8ebde08187b552350589b2f905edf25e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8ebde08187b552350589b2f905edf25e_JaffaCakes118
Size

936KB
MD5

8ebde08187b552350589b2f905edf25e
SHA1

0b36d28a30475c18f32afc7e58d4a98370f9a20c
SHA256

fe7db90488c2d2b6996f753f153126b3b04e0cc7edf0e20badfba8d8638689e7
SHA512

ba13291f16e4ef227b23b310eda6c4012ff7798fe440b6e4ef5becbf4de1d962fc01c681ffa668c4adace784a8b2ffe739da98b3a19b6a307a3db0635d43c725
SSDEEP

12288:CprUCZH9pORU5gdzwZ+LeHvw03NKD9rZ3h7bnjImwYAOxjpM:CpICZORb9Uvw0YDRZ3hXjIFY+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ebde08187b552350589b2f905edf25e_JaffaCakes118

Files

8ebde08187b552350589b2f905edf25e_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

7b5ae37a73fdd0911a6cc1b6ce0ea976

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\NPS_VSS_ROOT\NPS\bin\release\program files\NPSDCAMITSOBEX.pdb

Imports

mobexdll

MObex_Init
MObex_SetOBEXPacketSize
MObex_RegisterCustomCB
MObex_SetConnected
MObex_DeInit
MObex_SendObject
MObex_SetConnectionID

kernel32

DuplicateHandle
GetCurrentProcess
GetVolumeInformationW
GetFullPathNameW
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
GlobalFlags
CompareStringW
WritePrivateProfileStringW
GetVersionExA
LoadLibraryA
GlobalFindAtomW
GetFileAttributesW
GetFileTime
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
TerminateProcess
SetEndOfFile
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetCurrentDirectoryA
GetDriveTypeA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
UnlockFile
LockFile
FlushFileBuffers
WriteFile
ReadFile
FindFirstFileW
FileTimeToLocalFileTime
FindNextFileW
FindClose
GetModuleHandleA
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryW
CompareStringA
InterlockedExchange
lstrcmpW
FileTimeToSystemTime
GetCurrentProcessId
lstrcmpA
GetProcAddress
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
SetLastError
OpenFileMappingW
Sleep
CreateDirectoryW
RemoveDirectoryW
DeleteFileW
CreateEventW
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
GetFileSize
SetFilePointer
CreateFileW
IsBadReadPtr
UnmapViewOfFile
CloseHandle
GetProcessHeap
HeapFree
OutputDebugStringA
MapViewOfFile
GetThreadLocale
SetThreadLocale
SystemTimeToTzSpecificLocalTime
lstrlenA
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
GetLastError
FindResourceExW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
OutputDebugStringW
FindResourceW
LoadResource
LockResource
SizeofResource
UnhandledExceptionFilter

user32

LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
RegisterWindowMessageW
GetWindowPlacement
SetWindowPos
ShowWindow
SetWindowLongW
IsWindow
GetDlgItem
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
SetWindowTextW
LoadCursorW
GetSysColorBrush
CharUpperW
GetSystemMetrics
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DestroyMenu
IsIconic
SetCursor
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
PostMessageW
PostQuitMessage
GetWindowTextW
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
CharNextW
UnregisterClassW
UnregisterClassA

gdi32

ScaleWindowExtEx
SetWindowExtEx
GetStockObject
DeleteDC
SetBkColor
RestoreDC
GetDeviceCaps
CreateBitmap
SaveDC
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueW
RegEnumKeyW
RegQueryValueExW
RegOpenKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW
PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

ole32

StringFromGUID2
CoCreateInstance
OleRun
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid

oleaut32

VarUdateFromDate
RegisterTypeLi
UnRegisterTypeLi
SysAllocStringLen
SafeArrayGetVartype
VariantInit
VariantClear
VariantCopy
SafeArrayCopy
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
GetErrorInfo
SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
SetErrorInfo
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 584KB - Virtual size: 581KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.calinfo
Size: 4KB - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7b5ae37a73fdd0911a6cc1b6ce0ea976

Headers

File Characteristics

PDB Paths

Imports

mobexdll

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

Exports

Exports

Sections

.text Size: 584KB - Virtual size: 581KB

.rdata Size: 128KB - Virtual size: 127KB

.data Size: 20KB - Virtual size: 102KB

.calinfo Size: 4KB - Virtual size: 64B

.rsrc Size: 20KB - Virtual size: 16KB

.reloc Size: 60KB - Virtual size: 57KB

.text Size: 116KB - Virtual size: 116KB

.text
Size: 584KB - Virtual size: 581KB

.rdata
Size: 128KB - Virtual size: 127KB

.data
Size: 20KB - Virtual size: 102KB

.calinfo
Size: 4KB - Virtual size: 64B

.rsrc
Size: 20KB - Virtual size: 16KB

.reloc
Size: 60KB - Virtual size: 57KB

.text
Size: 116KB - Virtual size: 116KB