a102965146b0c34c46cc7a1c6c12affe_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a102965146b0c34c46cc7a1c6c12affe_JaffaCakes118
Size

100KB
MD5

a102965146b0c34c46cc7a1c6c12affe
SHA1

83ed238d59fb29ccb6cfd2980e224a0b9ce81641
SHA256

2050f4e95cd4621171066802bead13b107d39d4063c5dc327ee8e23b777dbaf2
SHA512

4d0cb9cbcddeda7ff4c5337b3e0861b877ba8d26157b197f9792bb4b28a8a6f472e9765775037fc19d765ead42e2c509d9ecc5e7d318fd636d11eb33ccc20524
SSDEEP

3072:0bM6ZJHIzIT5/6fyfmXAlMCPjoBmvkNiLd2fJY3yhRUbu1oJaXV7KQCnqkRuYtgd:0Rz/MCPjoBmvkNiLd2fJY3yhRUbu1oJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a102965146b0c34c46cc7a1c6c12affe_JaffaCakes118

Files

a102965146b0c34c46cc7a1c6c12affe_JaffaCakes118
.dll windows:4 windows x86 arch:x86

7df4779449add43c2c17594a2cccea0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

commveh32

?setstatus@Buf@@QAEXW4T_CM_SectionError@@DPAD@Z
?get@Buf@@QAEIPADII@Z
?clear@Buf@@QAEID@Z
?set@Buf@@QAEIJI@Z
?getServiceUnitALLParamsValue@Buf@@QAEIW4T_PARAM_TYPE@@G@Z
?getServiceUnitParamValue@Buf@@QAEIW4T_PARAM_TYPE@@PBD_N@Z
?getServiceUnitParamStates@Buf@@QAEIPBD0W4T_PARAM_TYPE@@PADAAF_N4@Z
?getServiceUnitALLParamsInfo@Buf@@QAEIPBD0AAKW4T_PARAM_TYPE@@PAUT_PARAM_INFO@@_N@Z
?getServiceUnitNbParams@Buf@@QAEIPBD0W4T_PARAM_TYPE@@AAJ_N@Z
?GetECUFaultFrame@Buf@@QAEIXZ
?GetECUFaultType@Buf@@QAEIXZ
?getsizebuf@Buf@@QAEJXZ
?set@Buf@@QAEIPADII@Z
?set@Buf@@QAEIPADH@Z
?DejaDedans@Buf@@QAEHPADIIIE@Z
??1Buf@@QAE@XZ
??0Buf@@QAE@XZ
?OpenDefaultMessagerie@Buf@@QAEIXZ
?destroyServiceUnit@Buf@@QAEIXZ
?createServiceUnit@Buf@@QAEIPBDPAD_N@Z
?destroyService@Buf@@QAEIXZ
?createService@Buf@@QAEIPBD@Z
?ExecuteFnc@Buf@@QAEIPBDAAVStock@@@Z
?getstatuscom@Buf@@QAEIXZ
?getstatus@Buf@@QAEIXZ
?identifyEcuVersion@Buf@@QAEIJ@Z
?getRequestsAndParametersIdent@Buf@@QAEIXZ
?GetDescList@Buf@@QAEIPBD@Z
?get@Buf@@QAEIPAV1@IIH@Z
?get@Buf@@QAEIPAEI@Z
?concat@Buf@@QAEIPAV1@@Z
?move@Buf@@QAEIPAV1@II@Z
?set@Buf@@QAEIEI@Z
?set@Buf@@QAEIFI@Z
?SetContexteTEP@Stock@@QAEIPAD0@Z
?getMessagerieServiceUnitsName@Buf@@QAEIAAJPBD_N@Z
?AFputstatus@Buf@@QAEXDPAD@Z
?move@Buf@@QAEIPAV1@@Z
?setServiceUnitParamValue@Buf@@QAEIW4T_PARAM_TYPE@@PBDF1@Z
?getServiceUnitECUAnswer@Buf@@QAEIXZ
?com@Buf@@QAEIQADPAV1@@Z
?Temporisation@@YAXK@Z
?mGetTableLID@C_CTX_FunContext@@QBEPAVTableLID@@XZ
?SetTableLIDPleine@TableLID@@QAEXH@Z
?GetTableLIDPleine@TableLID@@QBEHXZ
?AffichTableLID@TableLID@@QBEXXZ
?GetListFamLID@TableLID@@QBEHPAE@Z
?GetECUName@TableLID@@QBEXPAD@Z
?RemplirTableLID@TableLID@@QAE?AW4STATUS_LID@@XZ
?GetECUFrame@TableLID@@QAEXPAVBuf@@@Z

dll_pgp

?get_lLength@ParValMS@@QAE?BJXZ
?get_iDataTypeId@ParValMS@@QAE?BHXZ
?StrBruteToValConv@@YAJPAD0H@Z
?getPosTabParam@Cmd_Mess@@QAEJV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?get_TabParam@Cmd_Mess@@QAEPAPAVPar_Mess@@XZ
?ExecuteTrame@@YA_NPADW4T_SERVICEUNIT_TYPE@@PAVCmd_Mess@@HAAVStock@@W4eTypeCalculCRC@@PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1Cmd_Mess@@UAE@XZ
??0Cmd_Mess@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4T_PARAM_TYPE@@W4TypeFonction@@PAVStock@@@Z
?AddProcessingKey@XmlFile@@QAE_NPBD@Z
?AddFrameKey@XmlFile@@QAE_NPBD@Z
?AddProperty@XmlFile@@QAE_NPBD00000@Z
?AddDtcInter@XmlFile@@QAE_NPBD@Z
?GetChaineBuf@@YAHAAVBuf@@HAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AddDtc@XmlFile@@QAE_NPBD@Z
?Create@XmlFile@@QAEPADXZ
??1XmlFile@@UAE@XZ
??0XmlFile@@QAE@XZ
?ExecuteComInitFin@@YA_NPADW4T_SERVICEUNIT_TYPE@@AAVStock@@@Z
?output@GestDebug@@QBAXHPBDZZ
?Instance@GestDebug@@SAPAV1@XZ
?getRawMnemo@GestComBuf@@QAEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
?execute@GestComBuf@@QAE_NPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1GestComBuf@@UAE@XZ
??0GestComBuf@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?BufToString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVBuf@@@Z
?SetMnemo@GestComBuf@@SA_NAAVBuf@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1H@Z
?RecupValParam@@YA_NAAVStock@@W4T_PARAM_TYPE@@PAVCmd_Mess@@@Z
?getValues@ConfPgp@@QBEPBQBEPBE@Z
?Instance@ConfPgp@@SAPAV1@XZ
?SetPrivateInfo@GestAppContext@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetParamValue@GestAppContext@@QAEFABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?FormatExitBuffer@GestAppContext@@QAEAAVBuf@@AAVStock@@@Z
??1GestAppContext@@UAE@XZ
??0GestAppContext@@QAE@PAVStock@@@Z
?Split@GestComBuf@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@D@Z
?GetMnemoRT@GestComBuf@@SAHAAVBuf@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z
?execute@GestComBuf@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4eTypeCalculCRC@@PAV23@@Z
?getTypedService@CCCP@@SA?AV?$vector@US_FrameIdentifier@@V?$allocator@US_FrameIdentifier@@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?getECUFrame@CCCP@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1CCCP@@UAE@XZ
??0CCCP@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAVStock@@W4T_PARAM_TYPE@@0@Z
?RunTelecoding@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@00PAVStock@@@Z
?Free@PopUpProgress@@SAXXZ
?Instance@PopUpProgress@@SAPAV1@XZ
?changeServicesAndServicesUnitsNames@TlcdDLPR@@QAEXAAVBuf@@@Z
?TelecodageRun@TlcdDLPR@@QAEXAAVStock@@W4eTypeAlgoConfPoss@@@Z
??1TlcdDLPR@@UAE@XZ
??0TlcdDLPR@@QAE@AAVBuf@@PAVStock@@@Z
?GetParamValue@GestAppContext@@QAEFABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z
?manage@C_DataWriteManager@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z
??1C_DataWriteManager@@UAE@XZ
??0C_DataWriteManager@@QAE@PAVStock@@@Z
?AddFreezeFrame@XmlFile@@QAE_NPBD00000@Z
?AsciiToUChar@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAE@Z
?convValeurBrute@FormLin@@UAE_NNPAE@Z
?convValeurCalculee@FormLin@@UAENPAE@Z
??1FormLin@@UAE@XZ
??0FormLin@@QAE@NNPBDI@Z
?ExecuteCom@@YA_NPADPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?toString@GestComBuf@@SAXPBEHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?toBinary@GestComBuf@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAPAEAAH@Z
?SetMnemonicValue@@YAHPBDPADAAVStock@@@Z
?GetMnemonicValue@@YAHPBDPADAAVStock@@@Z

msvcp80

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?setprecision@std@@YA?AU?$_Smanip@H@1@H@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z

msvcr80

free
malloc
strtol
strncpy
atol
_ltoa
?terminate@@YAXXZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_wassert
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_invalid_parameter_noinfo
strncat
sprintf
atoi
strncmp
??_V@YAXPAX@Z
??3@YAXPAX@Z
sscanf
??2@YAPAXI@Z
__CxxFrameHandler3
memset
memcpy
_CxxThrowException

kernel32

InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep

Exports

Exports

APPGEN61
APPGEN_RAW152
DATAWRITE143
EFFDEF22
FINDIAG52
FINDMEMZONE77
GET_SEED132
INITDIAG51
LECTDEF32
LECTUREZI53
SEND_KEY133
SPEC_TLCDDLPR_MULTILID1281
SPEC_TRAME80_MESS3001
SPEC_TRAME83_MESS3002
TELECODAGE_GEN127
TLCD_DLPR128
TRAMEGEN56
VARCONTEXTE145

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7df4779449add43c2c17594a2cccea0f

Headers

File Characteristics

Imports

commveh32

dll_pgp

msvcp80

msvcr80

kernel32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 43KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB