702fee16adc5f406bc31b6e1865a746e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

702fee16adc5f406bc31b6e1865a746e_JaffaCakes118
Size

309KB
MD5

702fee16adc5f406bc31b6e1865a746e
SHA1

2e4c2277dcb3eac95be6034b7eb039a4b8d5bdc1
SHA256

3f84ab97568ee641e746d7e71c82b798511c7f8451f261a04499187720674bcf
SHA512

b089cbb71a0fb932c74e31cb5079d2449dbc7f00fb1b4df83bf24736dfdd5abd35a3381fe91817771e2c89b805387831a52cd06549207708f8126930e1bd6c71
SSDEEP

3072:1ghMhi+5iCHWqkFEonUJxvVqbS8+qFdYyZn6RLZnhwaIWBHME6M1PSOAhcTm:1uEiWHFonUrVun+6dYCWLVIPEjPSOAh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
702fee16adc5f406bc31b6e1865a746e_JaffaCakes118

Files

702fee16adc5f406bc31b6e1865a746e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e13ae5fc1aadd9eba44a6e5cbcb6573a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\ribsrel\Release\releases\public\caps\libraries\windows\release\dynamic\adobe_caps.pdb

Imports

kernel32

CloseHandle
LocalFree
LoadLibraryA
CopyFileW
GetVersionExA
DeleteFileA
Sleep
DeleteFileW
GetProcAddress
GetTempPathA
GetTempPathW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetLastError
LockFile
LockFileEx
UnlockFile
GetFullPathNameA
GetFullPathNameW
GetSystemTime
GetCurrentThreadId
EnterCriticalSection
InitializeCriticalSection
InterlockedIncrement
LeaveCriticalSection
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
CreateFileA
CreateFileW
lstrcpyW
lstrlenW
GetFileAttributesW
GetFileAttributesExW
SystemTimeToFileTime
MultiByteToWideChar
GetFileSize
WideCharToMultiByte
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentProcessId

advapi32

AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
GetNamedSecurityInfoW

shell32

SHGetFolderLocation
SHCreateDirectoryExW
SHGetFolderPathW
SHGetPathFromIDListW

ole32

CoTaskMemFree

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z

msvcr80

?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
__CxxFrameHandler3
strlen
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memmove_s
free
malloc
atoi
memset
memcmp
sprintf
memcpy
??0exception@std@@QAE@ABQBD@Z
strcmp
isdigit
isspace
__iob_func
isalnum
strncpy
toupper
tolower
_gmtime64
_time64
strftime
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
strcpy
strstr
realloc

shlwapi

PathStripPathW
PathAppendW
PathRemoveBackslashW
PathFileExistsW

Exports

Exports

capsBackup
capsCloseSession
capsGetCollection
capsGetCollectionData
capsGetCollectionDataKeys
capsGetCollectionDataKeysAndValues
capsGetCollectionPayloads
capsGetCollections
capsGetInstallState
capsGetLastModTime
capsGetPayload
capsGetPayloadCollections
capsGetPayloadCollectionsAcrossUpgrades
capsGetPayloadConstraint
capsGetPayloadData
capsGetPayloadDataKeys
capsGetPayloadDataKeysAndValues
capsGetPayloads
capsGetUpgradedPayloadsKeysAndValues
capsOpenSession
capsOpenSessionNoCreate
capsRemoveCollectionData
capsRemoveCollectionDomainData
capsRemovePayloadData
capsRemovePayloadDomainData
capsSessionCommit
capsSessionRollback
capsSetCollectionData
capsSetPayloadData
pcdCacheGetLastModTime
pcdCloseSession
pcdGetDomainData
pcdGetDomainDataKeys
pcdGetDomainDataSubdomains
pcdGetLastModTime
pcdOpenCacheSession
pcdOpenCacheSessionNoCreate
pcdOpenSession
pcdOpenSessionNoCreate
pcdRemoveDomainData
pcdSessionCommit
pcdSessionRollback
pcdSetDomainData

Sections

.text
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e13ae5fc1aadd9eba44a6e5cbcb6573a

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

msvcp80

msvcr80

shlwapi

Exports

Exports

Sections

.text Size: 151KB - Virtual size: 151KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 114KB - Virtual size: 114KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 151KB - Virtual size: 151KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 114KB - Virtual size: 114KB

.reloc
Size: 5KB - Virtual size: 4KB