3f3afdd310eadd028737a3f3a0ca9f59_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3f3afdd310eadd028737a3f3a0ca9f59_JaffaCakes118
Size

985KB
MD5

3f3afdd310eadd028737a3f3a0ca9f59
SHA1

dccf939cb5635b1cac581c02be34bb3db4b1df71
SHA256

28bc1ead8bb9e58f9d993732f833948b9b2108999063fcb457ba38d31ee224f0
SHA512

967e6c7d0752e3d2b9e7a5c98ddde0fd2439e05361af4db39b80a99a5f396fad28f6f743a1ac0feb25aa7bae85f51b11e3d2b11bbacf2119ced5d7e3891c9a48
SSDEEP

12288:pgYnXg35X3Jk0J8l1adqmvY+BQKsTmOhEex6g3Xc2Yck:yYnXy5HJy1adqmvY+QM4Yck

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f3afdd310eadd028737a3f3a0ca9f59_JaffaCakes118

Files

3f3afdd310eadd028737a3f3a0ca9f59_JaffaCakes118
.exe windows:5 windows x86 arch:x86

354b2634d851b41749f18893a5fa398e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Desktop\Desktop\branches\13.0.16\bin\Win32\Release\odsw.pdb

Imports

bdch

ord2

bdutils

??1CBDDebug@@QAE@XZ
??0CBDDebug@@QAE@H@Z

bdguictl

?XBrowseForFolders@@YAHPAUXBrowseInfo@@@Z
??1CBDGDIManager@@UAE@XZ
??0CBDGDIManager@@QAE@XZ
?Init@CBDGDIManager@@QAE_NPB_W@Z

txmlutil

?LoadFile@CBDTinyXml@@UAE_NPB_W@Z
?GetIntValue@CBDTinyXml@@QBEHPBVTiXmlElement@@PB_WHPA_N@Z
??0TiXmlText@@QAE@PB_W@Z
??1TiXmlText@@UAE@XZ
?InsertEndChild@TiXmlNode@@QAEPAV1@ABV1@@Z
?SaveFile@TiXmlDocument@@QBE_NPB_W@Z
?InsertAfterChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z
?RemoveChild@TiXmlNode@@QAE_NPAV1@@Z
?Attribute@TiXmlElement@@QBEPB_WPB_WPAH@Z
??1CBDTinyXml@@QAE@XZ
?StreamIn@TiXmlElement@@MAEXPAV?$basic_istream@_WU?$char_traits@_W@std@@@std@@PAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?Accept@TiXmlElement@@UBE_NPAVTiXmlVisitor@@@Z
?Clone@TiXmlElement@@UBEPAVTiXmlNode@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?ToElement@TiXmlElement@@UBEPBV1@XZ
?ToElement@TiXmlElement@@UAEPAV1@XZ
?ToDocument@TiXmlNode@@UBEPBVTiXmlDocument@@XZ
?ToDocument@TiXmlNode@@UAEPAVTiXmlDocument@@XZ
?Parse@TiXmlElement@@UAEPB_WPB_WPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?Print@TiXmlElement@@UBEXPAU_iobuf@@H@Z
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PB_W@Z
?Attribute@TiXmlElement@@QBEPB_WPB_W@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
??0TiXmlDocument@@QAE@XZ
?GetText@TiXmlElement@@QBEPB_WXZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PB_W@Z
?GetRootElement@CBDTinyXml@@QAEPAVTiXmlElement@@XZ
??1TiXmlElement@@UAE@XZ
??0CBDTinyXml@@QAE@XZ
??1TiXmlDocument@@UAE@XZ
?InsertRootElement@CBDTinyXml@@QAEPAVTiXmlElement@@PB_W@Z
?LinkEndChild@TiXmlNode@@QAEPAV1@PAV1@@Z
??0TiXmlElement@@QAE@PB_W@Z
?SetText@CBDTinyXml@@SAPAVTiXmlText@@PAVTiXmlElement@@PB_W@Z
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ

productinfo

?GetInstance@CProductInfo@@SAPAV1@XZ

mfc90u

ord794
ord4211
ord1186
ord1144
ord1098
ord3670
ord4681
ord6806
ord2893
ord3115
ord2966
ord6018
ord5663
ord5680
ord4996
ord4347
ord2447
ord5676
ord5674
ord3217
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4423
ord4448
ord4518
ord5979
ord5938
ord939
ord6703
ord2695
ord266
ord2702
ord6630
ord2596
ord4544
ord2069
ord6604
ord265
ord1599
ord3220
ord285
ord1607
ord6687
ord2504
ord2478
ord6659
ord4235
ord6164
ord2676
ord1313
ord1314
ord899
ord1486
ord6808
ord6577
ord6579
ord4443
ord4442
ord3185
ord3736
ord2694
ord909
ord3793
ord2937
ord1603
ord5939
ord2170
ord2889
ord4287
ord3085
ord4066
ord4074
ord5841
ord1026
ord1484
ord2475
ord6683
ord2981
ord2927
ord5966
ord4926
ord4788
ord2344
ord6782
ord4163
ord6601
ord3066
ord4328
ord5102
ord4617
ord5632
ord589
ord5167
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1752
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2967
ord3140
ord2774
ord2764
ord3241
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord3514
ord5653
ord4784
ord6287
ord280
ord286
ord2597
ord3741
ord6673
ord799
ord1248
ord5007
ord2537
ord600
ord296
ord3082
ord6295
ord2337
ord1250
ord1254
ord813
ord1137
ord4543
ord2885
ord370
ord638
ord3959
ord801
ord4043
ord4967
ord811
ord4324
ord5851
ord2364
ord4631
ord3999
ord4905
ord1272

msvcr90

wcschr
wcscpy_s
??0exception@std@@QAE@XZ
_vsnwprintf
wcscmp
swprintf_s
wcslen
wcsstr
_wtoi
_wcsicmp
srand
_time64
rand
malloc
free
vswprintf_s
memmove_s
wcsnlen
_wcslwr_s
_i64tow_s
_itow_s
wcsrchr
_wtoi64
__CxxFrameHandler3
_CxxThrowException
_invalid_parameter_noinfo
memset
memcmp
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
memcpy_s
??1exception@std@@UAE@XZ
_vscwprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_localtime64
_mktime64
_vsnwprintf_s
wcscat_s

kernel32

HeapAlloc
HeapDestroy
InterlockedDecrement
GetFullPathNameW
HeapFree
GetProcessHeap
GetLastError
CreateMutexW
CloseHandle
CreateEventW
ReleaseMutex
LocalAlloc
FormatMessageW
Sleep
WaitForSingleObject
GetEnvironmentVariableW
OutputDebugStringW
FreeLibrary
GetDriveTypeW
GetLogicalDrives
HeapReAlloc
SizeofResource
LockResource
LoadResource
FindResourceExW
OpenMutexW
InitializeCriticalSection
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapSize
RaiseException
GetLongPathNameW
GetModuleHandleW
FindClose
FindFirstFileW
LoadLibraryW
lstrlenW
GetShortPathNameW
FindResourceW
DeleteCriticalSection
GetModuleFileNameW
IsDebuggerPresent

user32

SendMessageW
GetSystemMenu
MessageBoxW
SetWindowRgn
EnableWindow
GetParent
AppendMenuW
LoadStringW
PostMessageW
GetWindowRect
GetClientRect

gdi32

CreateRoundRectRgn

advapi32

GetUserNameW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

SHGetFileInfoW
SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathAppendW

ole32

CoInitialize
OleRun
CoCreateInstance
CoTaskMemAlloc
CoUninitialize

oleaut32

SysFreeString
SysStringLen
SysAllocStringLen
GetErrorInfo
VariantClear
VariantInit
SysAllocString

msvcp90

??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

txmlx

?SaveCustom@txmlx_bld_custom@@YAIPAVTiXmlElement@@AAU?$_custom_base@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_W@txmlx_struct@@K@Z
?LoadCustom@txmlx_ldr_custom@@YAIPAVTiXmlElement@@PAU?$_custom_base@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_W@txmlx_struct@@K@Z
?null_node@?$_custom_base@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_W@txmlx_struct@@2QAU12@A
?null_attr@_attr@?$_custom_base@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_W@txmlx_struct@@2QAU123@A

Sections

.text
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

354b2634d851b41749f18893a5fa398e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bdch

bdutils

bdguictl

txmlutil

productinfo

mfc90u

msvcr90

kernel32

user32

gdi32

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

msvcp90

txmlx

Sections

.text Size: 239KB - Virtual size: 239KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 19KB - Virtual size: 21KB

.rsrc Size: 507KB - Virtual size: 506KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 239KB - Virtual size: 239KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 19KB - Virtual size: 21KB

.rsrc
Size: 507KB - Virtual size: 506KB

UPX0
Size: 144KB - Virtual size: 380KB