8d95c54e9ac8de28e38f29a78c8789cd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8d95c54e9ac8de28e38f29a78c8789cd_JaffaCakes118
Size

128KB
MD5

8d95c54e9ac8de28e38f29a78c8789cd
SHA1

83d0910e77ef851e2eb277f8f0b36a5e41fb0cbb
SHA256

4064b78a32e4e0308c5c50491df1f58791051e84310715525b1e59ac3eda3349
SHA512

ca19af9c3f876fea7d92655285cdd8177875769dcc7ea9ac7e8c42a38c2b1a3e31cd1665d5e8a1c784347e18e2a3e664f6a03176525e52255f669d44e94236b1
SSDEEP

1536:hZfI4jMLyt+s+jDmw+LFl73FPoGJN0a33NIa0PjVBo0XliVQZMq3sZVQKBvzU/:rfIAMWws+jDmnLFlbJoG2PfVXl3SpF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d95c54e9ac8de28e38f29a78c8789cd_JaffaCakes118

Files

8d95c54e9ac8de28e38f29a78c8789cd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

9ef8b0521d52e71e2b63a513da26117a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Utps_v100r001b302d09sp03c88(新电)\Utps_v100r001b302d09sp03c88\lb_UTPS_V100R001B302D09SP03C88_CODE\Wt_utps_code\Utps_v100r001\utps\solution\win32\NDISPlugin\Release\NDISPlugin.pdb

Imports

iphlpapi

GetIpAddrTable
GetAdaptersInfo
GetIfTable

ndisapi

NdisSelectDevice
NdisGetDeviceName
NdisGetDeviceCount
NdisGetConnState
NdisOnPowerbroadcast
NdisCancelConnect
NdisConnect
NdisConnectionNotification
NdisDestroyInstance
NdisDisconnect

mfc71u

ord265
ord1473
ord1472
ord577
ord280
ord578
ord2313
ord304
ord283
ord2311
ord293
ord774
ord764
ord762
ord1079
ord1168
ord371
ord1093
ord2263
ord4079
ord266

msvcr71

_itoa
__CxxFrameHandler
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_purecall
__RTDynamicCast
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
free
_except_handler3
memset
time

kernel32

DeleteCriticalSection
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
InitializeCriticalSection
CreateThread
TerminateThread
ReleaseMutex
CreateMutexA
MultiByteToWideChar
WideCharToMultiByte
CreateEventW
WaitForSingleObject
ResetEvent
CloseHandle
Sleep

msvcp71

?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

Exports

Exports

CreatePlugin

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9ef8b0521d52e71e2b63a513da26117a

Headers

File Characteristics

PDB Paths

Imports

iphlpapi

ndisapi

mfc71u

msvcr71

kernel32

msvcp71

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 816B

.reloc Size: 8KB - Virtual size: 6KB

.text Size: 64KB - Virtual size: 64KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 816B

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 64KB - Virtual size: 64KB