662ccec51149e62b4d97deca634a05e1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

662ccec51149e62b4d97deca634a05e1_JaffaCakes118
Size

965KB
MD5

662ccec51149e62b4d97deca634a05e1
SHA1

939b0763180a514ef59e82621e8c44a7d5ff6655
SHA256

84112a17887078f63957932fde99d8f9e19921efa26e03d4f9b3a0eaa42fb28c
SHA512

1d7fbc90c3e7e88a0566b643ac9a18947b2bbc19f5425c3ab8c5a762636f3d5fc3b04bdde3ff70462208d1ee882d4da6692cc5d9a06de27a3673598a1a832bed
SSDEEP

24576:/31V65ScZZAkOg5OTwzELCJ4xhp9On7RHVLr:q5wpCJ4xhLOn7fr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
662ccec51149e62b4d97deca634a05e1_JaffaCakes118

Files

662ccec51149e62b4d97deca634a05e1_JaffaCakes118
.dll windows:5 windows x86 arch:x86

425cb978e2fdd909230577433f1a3b71

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\icp\projects\BRSDK73\se_5x_engine\se_5x_engine\ilsyncEx\Release_mtd\ilsyncex.pdb

Imports

attendees

?createAttendeeList@@YAPAUIAttendeeList@@XZ
?createAttendee@@YAPAUIAttendee@@XZ

ptattach

?GetNumTags@CPtAttachmentInfo@@QAEJPAK@Z
?GetAttachmentID@CPtAttachmentInfo@@QAEJPAPBD@Z
?AddAttachment@CPtAttachmentInfoList@@QAEJABVCPtAttachmentInfo@@PAK@Z
?GetTag@CPtAttachmentInfoList@@QAEJPBDPAPBD@Z
?GetNextTag@CPtAttachmentInfo@@QAEJPAPBD0@Z
?GetAttachmentEncoderDecoder@@YAJPAPAVCPtAttachmentEncoder@@@Z
??0CPtAttachmentInfoList@@QAE@XZ
??1CPtAttachmentInfoList@@QAE@XZ
?AddTag@CPtAttachmentInfo@@QAEJPBD0@Z
??0CPtAttachmentInfo@@QAE@XZ
?FreeAttachmentEncoderDecoder@@YAJPAVCPtAttachmentEncoder@@@Z
?GetAttachment@CPtAttachmentInfoList@@QAEJKPAPAVCPtAttachmentInfo@@@Z
?GetNumAttachmentItems@CPtAttachmentInfoList@@QAEJPAK@Z

zlib1

uncompress

iltif32

_TIFFieldValuesDifferEx@32

recipients

ord1
ord2
ord3

kernel32

HeapReAlloc
HeapDestroy
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetTempFileNameA
GetTempPathA
LoadResource
FindResourceA
IsDBCSLeadByte
WideCharToMultiByte
MultiByteToWideChar
SystemTimeToFileTime
LocalFileTimeToFileTime
lstrlenW
lstrlenA
GlobalLock
GlobalUnlock
FileTimeToLocalFileTime
FileTimeToSystemTime
QueryPerformanceFrequency
LocalAlloc
LocalFree
QueryPerformanceCounter
FreeLibrary
GetProcAddress
GetPrivateProfileStringW
lstrcpyA
GetProcessHeap
HeapFree
GetSystemTime
GetModuleFileNameW
GetFileAttributesW
ReleaseMutex
CloseHandle
CreateMutexA
HeapSize
WaitForSingleObject
CopyFileW
DeleteFileW
GlobalFree
GlobalAlloc
GlobalFlags
GlobalReAlloc
CreateFileW
SetFilePointer
GetFileSizeEx
ReadFile
GetModuleFileNameA
Sleep
LoadLibraryW
GetTickCount
DeleteFileA
MoveFileW
_lread
_llseek
GetUserDefaultLangID
GetTimeZoneInformation
_lwrite
_lclose
WriteFile
WritePrivateProfileStringW
GetProfileStringA
GetLocaleInfoW
GetThreadLocale
GetTempFileNameW
HeapAlloc
GetTempPathW
GetShortPathNameW
GetFileSize
GetFileTime
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleHandleA
IsBadReadPtr
LoadLibraryExW
GetLastError

user32

CharLowerA
wsprintfW
wsprintfA
wvsprintfA
CharUpperA

advapi32

RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
StgOpenStorageEx
StgCreateDocfile
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
StgOpenStorage
StgCreateStorageEx

oleaut32

SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SysAllocString

msvcp90

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0strstreambuf@std@@QAE@H@Z
??1strstreambuf@std@@UAE@XZ
?freeze@strstreambuf@std@@QAEX_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?_Copy_s@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPA_WIII@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

msvcr90

tolower
?terminate@@YAXXZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_CxxThrowException
memset
__CxxFrameHandler3
memcpy
__RTDynamicCast
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
_invalid_parameter_noinfo
wcscpy_s
_wtol
sprintf
memmove_s
strncpy
memcpy_s
_stricmp
_mbsicmp
_wcsicmp
sprintf_s
_create_locale
wcsstr
_wtof_l
_free_locale
_swprintf_s_l
wcscat_s
strcpy_s
_waccess
_makepath_s
strstr
_wsplitpath_s
swprintf_s
_wmakepath_s
_snwprintf
wcsnlen
wcsncpy_s
_mbscmp
strncpy_s
strtol
wcstol
wcschr
strtok_s
strrchr
_wremove
_strupr
_waccess_s
vswprintf_s
atol
_access
wcsrchr
_wtoi
isalpha
iswalnum
_strtime_s
_strdate_s
_ctime64_s
_time64
_splitpath_s
_wrename
_wstat64i32
_ftime64_s
_ismbcspace
_mbsinc
memmove
strncmp
_wmkdir
atoi
strncat
_itoa_s
strcat_s
_mktemp_s
mbstowcs_s
wcstombs_s
strchr
strtoul
_mbsstr
strtok
_ltoa_s
_strupr_s
atof
toupper
strcspn
_localtime64_s
wcstoul
_i64toa_s
_fullpath
free
realloc
malloc
_strnicmp
isleadbyte
_tempnam
fprintf
__iob_func
fopen_s
fclose
fgets
_mbschr
_mbsnbcpy_s
_mbsnbcmp
_strdup
isalnum
_mbstok_s

Exports

Exports

CreateSyncEngineSession
_CreateThreeWaySyncSession@4

Sections

.text
Size: 669KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 27KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

425cb978e2fdd909230577433f1a3b71

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

attendees

ptattach

zlib1

iltif32

recipients

kernel32

user32

advapi32

ole32

oleaut32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 669KB - Virtual size: 668KB

.rdata Size: 118KB - Virtual size: 117KB

.data Size: 27KB - Virtual size: 83KB

.rsrc Size: 101KB - Virtual size: 100KB

.reloc Size: 49KB - Virtual size: 48KB

.text
Size: 669KB - Virtual size: 668KB

.rdata
Size: 118KB - Virtual size: 117KB

.data
Size: 27KB - Virtual size: 83KB

.rsrc
Size: 101KB - Virtual size: 100KB

.reloc
Size: 49KB - Virtual size: 48KB