2e88d5912769dc391a549e8200d288b1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2e88d5912769dc391a549e8200d288b1_JaffaCakes118
Size

1.0MB
MD5

2e88d5912769dc391a549e8200d288b1
SHA1

fc285f75a0b5b331d853be28eee7daf219f848aa
SHA256

60c26c6955dd69f509c864262d91d05315f0615f9f13319c3f38c99a7b0d9756
SHA512

cedb0b651eac0f1b2e2686b30767b7c2b5a91db8c5bc4d4c2fa5cee6e9e24355b3203aa5bd625e4dc00da748df89eebcf33c32b6f155c2ceb4bbeefc4193bcfa
SSDEEP

24576:sdRM77dtVkCyWEkJ2jFp0eZKboe2L1MNmTICeiy6zpinb4OsRW7xu+5:szM77dtVkxWKTIboe2L1MNmTICk6zpiR

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NetBus Pro/NBFind.dll
unpack001/NetBus Pro/NBHelp.dll
unpack001/NetBus Pro/NBSvr.exe
unpack001/NetBus Pro/NBUninst.dll
unpack001/NetBus Pro/NetBus.exe

Files

2e88d5912769dc391a549e8200d288b1_JaffaCakes118
.zip
NetBus Pro/DB/Broadcast1.db
NetBus Pro/DB/Command1.db
NetBus Pro/DB/Host.db
NetBus Pro/DB/Schedule1.db
NetBus Pro/DB/Script1.db
NetBus Pro/Lang/Default.lng
NetBus Pro/Lang/Swedish.lng
NetBus Pro/NBFind.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

EntryPoint

Sections

CODE
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetBus Pro/NBHelp.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DisableClick
DisableKeys
EnableClick
EnableKeys
InstallControl
InstallKeyHook
InstallKeySpy
UninstallControl
UninstallKeyHook
UninstallKeySpy

Sections

CODE
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 293B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetBus Pro/NBSvr.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 443KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetBus Pro/NBUninst.dll
.dll windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

UninstInitialize
UninstUnInitialize

Sections

CODE
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 109B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetBus Pro/NetBus.GID
NetBus Pro/NetBus.cnt
NetBus Pro/NetBus.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 947KB - Virtual size: 946KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 9KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 20B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NetBus Pro/NetBus.hlp
NetBus Pro/Readme.txt
NetBus Pro/Skin/Listen.bmp
NetBus Pro/Skin/Logotype.bmp
NetBus Pro/Uninst.isu
NetBus Pro/ad468x60.gif
.gif
NetBus Pro/ad468x60.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 56KB - Virtual size: 55KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 72B

.reloc Size: 5KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 53KB - Virtual size: 53KB

DATA Size: 2KB - Virtual size: 1KB

BSS Size: - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 293B

.reloc Size: 5KB - Virtual size: 4KB

.rsrc Size: 5KB - Virtual size: 5KB

Headers

File Characteristics

Sections

CODE Size: 443KB - Virtual size: 443KB

DATA Size: 15KB - Virtual size: 15KB

BSS Size: - Virtual size: 5KB

.idata Size: 11KB - Virtual size: 10KB

.tls Size: - Virtual size: 20B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 30KB - Virtual size: 29KB

.rsrc Size: 109KB - Virtual size: 109KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 12KB - Virtual size: 12KB

DATA Size: 512B - Virtual size: 216B

BSS Size: - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.edata Size: 512B - Virtual size: 109B

.reloc Size: 1024B - Virtual size: 860B

.rsrc Size: 512B - Virtual size: 512B

Headers

File Characteristics

Sections

CODE Size: 947KB - Virtual size: 946KB

DATA Size: 11KB - Virtual size: 11KB

BSS Size: - Virtual size: 9KB

.idata Size: 11KB - Virtual size: 10KB

.tls Size: - Virtual size: 20B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 63KB - Virtual size: 63KB

.rsrc Size: 228KB - Virtual size: 228KB

CODE
Size: 56KB - Virtual size: 55KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 72B

.reloc
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

CODE
Size: 53KB - Virtual size: 53KB

DATA
Size: 2KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 293B

.reloc
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 5KB - Virtual size: 5KB

CODE
Size: 443KB - Virtual size: 443KB

DATA
Size: 15KB - Virtual size: 15KB

BSS
Size: - Virtual size: 5KB

.idata
Size: 11KB - Virtual size: 10KB

.tls
Size: - Virtual size: 20B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 30KB - Virtual size: 29KB

.rsrc
Size: 109KB - Virtual size: 109KB

CODE
Size: 12KB - Virtual size: 12KB

DATA
Size: 512B - Virtual size: 216B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 109B

.reloc
Size: 1024B - Virtual size: 860B

.rsrc
Size: 512B - Virtual size: 512B

CODE
Size: 947KB - Virtual size: 946KB

DATA
Size: 11KB - Virtual size: 11KB

BSS
Size: - Virtual size: 9KB

.idata
Size: 11KB - Virtual size: 10KB

.tls
Size: - Virtual size: 20B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 63KB - Virtual size: 63KB

.rsrc
Size: 228KB - Virtual size: 228KB