6087fc260d5cfe169e97a28c0f95948e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6087fc260d5cfe169e97a28c0f95948e_JaffaCakes118
Size

100KB
MD5

6087fc260d5cfe169e97a28c0f95948e
SHA1

a6170d1a065cdbf5fd5e25d3bc1f739a88df89f3
SHA256

f2a0c3ba2f48c01e8b4f507a084dba56b8eac9c08454cb0439e3d167c8251fbb
SHA512

c6063f7deb0329e37cd6295ce9e81f11052bd1325bd889e19d0543e87647653fef75358e3731e3197406d8d8e2411d3c11dcdfc772b1eaf591f612688363c1d3
SSDEEP

3072:MHI4lnf3eY/D9Q/vYPCPjoBmvkNiLd2fJY3yhRUbu1oJaXV7KQCnqkRuYtgv7W8:wI4lnf3eY/BQ4PCPjoBmvkNiLd2fJY3y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6087fc260d5cfe169e97a28c0f95948e_JaffaCakes118

Files

6087fc260d5cfe169e97a28c0f95948e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

15398fed5990fc8b7074a34a074422f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

commveh32

?setstatus@Buf@@QAEXW4T_CM_SectionError@@DPAD@Z
?get@Buf@@QAEIPADII@Z
?clear@Buf@@QAEID@Z
?set@Buf@@QAEIJI@Z
??1Stock@@QAE@XZ
??0Stock@@QAE@XZ
?com@Buf@@QAEIQADPAV1@@Z
?getsizebuf@Buf@@QAEJXZ
?get@Buf@@QAEIPAEI@Z
?set@Buf@@QAEIPADII@Z
?set@Buf@@QAEIEI@Z
??1Buf@@QAE@XZ
??0Buf@@QAE@XZ
?set@Buf@@QAEIPADH@Z
?OpenDefaultMessagerie@Buf@@QAEIXZ
?destroyServiceUnit@Buf@@QAEIXZ
?createServiceUnit@Buf@@QAEIPBDPAD_N@Z
?destroyService@Buf@@QAEIXZ
?createService@Buf@@QAEIPBD@Z
?ExecuteFnc@Buf@@QAEIPBDAAVStock@@@Z
?getstatuscom@Buf@@QAEIXZ
?getstatus@Buf@@QAEIXZ
?get@Buf@@QAEIPAV1@IIH@Z
?concat@Buf@@QAEIPAV1@@Z
?move@Buf@@QAEIPAV1@II@Z
?set@Buf@@QAEIFI@Z
?DejaDedans@Buf@@QAEHPADIIIE@Z
?SetContexteTEP@Stock@@QAEIPAD0@Z
?identifyEcuVersion@Buf@@QAEIJ@Z
?getRequestsAndParametersIdent@Buf@@QAEIXZ
?GetDescList@Buf@@QAEIPBD@Z
?getMessagerieServiceUnitsName@Buf@@QAEIAAJPBD_N@Z
?AFputstatus@Buf@@QAEXDPAD@Z
?getServiceUnitALLParamsValue@Buf@@QAEIW4T_PARAM_TYPE@@G@Z
?getServiceUnitParamValue@Buf@@QAEIW4T_PARAM_TYPE@@PBD_N@Z
?getServiceUnitParamStates@Buf@@QAEIPBD0W4T_PARAM_TYPE@@PADAAF_N@Z
?getServiceUnitALLParamsInfo@Buf@@QAEIPBD0AAKW4T_PARAM_TYPE@@PAUT_PARAM_INFO@@_N@Z
?getServiceUnitNbParams@Buf@@QAEIPBD0W4T_PARAM_TYPE@@AAJ_N@Z
?GetECUFaultFrame@Buf@@QAEIXZ
?GetECUFaultType@Buf@@QAEIXZ
?move@Buf@@QAEIPAV1@@Z
?Temporisation@@YAXK@Z
?SetTableLIDPleine@TableLID@@QAEXH@Z
?GetTableLIDPleine@TableLID@@QBEHXZ
?AffichTableLID@TableLID@@QBEXXZ
?GetListFamLID@TableLID@@QBEHPAE@Z
?GetECUName@TableLID@@QBEXPAD@Z
?RemplirTableLID@TableLID@@QAE?AW4STATUS_LID@@XZ
?GetECUFrame@TableLID@@QAEXPAVBuf@@@Z
?mGetTableLID@C_CTX_FunContext@@QBEPAVTableLID@@XZ

dll_pgp

?output@GestDebug@@QBAXHPBDZZ
?Instance@GestDebug@@SAPAV1@XZ
?ExecuteComInitFin@@YA_NPADW4T_SERVICEUNIT_TYPE@@AAVStock@@@Z
?BufToString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVBuf@@@Z
?SetMnemo@GestComBuf@@SA_NAAVBuf@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1H@Z
?getRawMnemo@GestComBuf@@QAEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?execute@GestComBuf@@QAE_NPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1GestComBuf@@UAE@XZ
??0GestComBuf@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?GetChaineBuf@@YAHAAVBuf@@HAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1Cmd_Mess@@UAE@XZ
??0Cmd_Mess@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4T_PARAM_TYPE@@W4TypeFonction@@PAVStock@@@Z
?getValues@ConfPgp@@QBEPBQBEPBE@Z
?Instance@ConfPgp@@SAPAV1@XZ
?RecupValParam@@YA_NAAVStock@@W4T_PARAM_TYPE@@PAVCmd_Mess@@@Z
?FormatExitBuffer@GestAppContext@@QAEAAVBuf@@AAVStock@@@Z
??1GestAppContext@@UAE@XZ
??0GestAppContext@@QAE@PAVStock@@@Z
?Split@GestComBuf@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@D@Z
?GetMnemoRT@GestComBuf@@SAHAAVBuf@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z
?execute@GestComBuf@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4eTypeCalculCRC@@PAV23@@Z
?SetPrivateInfo@GestAppContext@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetParamValue@GestAppContext@@QAEFABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?getPosTabParam@Cmd_Mess@@QAEJV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AddProcessingKey@XmlFile@@QAE_NPBD@Z
?get_TabParam@Cmd_Mess@@QAEPAPAVPar_Mess@@XZ
?AddFrameKey@XmlFile@@QAE_NPBD@Z
?AddProperty@XmlFile@@QAE_NPBD00000@Z
?AddDtcInter@XmlFile@@QAE_NPBD@Z
?AddDtc@XmlFile@@QAE_NPBD@Z
?Create@XmlFile@@QAEPADXZ
??1XmlFile@@UAE@XZ
??0XmlFile@@QAE@XZ
?get_lLength@ParValMS@@QAE?BJXZ
?get_iDataTypeId@ParValMS@@QAE?BHXZ
?ExecuteTrame@@YA_NPADW4T_SERVICEUNIT_TYPE@@PAVCmd_Mess@@HAAVStock@@W4eTypeCalculCRC@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?StrBruteToValConv@@YAJPAD0H@Z
?getTypedService@CCCP@@SA?AV?$vector@US_FrameIdentifier@@V?$allocator@US_FrameIdentifier@@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?getECUFrame@CCCP@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1CCCP@@UAE@XZ
??0CCCP@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAVStock@@W4T_PARAM_TYPE@@0@Z
?RunTelecoding@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@00PAVStock@@@Z
?changeServicesAndServicesUnitsNames@TlcdDLPR@@QAEXAAVBuf@@@Z
?TelecodageRun@TlcdDLPR@@QAEXAAVStock@@W4eTypeAlgoConfPoss@@@Z
??1TlcdDLPR@@UAE@XZ
??0TlcdDLPR@@QAE@AAVBuf@@PAVStock@@@Z
?Free@PopUpProgress@@SAXXZ
?Instance@PopUpProgress@@SAPAV1@XZ
?GetParamValue@GestAppContext@@QAEFABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z
?getType@JobException@@QAE?AW4ExceptionType@@XZ
?processECUAnswer@C_ActuatorTest@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?launchATRequest@C_ActuatorTest@@QAE_NXZ
?overloadParameters@C_ActuatorTest@@QAE_NXZ
?activateServiceAndServiceUnit@C_ActuatorTest@@QAE_NXZ
?parseXMLBuf@C_ActuatorTest@@QAE_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1C_ActuatorTest@@UAE@XZ
??0C_ActuatorTest@@QAE@PAVStock@@@Z
?manage@C_DataWriteManager@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z
??1C_DataWriteManager@@UAE@XZ
??0C_DataWriteManager@@QAE@PAVStock@@@Z
?toString@GestComBuf@@SAXPBEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?toBinary@GestComBuf@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAPAEAAH@Z
?GetMnemonicValue@@YAHPBDPADAAVStock@@@Z
?SetMnemonicValue@@YAHPBDPADAAVStock@@@Z

msvcp80

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

msvcr80

malloc
_wassert
_ltoa
atol
strtol
strncpy
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
free
strncmp
atoi
strncat
??_V@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_invalid_parameter_noinfo
??2@YAPAXI@Z
sscanf
sprintf
__CxxFrameHandler3
memset
memcpy
_CxxThrowException

kernel32

Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange

Exports

Exports

APPGEN61
APPGEN_RAW152
DATAWRITE143
EFFDEF22
FINDIAG52
FINDMEMZONE77
GET_SEED132
INITDIAG51
LECTDEF67
LECTDEFECU23
LECTUREZI53
SEND_KEY133
SPEC_TLCDDLPR_MULTILID1281
SPEC_TRAME_MESS2168
TAM_MCC_GEN140
TA_GEN142
TELECODAGE_GEN127
TLCD_DLPR128
TRAMEGEN56

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15398fed5990fc8b7074a34a074422f3

Headers

File Characteristics

Imports

commveh32

dll_pgp

msvcp80

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB