManager@@SA_NPAPAVCNbuuBitmap@@@Z
??0CNbuuCommonButtonCtrl@@QAE@XZ
??1CNbuuCommonButtonCtrl@@UAE@XZ
??0CNbuuGraphics@@QAE@PAUHDC__@@@Z
??1CNbuuGraphics@@UAE@XZ
?DrawImage@CNbuuGraphics@@QAEXPAVCNbuuBitmap@@HH@Z
?FlipDialog@CRTLHelper@@SAPAUDLGTEMPLATE@@PAUHINSTANCE__@@PBGH@Z
??0CRTLHelper@@QAE@PBG@Z
??1CRTLHelper@@UAE@XZ
??0CNbuuWindowBackgroundCtrl@@QAE@XZ
??1CNbuuWindowBackgroundCtrl@@UAE@XZ
?PcsInitializeWER@@YAHXZ
?Show@CNbuuCommonMessageBox@@SAHPAUHWND__@@PBG1I@Z
?IsRTL@CRTLHelper@@SAHPBG@Z
?GetLangID@CRTLHelper@@SAPAGPAUHKEY__@@PBG1@Z
?m_dwLayout@CNbuuLib@@0KA
??0CPCSL2InfoReader@@QAE@XZ
??1CPCSL2InfoReader@@QAE@XZ
?ReadPCSL@CPCSL2InfoReader@@QAEHPAG@Z
?GetUIManufacturer@CPCSL2InfoReader@@QAEPBGXZ

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
PathRemoveExtensionW
PathAddBackslashW

comctl32

InitCommonControlsEx
ord17

gdiplus

GdiplusStartup
GdiplusShutdown

kernel32

HeapAlloc
IsProcessorFeaturePresent
VirtualFree
GetVersionExA
HeapDestroy
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
VirtualAlloc
HeapFree
GetStartupInfoA
CreateProcessW
InterlockedDecrement
GlobalLock
WaitForSingleObject
GlobalAlloc
Sleep
LeaveCriticalSection
ExitThread
RaiseException
EnterCriticalSection
GlobalFree
DeleteCriticalSection
CloseHandle
CreateThread
CreateMutexW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
OpenMutexW
CreateFileMappingW
OpenFileMappingW
ReleaseMutex
FindResourceExW
FindResourceW
LoadResource
GetCurrentProcess
SizeofResource
FlushInstructionCache
LockResource
ExitProcess
GetCommandLineW
InterlockedIncrement
SetEvent
InitializeCriticalSection
CreateEventW
lstrcmpiW
GetCurrentThreadId
FindFirstFileW
FindClose
LoadLibraryExW
GetModuleFileNameW
QueryDosDeviceW
LoadLibraryA
GetProcAddress
WaitForMultipleObjects
ResetEvent
CreateEventA
OpenEventA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
GetProcessHeap

user32

PostThreadMessageW
DispatchMessageW
SetCursor
GetSystemMenu
GetWindowRect
FillRect
LoadImageW
DrawTextW
GetParent
GetClientRect
SetFocus
PtInRect
SystemParametersInfoW
EnableMenuItem
GetDlgItem
SetWindowLongW
RedrawWindow
SetWindowPos
ShowScrollBar
MapWindowPoints
SetWindowTextW
GetProcessDefaultLayout
PeekMessageW
DefWindowProcW
GetWindow
PostQuitMessage
IsIconic
GetLastActivePopup
SetForegroundWindow
GetForegroundWindow
GetDesktopWindow
GetCursorPos
LoadStringW
GetActiveWindow
SetProcessDefaultLayout
MessageBoxW
EnableWindow
DialogBoxIndirectParamW
LoadCursorW
WaitForInputIdle
EnumWindows
BringWindowToTop
GetWindowLongW
GetWindowTextW
EndDialog
ShowWindow
IsWindow
FlashWindow
SendMessageW
GetWindowThreadProcessId
TranslateMessage
GetMessageW
DestroyWindow
GetFocus
LoadIconW
UnregisterClassA
CallWindowProcW
CharNextW

gdi32

SelectObject
DeleteObject
ExcludeClipRect
SetTextColor
CreateFontIndirectW
CreateSolidBrush

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysStringLen
SysAllocString

atl80

ord44
ord43
ord49
ord18
ord22
ord42
ord64
ord20
ord61
ord23
ord17
ord32

msvcp80

??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z

msvcr80

__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__p__fmode
_unlock
?terminate@@YAXXZ
_CxxThrowException
wcsncmp
wcsncpy
_wtoi
_beginthreadex
_endthreadex
strlen
memcpy_s
memmove_s
wcscmp
_purecall
??_V@YAXPAX@Z
_invalid_parameter_noinfo
wcslen
_swprintf
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
wcscat
free
_recalloc
__dllonexit
memset
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
wcscpy
??3@YAXPAX@Z

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 176KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe0184cd2a8474b360fa8a6eda4dfb1f

Headers

File Characteristics

PDB Paths

Imports

ngscm

shlwapi

comctl32

gdiplus

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl80

msvcp80

msvcr80

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 176KB - Virtual size: 177KB

.rsrc Size: 19KB - Virtual size: 18KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 176KB - Virtual size: 177KB

.rsrc
Size: 19KB - Virtual size: 18KB