730508a25398bee304512d732fc958b6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

730508a25398bee304512d732fc958b6_JaffaCakes118
Size

196KB
MD5

730508a25398bee304512d732fc958b6
SHA1

681f2e4c482e36ee738654f78036577e75f4d8dd
SHA256

3e68359a8e2132ee5c502fd7412ea5058c05f49633329f5286b7d2066db5cb61
SHA512

7c3de82e744ad025cc16dd8f8f0c19e78521541f2a52955f366fda7d21468c086c8e1f548b307a27f10891c1b804ac6f3525cfbc40a7b9d8f90366887e06b9b2
SSDEEP

3072:FNA0GMHosm+8+3tmwHIAPb31hneCHFRXO0Dd0UjBiYS:FqcIsv4x4decXtIY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
730508a25398bee304512d732fc958b6_JaffaCakes118

Files

730508a25398bee304512d732fc958b6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8b127f73ff32f12eadd1d4fdd6fe4e68

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\dlebansais\Documents\Projects 2005\Bluetooth SDK\AvqBtSDK\Toshiba\Release\Toshiba.pdb

Imports

tosbtapi

BtCreateCOMM2
BtGetRemoteDeviceList2
BtCloseAPI
BtGetLocalInfo2
BtRefreshSDDB2
BtConnectSDP
BtDisconnectSDP
BtServiceSearchAttribute2
BtAnalyzeProtocolParameter2
BtAnalyzeServiceAttributeLists2
BtMakeAttributeIDList2
BtMakeServiceSearchPattern2
BtDisconnect
BtOpenAPI
BtCancelDiscoverRemoteDevice
BtDiscoverRemoteDevice2
BtRecvData
BtSendData
BtGetCOMMInfoList2
BtMemFree
BtSetAutoConnectCOMMInfo
BtConnectCOMM2
BtSetAutoConnectCOMMState
BtDisconnectCOMM
BtMemAlloc
BtGetAutoConnectCOMMInfoList
BtConnect

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
WriteFile
HeapReAlloc
CloseHandle
GetCurrentThreadId
CreateEventW
ResetEvent
WaitForSingleObject
SetEvent
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
Sleep
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
VirtualAlloc
HeapFree
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetLastError
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

CreateWindowExW
wsprintfW
DestroyWindow
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
TranslateMessage
wsprintfA
DefWindowProcW
RegisterClassW
LoadIconW
LoadCursorW

advapi32

RegCloseKey
RegOpenKeyW

Exports

Exports

?IsDevicePaired@@YAHJQBE@Z
?ToshConnect@@YAJJQBEABU_GUID@@AAG@Z
?ToshConnectHeadset@@YAJJQBEABU_GUID@@AAG@Z
?ToshDeviceInquiry@@YAJJP6GJJPAXAAU_BLUETOOTH_DEVICE_INFO@@@Z0@Z
?ToshDisconnect@@YAJJG@Z
?ToshDisconnectHeadset@@YAJJG@Z
?ToshGetCOMPort@@YAJJQBEU_GUID@@ABUTOSHSERVICEINFO@@AAI@Z
?ToshGetLocalDeviceInfo@@YAHJPAE@Z
?ToshGetServiceInfo@@YAJJQBEPAUGUID_ENUM@@IP6GJJABU_GUID@@PAGAAUTOSHSERVICEINFO@@PAX@Z5@Z
?ToshInitializeAPI@@YA_NJP6GXPAXJPAG@Z0@Z
?ToshInstallCOMPort@@YAJJQBEU_GUID@@AAUTOSHSERVICEINFO@@AAI@Z
?ToshIsCacheBuilt@@YAHJPAG@Z
?ToshPair@@YAJJQBEP6GHJHPAX@Z11@Z
?ToshReceiveData@@YAJJGPBEKAAG@Z
?ToshRefreshSDDB@@YAJJQBE@Z
?ToshRemovePairing@@YAXJQBE@Z
?ToshSendData@@YAJJGPBEK@Z
?ToshTerminateAPI@@YAXXZ

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b127f73ff32f12eadd1d4fdd6fe4e68

Headers

File Characteristics

PDB Paths

Imports

tosbtapi

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 100KB - Virtual size: 98KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 100KB - Virtual size: 98KB

.reloc
Size: 8KB - Virtual size: 6KB