32f81ea297f78664968a0229bb7ee458_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

32f81ea297f78664968a0229bb7ee458_JaffaCakes118
Size

328KB
MD5

32f81ea297f78664968a0229bb7ee458
SHA1

87a887009cc251c16d1b71f78d523cd7f0bacf81
SHA256

0607691084cbe51dcbd00858592120126ed6b9ca85b31a28b79b92bebd52f24b
SHA512

6ee34d959238436a3d8f4ad2f5d992eb7cab3cf584e133f2cafb23f218d057592353ee48b2c8826e23af66e53f2abf8e652d2c0ad56c6d520ef26e23f5da3662
SSDEEP

6144:v23xERz62o6rPOovj6w7bnOaIaWjoWzYAOxjp/:e3mJoe7bnjImwYAOxjp/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32f81ea297f78664968a0229bb7ee458_JaffaCakes118

Files

32f81ea297f78664968a0229bb7ee458_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e167a1c44862a321f667dd236ae58cb7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\NPS_VSS_ROOT\NPS\bin\release\program files\NPSSMSSender.pdb

Imports

npscustomctrl

?getKeyValue@CWin32Registry@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0PAV23@PB_W@Z
??1CWin32Registry@@UAE@XZ
??0CWin32Registry@@QAE@H@Z
??1CNPSButton@@UAE@XZ
??0CNPSButton@@QAE@XZ
?SetToolTipText@CNPSButton@@QAEXPB_W@Z
?initFrameToolTipText@CNPSFrame@@QAEXPB_W00000@Z
?setAppIcon@CNPSFrame@@QAEXI@Z
?setPopupMenu@CNPSFrame@@QAEXIV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?OnCreate@CNPSFrame@@IAEHPAUtagCREATESTRUCTW@@@Z
?OnClose@CNPSFrame@@IAEXXZ
?HideCloseSysBtn@CNPSFrame@@QAEXH@Z
?OnNcHitTest@CNPSFrame@@IAEJVCPoint@@@Z
?GetThisClass@CNPSFrame@@SGPAUCRuntimeClass@@XZ
?initFrame@CNPSFrame@@QAEXIIIIHIIIIIIVCSize@@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?ShowTransferStatus@CNPSTransferWnd@@QAEXHW4eTransferType@1@@Z
?SetText@CNPSTransferWnd@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
??1CNPSFrame@@MAE@XZ
??0CNPSFrame@@IAE@XZ
?GetThisMessageMap@CNPSFrame@@KGPBUAFX_MSGMAP@@XZ
?PreTranslateMessage@CNPSFrame@@MAEHPAUtagMSG@@@Z
?GetSysButtonRect@CNPSFrame@@IAE?AVCRect@@H@Z
?DoDataExchange@CNPSFrame@@MAEXPAVCDataExchange@@@Z
?GetRuntimeClass@CNPSButton@@UBEPAUCRuntimeClass@@XZ
?GetMessageMap@CNPSButton@@MBEPBUAFX_MSGMAP@@XZ
?PreTranslateMessage@CNPSButton@@UAEHPAUtagMSG@@@Z
?DrawItem@CNPSButton@@UAEXPAUtagDRAWITEMSTRUCT@@@Z
??0CNPSAboutDlg@@QAE@PAVCWnd@@AAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@G@Z
??1CNPSAboutDlg@@UAE@XZ
??1CNPSTransferWnd@@UAE@XZ
?GetRuntimeClass@CNPSTransferWnd@@UBEPAUCRuntimeClass@@XZ
?GetMessageMap@CNPSTransferWnd@@MBEPBUAFX_MSGMAP@@XZ
?PreCreateWindow@CNPSTransferWnd@@MAEHAAUtagCREATESTRUCTW@@@Z
?PreTranslateMessage@CNPSTransferWnd@@MAEHPAUtagMSG@@@Z
??0CNPSTransferWnd@@QAE@XZ
??0CNPSDialog@@IAE@IPAVCWnd@@@Z
??1CNPSDialog@@MAE@XZ
?initialDialog@CNPSDialog@@QAEXHHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?DoDataExchange@CNPSDialog@@MAEXPAVCDataExchange@@@Z
?GetThisMessageMap@CNPSDialog@@KGPBUAFX_MSGMAP@@XZ
?OnCtlColor@CNPSDialog@@IAEPAUHBRUSH__@@PAVCDC@@PAVCWnd@@I@Z
?GetThisClass@CNPSDialog@@SGPAUCRuntimeClass@@XZ
?PreCreateWindow@CNPSFrame@@MAEHAAUtagCREATESTRUCTW@@@Z
?SetImage@CNPSButton@@QAEXIK@Z

mfc80u

ord1198
ord764
ord3983
ord5196
ord2030
ord1590
ord2068
ord6115
ord1646
ord2072
ord6063
ord1647
ord1903
ord4109
ord1953
ord3981
ord5157
ord5351
ord1353
ord3923
ord4961
ord4190
ord3339
ord6010
ord1894
ord6275
ord3796
ord6273
ord1543
ord2155
ord1513
ord2163
ord2169
ord2399
ord2366
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord3436
ord2407
ord2390
ord2392
ord357
ord2394
ord606
ord2388
ord2404
ord2384
ord577
ord931
ord6061
ord927
ord929
ord283
ord925
ord920
ord5229
ord5231
ord5956
ord501
ord1591
ord709
ord4276
ord4716
ord3397
ord1785
ord5198
ord3636
ord4255
ord4179
ord4480
ord6265
ord3943
ord5067
ord2638
ord1899
ord3703
ord5141
ord4290
ord3713
ord4238
ord4119
ord3712
ord1393
ord2527
ord3940
ord2640
ord1608
ord2534
ord1611
ord2856
ord5909
ord2708
ord6721
ord4301
ord1338
ord2829
ord1334
ord2255
ord2725
ord4980
ord1079
ord2651
ord2531
ord1343
ord5558
ord774
ord860
ord2311
ord776
ord370
ord1178
ord618
ord5999
ord3249
ord1086
ord1248
ord5708
ord280
ord1176
ord5437
ord762
ord266
ord265
ord1118
ord1472
ord6293
ord5327
ord293
ord261
ord1476
ord4100
ord282
ord6700
ord2261
ord3990
ord1479
ord2340
ord6282
ord1172
ord5316
ord1571
ord3103
ord4310
ord1271
ord896
ord1925
ord3204
ord1182
ord5485
ord3198
ord4074
ord2086
ord1582
ord760
ord4234
ord572
ord587
ord4574
ord3311
ord3157
ord3281
ord741
ord1634
ord1572
ord4256
ord1955
ord3286
ord5171
ord5199
ord6271
ord5148
ord1392
ord5908
ord6720
ord1542
ord1661
ord5637
ord1662
ord4117
ord2011
ord3995
ord4884
ord715
ord4729
ord2077
ord4206
ord1536
ord6086
ord5178
ord5911
ord4226
ord2424
ord5210
ord2985
ord3133
ord3158
ord3435
ord1784
ord5803
ord6301
ord1058
ord1274
ord2365
ord4259
ord4271
ord1297
ord2164
ord1117
ord5144
ord3939
ord1548
ord5524
ord2418
ord2419
ord2986
ord5352
ord940
ord2933
ord4129
ord4303
ord5006
ord5003
ord2609
ord1904
ord2237
ord4347
ord5727
ord3590
ord1545
ord3678
ord2656
ord3342
ord1578
ord5053
ord731
ord3301
ord5829
ord3756
ord4314
ord3189
ord2648
ord2239
ord1155
ord3327
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord4461
ord3942
ord4463
ord5222
ord3677
ord5220
ord2925
ord1911
ord3826
ord5378
ord566
ord6215
ord757
ord5096
ord1007
ord3800
ord5579
ord2054
ord4320
ord3824
ord6274
ord3795
ord6272
ord4008
ord1121
ord4032
ord1049
ord4026
ord5971
ord4025
ord547
ord956
ord334
ord593
ord5221
ord3639
ord368
ord616
ord4699
ord4258
ord4476
ord6039
ord5930
ord2762
ord3034
ord4216
ord1913
ord4733
ord4846
ord4251
ord5491
ord2736
ord5408
ord1370
ord5588
ord5152
ord2042
ord2007
ord6234
ord2615
ord2608
ord4560
ord4784
ord4437
ord4438
ord2121
ord899
ord6172
ord2260
ord3585
ord565
ord756
ord1577
ord620
ord3676
ord4585
ord4112
ord5373
ord2444
ord4267
ord1352
ord3338
ord5147
ord3968
ord4855
ord4858
ord4373
ord4378
ord4375
ord4393
ord5170
ord4395
ord4300
ord4380
ord4771
ord4175
ord4166
ord4974
ord4775
ord4198
ord777
ord557
ord745
ord564
ord755
ord1296
ord3028
ord3910
ord3557
ord5414
ord6014
ord730
ord3363
ord2781
ord330
ord589
ord5713
ord457
ord5392
ord5791
ord5711
ord1282
ord287
ord3444

msvcr80

??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
memmove_s
swscanf_s
free
_wcsdup
wcsncpy_s
_purecall
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
??0exception@std@@QAE@ABV01@@Z
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memcpy_s
_wtoi
_vsnwprintf_s
swprintf_s
_initterm
malloc
__CxxFrameHandler3
_CxxThrowException
memset
memcpy

kernel32

FormatMessageW
InterlockedDecrement
HeapAlloc
OutputDebugStringW
LoadLibraryW
Sleep
HeapFree
GetProcessHeap
GetCurrentProcessId
GetLastError
MultiByteToWideChar
lstrlenA
GetModuleFileNameW
GetThreadLocale
lstrlenW
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
WideCharToMultiByte
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
GetSystemDefaultLCID

user32

EnableMenuItem
GetWindowRect
PtInRect
GetParent
GetClientRect
IsWindow
InvalidateRect
EnableWindow
EmptyClipboard
OpenClipboard
GetKeyState
GetClipboardFormatNameW
SetClipboardData
CloseClipboard
GetClipboardData
CopyRect
OffsetRect
SetRect
ScreenToClient
GetCursorPos
GetActiveWindow
LoadIconW
DefWindowProcW
SetScrollPos
SetScrollRange
PostMessageW
IsWindowVisible
DestroyMenu
GetSubMenu
LoadMenuW
SetTimer
UpdateWindow
KillTimer
SendMessageW
RegisterWindowMessageW

gdi32

CreatePen
CreateSolidBrush
GetTextCharsetInfo
Rectangle
CreateFontW
DeleteObject

comctl32

InitCommonControlsEx

ole32

CoInitialize
OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString

oleaut32

GetErrorInfo
VariantTimeToSystemTime
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SysFreeString
SystemTimeToVariantTime
VariantChangeType
VariantInit
VariantClear

toolkitpro1112vc80u

?InitCommandBars@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@QAEHPAUCRuntimeClass@@@Z
??0CXTPClientRect@@QAE@PBVCWnd@@@Z
?GetThisClass@CXTPCommandBars@@SGPAUCRuntimeClass@@XZ
?OnSetPreviewMode@?$CXTPFrameWndBase@VCFrameWnd@@@@UAEXHPAUCPrintPreviewState@@@Z
?LoadFrame@?$CXTPFrameWndBase@VCFrameWnd@@@@UAEHIKPAVCWnd@@PAUCCreateContext@@@Z
?OnHookMessage@CXTPOffice2007FrameHook@@MAEHPAUHWND__@@IAAIAAJ2@Z
?OnWndMsg@?$CXTPCommandBarsSiteBase@VCFrameWnd@@@@MAEHIIJPAJ@Z

gdiplus

GdipDeleteBrush
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImagePointRectI
GdipCreateSolidFill
GdipFillRectangleI
GdipCreateFromHDC
GdipDeleteGraphics

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

dump

?RegisterCrashHandler@@YAHPB_W0@Z

npscomnctrl

?CheckDragText@CNPSDragDropText@@QAEHH@Z
?LoadBitmapFromResource@NPSGdiPlusUtil@@YAPAVBitmap@Gdiplus@@PAUHINSTANCE__@@PB_W1@Z
??0CNPSComboBox@@QAE@XZ
??1CNPSComboBox@@UAE@XZ
?initandColor@CNPSComboBox@@QAEXXZ
??0CNPSTransMenu@@QAE@XZ
??1CNPSTransMenu@@UAE@XZ
NPSLOG
?TrackPopupMenu@CNPSTransMenu@@QAEXIHHPAVCWnd@@PBUtagRECT@@H@Z
??0CWndShadow@@QAE@XZ
??1CWndShadow@@UAE@XZ
?InitNPSSkinManager@@YAXPB_W0@Z
?Create@CWndShadow@@QAEXPAUHWND__@@@Z
?InitShadow@CWndShadow@@QAEXXZ
?NPSDENGErrorStrSimple@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@ABV_com_error@@@Z
??0CNPSACEdit@@QAE@XZ
?Init@CNPSACEdit@@QAEXXZ
?SetACEditFont@CNPSACEdit@@QAEXPAVCFont@@0@Z
?AddSearchStrings@CNPSACEdit@@QAEXAAV?$CArray@UACEditData@@U1@@@@Z
??1CNPSACEdit@@UAE@XZ
?SetEditData@CNPSACEdit@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?GetEditData@CNPSACEdit@@QAEXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0@Z
?Initialize@NPSGdiPlusUtil@@YAXXZ
?GetTextNumber@CNPSACEdit@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?GetMessageMap@CNPSACEdit@@MBEPBUAFX_MSGMAP@@XZ
?PreTranslateMessage@CNPSACEdit@@MAEHPAUtagMSG@@@Z
?Uninitialize@NPSGdiPlusUtil@@YAXXZ
?SetThreadLocaleEx@@YAHK@Z
?Initialize@CWndShadow@@SA_NPAUHINSTANCE__@@@Z
?NPSSkinApplyWindow@@YAXPAUHWND__@@@Z
?ReceiveStringData@CNPSDragDropText@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
??1CNPSDragDropText@@QAE@XZ
??0CNPSDragDropText@@QAE@XZ
?GetDragDataToSender@CNPSDragDropText@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0HAAV23@11@Z
?GetItemCount@CNPSDragDropText@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
??1CNPSDropTarget@@UAE@XZ
?GetHeaderInfo@CNPSDragDropText@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV23@H@Z
??0CNPSDropTarget@@QAE@XZ
?CheckHeader@CNPSDragDropText@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HH@Z
?DrawStrechPNG@NPSGdiPlusUtil@@YAHPAVCDC@@PAVBitmap@Gdiplus@@HHHHHHHH@Z
?NPSMessageBox@@YAHPAUHWND__@@PB_W1I@Z

npsdbproxy

??0CNPSDBProxy@@QAE@XZ
??1CNPSDBProxy@@QAE@XZ
?ExecuteQuery@CNPSDBProxy@@QAEHPB_WH@Z
?Open@CNPSDBProxy@@QAEHPB_W0H@Z
?ExistTable@CNPSDBProxy@@QAEHPB_W@Z
?Close@CNPSDBProxy@@QAEHXZ
?ExecuteQuery@CNPSDBProxy@@QAEHPB_WAAV?$vector@V?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@V?$allocator@V?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@@2@@std@@@Z
?GetTableInfo@CNPSDBProxy@@QAEPAVCObject@@PB_W@Z

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e167a1c44862a321f667dd236ae58cb7

Headers

File Characteristics

PDB Paths

Imports

npscustomctrl

mfc80u

msvcr80

kernel32

user32

gdi32

comctl32

ole32

oleaut32

toolkitpro1112vc80u

gdiplus

msvcp80

dump

npscomnctrl

npsdbproxy

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 32KB - Virtual size: 28KB

.text Size: 116KB - Virtual size: 116KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 32KB - Virtual size: 28KB

.text
Size: 116KB - Virtual size: 116KB