2eb89f7f00e409cda1183f56494d8686_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2eb89f7f00e409cda1183f56494d8686_JaffaCakes118
Size

520KB
MD5

2eb89f7f00e409cda1183f56494d8686
SHA1

42f9abe1f4c488e2c83bf1b5a5fc17013934eb39
SHA256

8b624939b054b6cbf7c3e85abd8ea5a89f37e1bedd753909043f673aec0ece06
SHA512

2a16880bb3a76e845802fdb0f03d94ff5aa35946a33af87d852f53f9840e63a22fe6a54d37306d6ac3300f555cea42dc559d53ac167698ba952e62d9869aa5a8
SSDEEP

12288:wg7sixZS0rW56KoLYAyKhKjSKP5TryOfSmT2sQ:xRC5wLPyKhsSKP5TdfRT5Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2eb89f7f00e409cda1183f56494d8686_JaffaCakes118

Files

2eb89f7f00e409cda1183f56494d8686_JaffaCakes118
.dll windows:4 windows x86 arch:x86

17fd2434107d77c2bbcbda894d7cf07d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

cdlli41

ord643
ord2014
ord2002
ord2006
ord2001
ord639
ord38
ord262
ord2010
ord2007
ord641

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

rasapi32

RasEnumConnectionsA
RasEnumEntriesA
RasGetConnectStatusA
RasHangUpA
RasGetProjectionInfoA
RasDialA
RasGetConnectionStatistics

pdh

PdhOpenQueryA
PdhComputeCounterStatistics
PdhRemoveCounter
PdhAddCounterA
PdhCloseQuery
PdhGetRawCounterValue
PdhGetFormattedCounterValue
PdhCollectQueryData

mfc80

ord3023
ord5431
ord4081
ord5403
ord2468
ord566
ord3333
ord4261
ord4481
ord3949
ord2644
ord3709
ord3719
ord3718
ord2990
ord2533
ord2646
ord2540
ord2838
ord2714
ord4307
ord2835
ord2731
ord2537
ord5566
ord5213
ord5230
ord4568
ord3948
ord5226
ord5224
ord2931
ord1920
ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord757
ord2248
ord2131
ord5715
ord5491
ord4109
ord907
ord6180
ord4067
ord5346
ord305
ord2328
ord6750
ord5493
ord3457
ord379
ord6179
ord908
ord2471
ord629
ord1439
ord2308
ord914
ord6210
ord4055
ord6288
ord5323
ord2903
ord5877
ord5625
ord2120
ord5089
ord2750
ord2753
ord2746
ord3094
ord383
ord2703
ord3201
ord3787
ord6173
ord6172
ord2702
ord380
ord6178
ord1465
ord1467
ord384
ord3458
ord531
ord1003
ord723
ord2274
ord5445
ord3296
ord5437
ord427
ord870
ord765
ord315
ord1084
ord1037
ord1092
ord1206
ord1208
ord1098
ord556
ord5097
ord6310
ord1452
ord744
ord6703
ord299
ord1489
ord6297
ord262
ord5331
ord259
ord1580
ord6286
ord5320
ord371
ord1181
ord3255
ord2346
ord557
ord745
ord314
ord6754
ord266
ord3952
ord3460
ord1917
ord911
ord2271
ord3997
ord297
ord2272
ord5490
ord5529
ord4108
ord865
ord2322
ord5716
ord6006
ord762
ord3174
ord559
ord747
ord1482
ord265
ord304
ord784
ord781
ord578
ord310
ord1191
ord1187
ord1185
ord764
ord1167
ord1120
ord1201
ord1175
ord1177
ord1209
ord581
ord6174

msvcr80

rand
srand
_HUGE
strrchr
getenv
strtod
strncat
strcspn
_difftime64
_gmtime64
_localtime64
system
remove
rename
tmpnam
clock
setlocale
tolower
toupper
isxdigit
isupper
ispunct
islower
memchr
strpbrk
strcoll
isprint
strncmp
memmove
isgraph
strncpy_s
qsort
_splitpath_s
_atoi64
_findfirst64
_findnext64
_findclose
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
ldexp
frexp
_CIexp
_CIlog10
_CIlog
_CIsqrt
modf
_CIfmod
_CIatan2
_CIatan
_CIacos
_CIasin
_CItanh
_CItan
_CIcosh
_CIcos
_CIsinh
_CIsin
isalpha
isdigit
isalnum
localeconv
iscntrl
fflush
setvbuf
fseek
ftell
fwrite
clearerr
fscanf
tmpfile
_popen
_pclose
longjmp
exit
_setjmp3
fgets
floor
_CIpow
strtoul
isspace
fputs
strstr
fprintf
__iob_func
getc
freopen
fopen
ungetc
ferror
fclose
_errno
strerror
feof
fread
strncpy
_beginthreadex
_ismbcdigit
sprintf
realloc
memcpy_s
_mbsstr
_mktime64
vsprintf_s
_time64
strchr
_localtime64_s
??8type_info@@QBE_NABV0@@Z
memmove_s
_purecall
memcpy
atof
strcpy_s
memset
_stricmp
sprintf_s
atoi
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_invalid_parameter_noinfo
sscanf_s
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
ceil
__CxxFrameHandler3
free
malloc
_lseek
_open
_read
_close
_write
strftime

kernel32

WideCharToMultiByte
GetLastError
MultiByteToWideChar
SetFilePointer
CreateFileA
CloseHandle
GetFileSizeEx
FlushFileBuffers
WriteFile
Sleep
DeleteFileA
ReadFile
GetTickCount
CreateThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MoveFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocaleInfoA
GetFileTime
GetVersionExA
GetCurrentThreadId
CreateDirectoryA
GetFileAttributesA
CreateProcessA
GetACP
FormatMessageA
TerminateProcess
TerminateThread
WaitForSingleObject
SetEvent
GetExitCodeProcess
WaitForMultipleObjects
CreateEventA
DuplicateHandle
GetCurrentProcess
CreatePipe
SetLastError
ResumeThread
LocalFree
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
LoadLibraryA
GetProcAddress
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcessId
GetTempFileNameA
GetCurrentDirectoryA
SetFileAttributesA
FindFirstFileA
FindClose
SetFileTime
GetDriveTypeA
SetVolumeLabelA
GetDiskFreeSpaceExA
GetTempPathA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
LocalAlloc
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
PeekNamedPipe
GetThreadLocale
InterlockedExchange

user32

PostMessageA
SendMessageA
IsWindow
MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey

msvcp80

?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

ws2_32

connect
htons
socket
closesocket
listen
bind
WSACleanup
WSAStartup
ntohs
WSAGetLastError
getservbyname
recv
getsockname
getpeername
recvfrom
select
__WSAFDIsSet
sendto
ntohl
inet_addr
htonl
setsockopt
ioctlsocket
send
gethostbyname
gethostname
shutdown
accept

Exports

Exports

FCL_CFFileCopier_CopyAbort
FCL_CFFileCopier_CopyStart
FCL_CFFileCopier_Create
FCL_CFFileCopier_Destroy
FCL_CFFileCopier_GetLastError
FCL_CFFileCopier_GetProgress
FCL_CFFileCopier_IsSuccess
FCL_CFFileCopier_IsWorking
FCL_CFFileCopier_SetNotifyTarget
FCL_CFFileVersionInfo_Create
FCL_CFFileVersionInfo_Destroy
FCL_CFFileVersionInfo_GetStrInfo
FCL_CFFileVersionInfo_LoadFile
FCL_CFFile_Close
FCL_CFFile_Create
FCL_CFFile_Destroy
FCL_CFFile_GetLastError
FCL_CFFile_GetSize
FCL_CFFile_IsOpen
FCL_CFFile_Open
FCL_CFFile_WriteLine
FCL_CFFile_WriteStr
FCL_CFIniFile_Close
FCL_CFIniFile_Create
FCL_CFIniFile_DeleteEntry
FCL_CFIniFile_DeleteSection
FCL_CFIniFile_Destroy
FCL_CFIniFile_Flush
FCL_CFIniFile_GetSectionsEntriesList
FCL_CFIniFile_GetValue
FCL_CFIniFile_Open
FCL_CFIniFile_RefreshCache
FCL_CFIniFile_SetValue
FCL_CFPerfMonitor_AddCounter
FCL_CFPerfMonitor_CollectData
FCL_CFPerfMonitor_Create
FCL_CFPerfMonitor_Destroy
FCL_CFPerfMonitor_GetCounterStatistics
FCL_CFPerfMonitor_GetCounterValue
FCL_CFPerfMonitor_Initialize
FCL_CFPerfMonitor_QueryObjectCounters
FCL_CFPerfMonitor_QueryObjects
FCL_CFPerfMonitor_RemoveCounter
FCL_CFPortForwarder_ConfigSet
FCL_CFPortForwarder_Create
FCL_CFPortForwarder_Destroy
FCL_CFPortForwarder_GetLastError
FCL_CFPortForwarder_GetStatistics
FCL_CFPortForwarder_IsRunning
FCL_CFPortForwarder_Start
FCL_CFPortForwarder_Stop
FCL_CFRasConn_Attach
FCL_CFRasConn_Create
FCL_CFRasConn_Destroy
FCL_CFRasConn_Dial
FCL_CFRasConn_EnumConnections
FCL_CFRasConn_EnumEntries
FCL_CFRasConn_GetConnStatistics
FCL_CFRasConn_GetLastError
FCL_CFRasConn_GetProjectionInfo
FCL_CFRasConn_HangUp
FCL_CFRasConn_IsConnected
FCL_CFRegExp_Compile
FCL_CFRegExp_Create
FCL_CFRegExp_Destroy
FCL_CFRegExp_Find
FCL_CFRegExp_FindEx
FCL_CFRegExp_GetError
FCL_CFRegExp_GetMarkers
FCL_CFRegExp_Match
FCL_CFRegExp_MatchAll
FCL_CFRegExp_Replace
FCL_CFRegExp_Split
FCL_CFRunProcess_Create
FCL_CFRunProcess_Destroy
FCL_CFRunProcess_GetExitCode
FCL_CFRunProcess_GetLastError
FCL_CFRunProcess_GetOutput
FCL_CFRunProcess_IsTerminated
FCL_CFRunProcess_Kill
FCL_CFRunProcess_SendInput
FCL_CFRunProcess_Start
FCL_CFScriptEngine_CallFunc
FCL_CFScriptEngine_Create
FCL_CFScriptEngine_Destroy
FCL_CFScriptEngine_FuncGetParams
FCL_CFScriptEngine_FuncSetError
FCL_CFScriptEngine_FuncSetRetValues
FCL_CFScriptEngine_GetGVarNum
FCL_CFScriptEngine_GetGVarStr
FCL_CFScriptEngine_GetLastError
FCL_CFScriptEngine_Include
FCL_CFScriptEngine_IsFunc
FCL_CFScriptEngine_Load
FCL_CFScriptEngine_RegisterFunc
FCL_CFScriptEngine_Run
FCL_CFScriptEngine_ScriptExit
FCL_CFScriptEngine_SetGVarNum
FCL_CFScriptEngine_SetGVarStr
FCL_CFSocket_AcceptConnection
FCL_CFSocket_AttachToSocket
FCL_CFSocket_Connect
FCL_CFSocket_Create
FCL_CFSocket_CreateSocket
FCL_CFSocket_Destroy
FCL_CFSocket_Disconnect
FCL_CFSocket_GetError
FCL_CFSocket_GetLocalAddress
FCL_CFSocket_GetLocalName
FCL_CFSocket_GetPeerName
FCL_CFSocket_GetReceivedData
FCL_CFSocket_GetSockName
FCL_CFSocket_IsConnectionDropped
FCL_CFSocket_IsOpen
FCL_CFSocket_IsUdp
FCL_CFSocket_MonPause
FCL_CFSocket_MonStart
FCL_CFSocket_MonStop
FCL_CFSocket_ReadData
FCL_CFSocket_Reconnect
FCL_CFSocket_RegisterNotifyWnd
FCL_CFSocket_SetServerState
FCL_CFSocket_WriteData
FCL_CFStrMap_Create
FCL_CFStrMap_Destroy
FCL_CFStrMap_EnumItems
FCL_CFStrMap_GetCount
FCL_CFStrMap_Lookup
FCL_CFStrMap_RemoveAll
FCL_CFStrMap_SetArray
FCL_CFStrMap_SetAt
FCL_CFZipArchive_AddNewFiles
FCL_CFZipArchive_Close
FCL_CFZipArchive_Create
FCL_CFZipArchive_Destroy
FCL_CFZipArchive_ExtractAllFiles
FCL_CFZipArchive_GetFileCount
FCL_CFZipArchive_GetLastError
FCL_CFZipArchive_IsFileZipArchive
FCL_CFZipArchive_IsOpen
FCL_CFZipArchive_IsReadOnly
FCL_CFZipArchive_Open
FCL_CFZipArchive_Test
Fut_FileCompress
Fut_FileUncompress
Fut_NetGetLocalIPAddr
Fut_NetGetLocalName
Fut_NetPing
Fut_NetResolveName
pcre_callout
pcre_compile
pcre_compile2
pcre_config
pcre_copy_named_substring
pcre_copy_substring
pcre_dfa_exec
pcre_exec
pcre_free
pcre_free_substring
pcre_free_substring_list
pcre_fullinfo
pcre_get_named_substring
pcre_get_stringnumber
pcre_get_stringtable_entries
pcre_get_substring
pcre_get_substring_list
pcre_info
pcre_maketables
pcre_malloc
pcre_refcount
pcre_stack_free
pcre_stack_malloc
pcre_study
pcre_version

Sections

.text
Size: 380KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17fd2434107d77c2bbcbda894d7cf07d

Headers

File Characteristics

Imports

cdlli41

version

rasapi32

pdh

mfc80

msvcr80

kernel32

user32

advapi32

msvcp80

ws2_32

Exports

Exports

Sections

.text Size: 380KB - Virtual size: 378KB

.rdata Size: 104KB - Virtual size: 103KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 380KB - Virtual size: 378KB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 23KB