31542f379ad49f01b8a7a23c91a2abc7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

31542f379ad49f01b8a7a23c91a2abc7_JaffaCakes118
Size

108KB
MD5

31542f379ad49f01b8a7a23c91a2abc7
SHA1

0e662c3682831b631154d9df80cc1d3a2a2d4fe2
SHA256

d4ab67b08e3b899484931a69326438e3dde3623a656ae3bebebb624da0ca17c4
SHA512

0629c23b9cedf00374327731d3d9661338db4e0c8d5bae24ad30ad3f9e3c3586d36e85cddbb482533e110106f866fc97799d52a50ec7396c43dabbe889e42e26
SSDEEP

1536:4cq6jSzLfqKz3OXHhlYrT8B8zx38z/03O2J4/pMsoX0l7zza:HTjSzeKDCHhJ8B1O042sokN3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31542f379ad49f01b8a7a23c91a2abc7_JaffaCakes118

Files

31542f379ad49f01b8a7a23c91a2abc7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

97377c8f21de7c0b4c1a99c4e77bcfa7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LocalFree
InterlockedDecrement
CloseHandle
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
InterlockedIncrement
SetFilePointer
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
HeapSize
HeapReAlloc
GetCurrentProcess
TerminateProcess
HeapAlloc
SetUnhandledExceptionFilter
ExitProcess
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTimeZoneInformation
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetVersion
GetCommandLineA
HeapFree
RaiseException
GetLastError
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
RtlUnwind

ole32

CoInitialize
OleRun
CoCreateInstance
CoUninitialize

oleaut32

GetErrorInfo
VariantClear
SysFreeString
SysAllocString

stlport_vc646

?append@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAEAAV12@PAD0ABUforward_iterator_tag@2@@Z
??1Init@ios_base@_STL@@QAE@XZ
??0Init@ios_base@_STL@@QAE@XZ
??1_Loc_init@ios_base@_STL@@QAE@XZ
??0_Loc_init@ios_base@_STL@@QAE@XZ
??_8?$basic_ifstream@DV?$char_traits@D@_STL@@@_STL@@7B@
??0?$basic_istream@DV?$char_traits@D@_STL@@@_STL@@QAE@PAV?$basic_streambuf@DV?$char_traits@D@_STL@@@1@@Z
??_7?$basic_ifstream@DV?$char_traits@D@_STL@@@_STL@@6B@
?seekg@?$basic_istream@DV?$char_traits@D@_STL@@@_STL@@QAEAAV12@JH@Z
?tellg@?$basic_istream@DV?$char_traits@D@_STL@@@_STL@@QAE?AV?$fpos@H@2@XZ
?read@?$basic_istream@DV?$char_traits@D@_STL@@@_STL@@QAEAAV12@PADH@Z
?_M_check_exception_mask@ios_base@_STL@@IAEXXZ
??0?$_STLP_alloc_proxy@PADDV?$allocator@D@_STL@@@_STL@@QAE@ABV?$allocator@D@1@PAD@Z
?_M_range_initialize@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAEXPBD0@Z
??_7?$basic_istream@DV?$char_traits@D@_STL@@@_STL@@6B@
??_7?$basic_ios@DV?$char_traits@D@_STL@@@_STL@@6B@
??1ios_base@_STL@@UAE@XZ
??1?$basic_istream@DV?$char_traits@D@_STL@@@_STL@@UAE@XZ
??_D?$basic_ifstream@DV?$char_traits@D@_STL@@@_STL@@QAEXXZ
?assign@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAEAAV12@PBD0@Z
?_M_assign_dispatch@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAEAAV12@PAD0ABU__false_type@2@@Z
??_8?$basic_ofstream@DV?$char_traits@D@_STL@@@_STL@@7B@
??0?$basic_ios@DV?$char_traits@D@_STL@@@_STL@@IAE@XZ
?_M_allocate_block@?$_String_base@DV?$allocator@D@_STL@@@_STL@@QAEXI@Z
??0?$basic_filebuf@DV?$char_traits@D@_STL@@@_STL@@QAE@XZ
?_M_deallocate@?$__node_alloc@$00$0A@@_STL@@CAXPAXI@Z
?init@?$basic_ios@DV?$char_traits@D@_STL@@@_STL@@IAEXPAV?$basic_streambuf@DV?$char_traits@D@_STL@@@2@@Z
??0?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAE@ABV01@@Z
?_M_open@_Filebuf_base@_STL@@QAE_NPBDH@Z
?clear@?$basic_ios@DV?$char_traits@D@_STL@@@_STL@@QAEXH@Z
?write@?$basic_ostream@DV?$char_traits@D@_STL@@@_STL@@QAEAAV12@PBDH@Z
?close@?$basic_filebuf@DV?$char_traits@D@_STL@@@_STL@@QAEPAV12@XZ
?_M_throw_failure@ios_base@_STL@@IAEXXZ
??1?$basic_filebuf@DV?$char_traits@D@_STL@@@_STL@@UAE@XZ
??1?$basic_ostream@DV?$char_traits@D@_STL@@@_STL@@UAE@XZ
??1?$basic_ios@DV?$char_traits@D@_STL@@@_STL@@UAE@XZ
??1?$_String_base@DV?$allocator@D@_STL@@@_STL@@QAE@XZ
??_D?$basic_ofstream@DV?$char_traits@D@_STL@@@_STL@@QAEXXZ
?_M_deallocate_block@?$_String_base@DV?$allocator@D@_STL@@@_STL@@QAEXXZ
?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
??0?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAE@XZ
?deallocate@?$_STLP_alloc_proxy@PADDV?$allocator@D@_STL@@@_STL@@QAEXPADI@Z
?deallocate@?$allocator@D@_STL@@QAEXPADI@Z
??1?$allocator@D@_STL@@QAE@XZ
??1?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAE@XZ
??1?$_STLP_alloc_proxy@PADDV?$allocator@D@_STL@@@_STL@@QAE@XZ
?c_str@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QBEPBDXZ
?_M_append_dispatch@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAEAAV12@PBD0ABU__false_type@2@@Z
?append@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAEAAV12@PBD@Z
?find@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QBEIDI@Z
?_M_append_dispatch@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAEAAV12@PAD0ABU__false_type@2@@Z
?erase@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAEPADPAD0@Z
?_M_allocate@?$__node_alloc@$00$0A@@_STL@@CAPAXI@Z
??_7?$basic_ofstream@DV?$char_traits@D@_STL@@@_STL@@6B@
?append@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAEAAV12@PBD0ABUforward_iterator_tag@2@@Z
?find@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QBEIPBDII@Z
?reserve@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QAEXI@Z
?get_allocator@?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@QBE?AV?$allocator@D@2@XZ
??0?$basic_ostream@DV?$char_traits@D@_STL@@@_STL@@QAE@PAV?$basic_streambuf@DV?$char_traits@D@_STL@@@1@@Z

Exports

Exports

??0ConfigurationDataFileProxy@@QAE@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationDataFileProxy@@QAE@AAVConnectionContext@@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationDataFileProxy@@QAE@AAVConnectionContext@@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@J@Z
??0ConfigurationDataFileProxy@@QAE@ABV0@@Z
??0ConfigurationDirectoryProxy@@QAE@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationDirectoryProxy@@QAE@AAVConnectionContext@@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationDirectoryProxy@@QAE@ABV0@@Z
??0ConfigurationFileProxy@@QAE@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationFileProxy@@QAE@AAVConnectionContext@@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationFileProxy@@QAE@ABV0@@Z
??0ConfigurationFileProxyException@@QAE@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConfigurationFileProxyException@@QAE@ABV0@@Z
??0ConfigurationFileSystemProxy@@QAE@AAVConnectionContext@@@Z
??0ConfigurationFileSystemProxy@@QAE@ABV0@@Z
??0ConfigurationFileSystemProxy@@QAE@XZ
??0ConnectionContext@@QAE@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
??0ConnectionContext@@QAE@ABV0@@Z
??0ConnectionContext@@QAE@XZ
??1ConfigurationDataFileProxy@@UAE@XZ
??1ConfigurationDirectoryProxy@@UAE@XZ
??1ConfigurationFileProxy@@UAE@XZ
??1ConfigurationFileProxyException@@QAE@XZ
??1ConfigurationFileSystemProxy@@QAE@XZ
??1ConnectionContext@@QAE@XZ
??4ConfigurationDataFileProxy@@QAEAAV0@ABV0@@Z
??4ConfigurationDirectoryProxy@@QAEAAV0@ABV0@@Z
??4ConfigurationFileProxy@@QAEAAV0@ABV0@@Z
??4ConfigurationFileProxyException@@QAEAAV0@ABV0@@Z
??4ConfigurationFileSystemProxy@@QAEAAV0@ABV0@@Z
??4ConnectionContext@@QAEAAV0@ABV0@@Z
??_7ConfigurationDataFileProxy@@6B@
??_7ConfigurationDirectoryProxy@@6B@
??_7ConfigurationFileProxy@@6B@
?get@ConfigurationDataFileProxy@@QAEXAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?getAndSaveTo@ConfigurationDataFileProxy@@QAEXAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@0@Z
?getConfigurationFileProxy@ConfigurationFileSystemProxy@@QAEPAVConfigurationDataFileProxy@@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?getConnectionContext@ConfigurationFileProxy@@QAEAAVConnectionContext@@XZ
?getDefaultConfigurationFileSystemProxy@ConfigurationFileSystemProxy@@SAAAV1@XZ
?getDirectoryProxy@ConfigurationFileSystemProxy@@QAEPAVConfigurationDirectoryProxy@@AAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?getDirectoryTree@ConfigurationDirectoryProxy@@AAEPAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAH_N1@Z
?getDirectoryTree@ConfigurationDirectoryProxy@@QAEPAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAH@Z
?getDirectoryTree@ConfigurationFileSystemProxy@@QAEPAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@AAV23@AAH@Z
?getFiles@ConfigurationDirectoryProxy@@QAEPAPAVConfigurationFileProxy@@AAH@Z
?getHost@ConnectionContext@@QAEAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@XZ
?getMessage@ConfigurationFileProxyException@@QAEAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@XZ
?getName@ConfigurationFileProxy@@QAEAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@XZ
?getTimeout@ConnectionContext@@QAEIXZ
?getTimestamp@ConfigurationDataFileProxy@@QAEXAAUtm@@@Z
?getType@ConfigurationDataFileProxy@@UAE?AW4configurationFileProxyType@@XZ
?getType@ConfigurationDirectoryProxy@@UAE?AW4configurationFileProxyType@@XZ
?loadFrom@ConfigurationDataFileProxy@@QAEXAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?put@ConfigurationDataFileProxy@@QAEXAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?remove@ConfigurationDataFileProxy@@QAEXXZ
?saveTo@ConfigurationDataFileProxy@@QAEXAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?setHost@ConnectionContext@@QAEXAAV?$basic_string@DV?$char_traits@D@_STL@@V?$allocator@D@2@@_STL@@@Z
?setTimeout@ConnectionContext@@QAEXI@Z

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97377c8f21de7c0b4c1a99c4e77bcfa7

Headers

File Characteristics

Imports

kernel32

ole32

oleaut32

stlport_vc646

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 16KB - Virtual size: 19KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 16KB - Virtual size: 19KB

.reloc
Size: 8KB - Virtual size: 7KB