4a6e3efccb58d5db071b31bb53b964fc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4a6e3efccb58d5db071b31bb53b964fc_JaffaCakes118
Size

173KB
MD5

4a6e3efccb58d5db071b31bb53b964fc
SHA1

0edc577b8db5765d810b191730e0dc9bc0f02248
SHA256

245a4aa8e5b0fdf3e2d7bafc43aec191cb01f731cff0dcb3231a9156ca2c52c7
SHA512

f5c084d0264e710d548b2988c6ca6ef69d1a9b9dcc64367ebe1265857750cc424f56f442b01f68a34624bca06503b009689f84f13f0d0efecdeedd9390d557ba
SSDEEP

3072:c78tVaS8PnjTho2tSDFYUJ3YQEBTbRRCZUM3Abu/GJt:cQtUF7ThTSDnJY1BBRCZL3AbX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a6e3efccb58d5db071b31bb53b964fc_JaffaCakes118

Files

4a6e3efccb58d5db071b31bb53b964fc_JaffaCakes118
.exe windows:6 windows x86 arch:x86

bd7b88b3bf13b911dfbb9520bc2312fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

PDB Paths

S:\wtf\_x86\exe.applet\applet.imagemount.exe:pdb

Imports

lib.syslog

?level@SysLogFilter@@SAIXZ
?state@SysLogFilter@@SA_NI@Z
?reg@SysLogFilter@@SAIPBD@Z
?id@SysLogFilter@@SAII@Z
?procName@SysLog@@SAXV?$Ref@VString@@@@@Z
?stdOutPrinter@SysLogStream@@SA?AV?$Ref@VSysLogStream@@@@XZ

svc.filesys

?convertStyle@Service@Client@Filesystem@Services@@SA?AV?$Ref@VString@@@@V5@W4DelimiterStyle@234@@Z
?open@File@Client@Filesystem@Services@@SA?AV?$Ref@VFile@Client@Filesystem@Services@@@@V?$Ref@VString@@@@I@Z
?search@Service@Client@Filesystem@Services@@SA?AV?$Ref@VString@@@@V5@0@Z
?open@Nodes@Client@Filesystem@Services@@SA?AV?$Ref@VNode@@@@V?$Ref@VString@@@@@Z

svc.node

?create@Generic@Providers@Nodes@Services@@SA?AV?$Ref@VGeneric@Interfaces@@@@V?$Ref@VProvider@Nodes@Services@@@@@Z
?create@Provider@Nodes@Services@@SA?AV?$Ref@VProvider@Nodes@Services@@@@V?$Ref@VNode@@@@I@Z

lib.zlib.1.2

inflate
inflateEnd
inflateInit_

lib.stdc

realloc
memcmp
fread
clockTicks
calloc
free
malloc
abort
fprintf
setvbuf
fclose
rand
toupper
clock
fopen
_getstderr

lib.time

?createLocal@Time@@SA?AV?$Ref@VTime@@@@_J@Z
?currtime@Date@@SA?AV?$Ref@VString@@@@V2@V?$Ref@VTime@@@@@Z

svc.credential

?query@Credential@Client@Credentials@Services@@SA?AV?$Ref@VCredential@Client@Credentials@Services@@@@V?$Ref@VString@@@@IV?$Ref@VTexts@Client@Credentials@Services@@@@I@Z
?create@Texts@Client@Credentials@Services@@SA?AV?$Ref@VTexts@Client@Credentials@Services@@@@XZ

svc.event

?create@DeviceClient@@SA?AV?$Ref@VDeviceClient@@@@V?$Ref@VString@@@@_N@Z

svc.virtualdisk

?create@Mount@Client@VirtualDisk@Services@@SA?AV?$Ref@VMount@Client@VirtualDisk@Services@@@@I@Z

svc.heimdall

?create@Label@Elements@Client@Heimdall@Services@@SA?AV?$Ref@VLabel@Elements@Client@Heimdall@Services@@@@V?$Ref@VString@@@@@Z
?create@Container@Elements@Client@Heimdall@Services@@SA?AV?$Ref@VContainer@Elements@Client@Heimdall@Services@@@@XZ
?create@Parameters@Client@Heimdall@Services@@SA?AV?$Ref@VParameters@Client@Heimdall@Services@@@@XZ
?show@Dialog@Client@Heimdall@Services@@SAIV?$Ref@VString@@@@V?$Ref@VContainer@Elements@Client@Heimdall@Services@@@@V?$Ref@VBase@Elements@Client@Heimdall@Services@@@@II@Z
?show@Dialog@Client@Heimdall@Services@@SAIW4Severity@1234@V?$Ref@VString@@@@1II@Z
?create@FSItem@Client@Heimdall@Services@@SA?AV?$Ref@VFSItem@Client@Heimdall@Services@@@@V?$Ref@VParameters@Client@Heimdall@Services@@@@@Z
?create@GroupBox@Elements@Client@Heimdall@Services@@SA?AV?$Ref@VGroupBox@Elements@Client@Heimdall@Services@@@@V?$Ref@VString@@@@@Z
?create@RadioButton@Elements@Client@Heimdall@Services@@SA?AV?$Ref@VRadioButton@Elements@Client@Heimdall@Services@@@@V?$Ref@VString@@@@@Z
?create@DropDown@Elements@Client@Heimdall@Services@@SA?AV?$Ref@VDropDown@Elements@Client@Heimdall@Services@@@@V?$Ref@VString@@@@@Z

svc.binary

?env@Binary@@SA?AV?$Ref@VEnv@@@@XZ

app.guilauncher.client

?create@Applet@Client@GUILauncher@Applications@@SA?AV?$Ref@VApplet@Client@GUILauncher@Applications@@@@V?$Ref@VString@@@@V?$Ref@VEventHandler@Applet@Client@GUILauncher@Applications@@@@@Z

lib.io.char

?split@StringUtil@@SA?AV?$Ref@V?$TVector@V?$Ref@VString@@@@@@@@V?$Ref@VString@@@@II@Z
?stdOutWriter@StdIO@@SA?AV?$Ref@VCharWriter@@@@XZ
?num@StrConv@@SA_NV?$Ref@VString@@@@PAI@Z
?replace@StringUtil@@SA?AV?$Ref@VString@@@@V2@00I@Z
?trim@StringUtil@@SA?AV?$Ref@VString@@@@V2@@Z
?str@StrConv@@SA?AV?$Ref@VString@@@@_K@Z
?create@StringFormatter@Characters@IO@Libraries@@SA?AV?$Ref@VStringFormatter@Characters@IO@Libraries@@@@V?$Ref@VString@@@@I@Z

lib.locale

?currentLanguage@Locale@1Libraries@@SA?AV?$Ref@VString@@@@XZ

lib.i18n

?create@I18N@@SA?AV?$Ref@VI18N@@@@PBD000@Z

system

?sleep@Thd@@SAXI@Z
?cancelled@Thd@@SA_NXZ
?create@String@@SA?AV?$Ref@VString@@@@PBD@Z
?get@Error@@SAIXZ
??1Object@@MAE@XZ
?selfTest@Object@@UAE_NV?$Ref@VStream@Interfaces@@@@@Z
?dump@Object@@UAEXV?$Ref@VStream@Interfaces@@@@@Z
?create@Thd@@SA?AV?$Ref@VThd@@@@V?$Ref@VExec@@@@@Z
?_dump@Object@@UAEXV?$Ref@VStream@Interfaces@@@@@Z
?gcproxy@Object@@UAEPAVGcProxy@@XZ
?obj@Object@@UAE?AV?$Ref@VObject@@@@XZ
?counterRef@Object@@UAEIXZ
?unlockRef@Object@@UAEXXZ
?lockRef@Object@@UAEXXZ
?decRef@Object@@UAEXXZ
?incRef@Object@@UAEXXZ
??0Object@@QAE@XZ
??_7type_info@@6B@
?exit@Proc@@SAXI@Z
?create@Sem@@SA?AV?$Ref@VSem@@@@I@Z
?create@String@@SA?AV?$Ref@VString@@@@XZ
?create@Thd@@SA?AV?$Ref@VThd@@@@V?$Ref@VExec@@@@IIIV?$Ref@VString@@@@@Z
?bootParameter@Sys@@SA?AV?$Ref@VString@@@@XZ
?set@Error@@SAXI@Z
?fill8@Mem@@SAXPAXIE@Z
?copy@Mem@@SAXPBXPAXI@Z
?free@Heap@@SAXPAX@Z
?alloc@Heap@@SAPAXI@Z
?create@String@@SA?AV?$Ref@VString@@@@PBDII@Z
?create@String@@SA?AV?$Ref@VString@@@@PBEII@Z
?create@Con@@SA?AV?$Ref@VCon@@@@I@Z
?create@OutMsg@@SA?AV?$Ref@VOutMsg@@@@XZ
?create@Chn@@SA?AV?$Ref@VChn@@@@V?$Ref@VConMan@@@@@Z
?free@Heap@@SAXPAXI0@Z
?alloc@Heap@@SAPAXIIPAX@Z
?lock@InitCode@@SAXXZ
?unlock@InitCode@@SAXXZ
?setExitCode@Proc@@SAII@Z
?_selfTest@Object@@UAE_NV?$Ref@VStream@Interfaces@@@@@Z
__RTDynamicCast

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd7b88b3bf13b911dfbb9520bc2312fc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

lib.syslog

svc.filesys

svc.node

lib.zlib.1.2

lib.stdc

lib.time

svc.credential

svc.event

svc.virtualdisk

svc.heimdall

svc.binary

app.guilauncher.client

lib.io.char

lib.locale

lib.i18n

system

Sections

.text Size: 124KB - Virtual size: 123KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 124KB - Virtual size: 123KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 6KB - Virtual size: 6KB