b067158395b549ccd6b650acfd308050_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b067158395b549ccd6b650acfd308050_JaffaCakes118
Size

864KB
MD5

b067158395b549ccd6b650acfd308050
SHA1

4ae8bd06416f80c59e2066d6e95ed9004d837638
SHA256

40f0cce90e9a98b05b24d030b24e22e50e1d5fd450ff937d76e2ba37b3cd75a5
SHA512

f74d1051883cf03ee0b0c1ba46b5070f44e9e7339e77a58638224b20eb1906a660418ba515755ca1474e41a4871aad896f6fa956d8150f873c82d35a3ace7517
SSDEEP

12288:PLPb7h1CEayyH7TjPUWHt0RSINDkSonaMV0zeT1D2G9CZRNngkOWE4CkxCXdwqbE:zXh1CbpHt0RTDJonaxaxf9SRNnz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b067158395b549ccd6b650acfd308050_JaffaCakes118

Files

b067158395b549ccd6b650acfd308050_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d2b9e1eeda6a2416a6bfb62c26ddea44

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

easyhook32

_LhWaitForPendingRemovals@0
_LhSetExclusiveACL@12
_LhInstallHook@16
_LhUninstallHook@4

awesomium

?update@WebCore@Awesomium@@QAEXXZ
?render@WebView@Awesomium@@QAEXPAEHHPAURect@2@@Z
?injectMouseWheel@WebView@Awesomium@@QAEXH@Z
?injectMouseMove@WebView@Awesomium@@QAEXHH@Z
?injectMouseDown@WebView@Awesomium@@QAEXW4MouseButton@2@@Z
?injectMouseUp@WebView@Awesomium@@QAEXW4MouseButton@2@@Z
?isDirty@WebView@Awesomium@@QAE_NXZ
??0WebCore@Awesomium@@QAE@W4LogLevel@1@_NW4PixelFormat@1@@Z
?createWebView@WebCore@Awesomium@@QAEPAVWebView@2@HH_N0H@Z
?setListener@WebView@Awesomium@@QAEXPAVWebViewListener@2@@Z
?loadURL@WebView@Awesomium@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@00@Z
?getListener@WebView@Awesomium@@QAEPAVWebViewListener@2@XZ
?destroy@WebView@Awesomium@@QAEXXZ
?executeJavascript@WebView@Awesomium@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z

portaudio_x86

ord27
ord5
ord3
ord59
ord19
ord14
ord17
ord15
ord21
ord22
ord8
ord13
ord4
ord56
ord57
ord58
ord60
ord12

taglib

?data@ByteVector@TagLib@@QBEPBDXZ
?size@ByteVector@TagLib@@QBEIXZ
?startsWith@ByteVector@TagLib@@QBE_NABV12@@Z
??0ByteVector@TagLib@@QAE@PBD@Z
??1ByteVector@TagLib@@UAE@XZ
??1FileRef@TagLib@@UAE@XZ
??1String@TagLib@@UAE@XZ
?toCString@String@TagLib@@QBEPBD_N@Z
?audioProperties@FileRef@TagLib@@QBEPAVAudioProperties@2@XZ
?tag@FileRef@TagLib@@QBEPAVTag@2@XZ
?isNull@FileRef@TagLib@@QBE_NXZ
??0FileRef@TagLib@@QAE@PBD_NW4ReadStyle@AudioProperties@1@@Z
?setDebugCB@TagLib@@YAXP6AXPBD@Z@Z

core_rl_magick_

AcquireExceptionInfo
CloneImageInfo
ResizeImage
ImagesToBlob
DestroyImageList
DestroyImage
DestroyImageInfo
DestroyExceptionInfo
InitializeMagick
DestroyMagick
BlobToImage

libcurl

curl_share_setopt
curl_easy_strerror
curl_share_cleanup
curl_slist_append
curl_easy_setopt
curl_easy_perform
curl_easy_cleanup
curl_easy_init
curl_multi_add_handle
curl_multi_remove_handle
curl_easy_getinfo
curl_multi_info_read
curl_multi_fdset
curl_multi_perform
curl_multi_cleanup
curl_multi_init
curl_global_init
curl_global_cleanup
curl_share_init
curl_slist_free_all

libapr

_apr_hash_get@12
_apr_hash_make@4
_apr_hash_set@16
_apr_thread_cond_destroy@4
_apr_thread_cond_create@8
_apr_time_now@0
_apr_thread_detach@4
_apr_thread_cond_wait@8
_apr_thread_cond_timedwait@16
_apr_array_make@12
_apr_thread_exit@8
_apr_thread_cond_signal@4
_apr_thread_create@20
_apr_thread_join@8
_apr_thread_cond_broadcast@4
_apr_pool_cleanup_run@12
_apr_env_set@12
apr_psprintf
_apr_time_exp_lt@12
apr_pstrcat
_apr_proc_wait@16
_apr_proc_create@24
_apr_procattr_dir_set@8
_apr_procattr_io_set@16
_apr_procattr_create@8
_apr_pool_destroy@4
_apr_strerror@12
_apr_sleep@8
_apr_file_close@4
_apr_file_open@20
_apr_dir_close@4
_apr_dir_open@12
_apr_dir_read@12
_apr_stat@16
_apr_rfc822_date@12
_apr_thread_rwlock_create@8
_apr_thread_rwlock_unlock@4
_apr_thread_rwlock_wrlock@4
_apr_thread_rwlock_rdlock@4
_apr_file_rename@12
_apr_file_remove@8
_apr_file_mtime_set@16
_apr_threadattr_detach_set@8
_apr_threadattr_create@8
_apr_file_read@12
_apr_file_write@12
_apr_file_seek@12
_apr_file_info_get@12
_apr_array_push@4
_apr_conv_ucs2_to_utf8@16
_apr_pool_cleanup_kill@12
apr_os_level
_apr_conv_utf8_to_ucs2@16
_apr_palloc@8
apr_pool_cleanup_null
_apr_pool_cleanup_register@16
_apr_thread_mutex_destroy@4
_apr_thread_mutex_create@12
_apr_thread_mutex_lock@4
_apr_pool_create_ex@16
_apr_hash_this@16
_apr_hash_next@4
_apr_file_read_full@16
_apr_time_exp_gmt_get@8
_apr_time_exp_gmt@12
_apr_strftime@20
_apr_file_unlock@4
_apr_thread_mutex_trylock@4
apr_snprintf
_apr_pstrmemdup@12
_apr_hash_copy@8
_apr_app_initialize@12
_apr_pool_allocator_get@4
_apr_allocator_max_free_set@8
apr_terminate
_apr_temp_dir_get@8
_apr_dir_make_recursive@12
_apr_generate_random_bytes@8
_apr_is_empty_array@4
_apr_threadkey_private_delete@4
_apr_threadkey_private_get@8
_apr_threadkey_private_set@8
_apr_threadkey_private_create@12
_apr_file_ungetc@8
_apr_file_getc@8
_apr_pool_abort_get@4
_apr_array_pop@4
_apr_file_write_full@16
_apr_thread_mutex_unlock@4
_apr_thread_data_set@16
_apr_pstrndup@12
_apr_pstrdup@8
_apr_filepath_get@12
_apr_file_lock@8
_apr_hash_first@8

libaprutil

_apr_xlate_close@4
_apr_xlate_conv_buffer@20
_apr_xlate_open@16
_apr_date_parse_rfc@4
_apr_base64_decode@8
_apr_base64_decode_len@4
_apr_base64_encode@12
_apr_base64_encode_len@4
_apr_queue_interrupt_all@4
_apr_queue_term@4
_apr_queue_trypush@8
_apr_date_parse_http@4
_apr_queue_pop@8
_apr_queue_size@4
_apr_queue_trypop@8
_apr_queue_create@12
_apr_xml_parser_geterror@12
_apr_xml_parse_file@20
_apr_xml_parser_done@8
_apr_xml_parser_feed@12
_apr_xml_parser_create@4
_apr_uuid_format@8
_apr_uuid_get@4
_apr_md5@12

log4cxx

?INFO@Level@log4cxx@@2V?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@B
?forcedLog@Logger@log4cxx@@QAEXABV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDH@Z
?WARN@Level@log4cxx@@2V?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@B
?getCurrentThreadId@Thread@helpers@log4cxx@@SAKXZ
?ERROR@Level@log4cxx@@2V?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@B
?FATAL@Level@log4cxx@@2V?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@B
?isFatalEnabled@Logger@log4cxx@@QBE_NXZ
?isErrorEnabled@Logger@log4cxx@@QBE_NXZ
?isWarnEnabled@Logger@log4cxx@@QBE_NXZ
?isInfoEnabled@Logger@log4cxx@@QBE_NXZ
?getLogger@Logger@log4cxx@@SA?AV?$ObjectPtrT@VLogger@log4cxx@@@helpers@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?configure@PropertyConfigurator@log4cxx@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?isDebugEnabled@Logger@log4cxx@@QBE_NXZ
?DEBUG@Level@log4cxx@@2V?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@B

pthreadvc2

pthread_cond_signal
pthread_mutex_lock
pthread_mutex_destroy
pthread_mutex_init
sched_setscheduler
pthread_setschedparam
sched_get_priority_max
sched_get_priority_min
pthread_getschedparam
pthread_self
pthread_cond_timedwait
pthread_cond_broadcast
pthread_detach
pthread_cond_init
pthread_cond_destroy
pthread_mutex_unlock
pthread_cond_wait
pthread_create

avcodec-51

ord199
ord216
ord227
ord214
ord236
ord162
ord196
ord151
ord221
ord728
ord153
ord238
ord727
ord152
ord210
ord212
ord721
ord726

avformat-51

ord55
ord17
ord238
ord40
ord272
ord152
ord59
ord60
ord263
ord260
ord38
ord22
ord26
ord41
ord27
ord18
ord50
ord136
ord52

avutil-49

ord39
ord29
ord30
ord53

sqlite3

sqlite3_open
sqlite3_mprintf
sqlite3_changes
sqlite3_errmsg
sqlite3_prepare
sqlite3_column_count
sqlite3_step
sqlite3_column_name
sqlite3_column_bytes
sqlite3_column_type
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_free

ws2_32

recv
send
sendto
setsockopt
htonl
bind
listen
__WSAFDIsSet
accept
recvfrom
ntohs
socket
connect
shutdown
closesocket
htons
gethostbyname
gethostname
ntohl
WSAGetLastError
select
inet_addr
inet_ntoa
WSACleanup
WSAStartup
getsockname

quartz

AMGetErrorTextA

wmvcore

WMCreateIndexer
WMCreateProfileManager

winmm

mixerGetControlDetailsA
mixerGetDevCapsA
mixerClose
mixerGetLineControlsA
mixerGetID
mixerOpen
waveOutGetPosition
waveOutClose
waveOutOpen
waveOutSetVolume
waveOutWrite
mixerGetLineInfoA
mixerSetControlDetails

zlib1

ord13
ord11

kernel32

LocalFree
Sleep
GetModuleFileNameA
SetErrorMode
WaitForMultipleObjects
ReleaseSemaphore
GetSystemInfo
VirtualFree
GetCurrentProcess
GetCurrentThreadId
CreateSemaphoreA
VirtualAlloc
CreateThread
FreeLibrary
GetVersionExA
GetSystemTimeAsFileTime
GetComputerNameA
lstrlenA
GlobalMemoryStatus
SetConsoleCtrlHandler
GetLastError
CreateProcessW
DeleteFileW
GetTickCount
CreateEventW
WaitForSingleObject
CloseHandle
GetCurrentProcessId
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InterlockedExchange
ExpandEnvironmentStringsW
FormatMessageA
lstrcmpW
CreateEventA
QueryPerformanceCounter
ResetEvent
ExpandEnvironmentStringsA

advapi32

StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
DeleteService
RegOpenKeyExA
RegCreateKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
DeregisterEventSource
ReportEventA
ControlService
StartServiceA
QueryServiceStatus
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ChangeServiceConfigA
CreateServiceA
RegisterEventSourceA
RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

msvcr80

strtol
strspn
_mktime64
memset
strncpy
memcpy
_stricmp
calloc
_stat64i32
_time64
strrchr
fread
fclose
fopen
srand
_ftime64
_gmtime64
fseek
realloc
atoi
fwrite
_errno
isalnum
ftell
rand
_strtoi64
__getmainargs
_cexit
_exit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
exit
strcspn
strstr
tolower
toupper
isalpha
isspace
strchr
isdigit
sprintf
sscanf
isxdigit
strncmp
memmove
free
malloc
_snprintf
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy_s
_vsnprintf
_CIsqrt
strpbrk
_purecall
wcsncmp
__RTDynamicCast
_snwprintf
_strdup
printf
getchar
__iob_func
_amsg_exit
_ctime64
_strnicmp
fprintf

msvcp80

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?allocate@?$allocator@D@std@@QAEPADIPBX@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

Sections

.text
Size: 564KB - Virtual size: 562KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2b9e1eeda6a2416a6bfb62c26ddea44

Headers

File Characteristics

Imports

easyhook32

awesomium

portaudio_x86

taglib

core_rl_magick_

libcurl

libapr

libaprutil

log4cxx

pthreadvc2

avcodec-51

avformat-51

avutil-49

sqlite3

ws2_32

quartz

wmvcore

winmm

zlib1

kernel32

advapi32

shell32

ole32

msvcr80

msvcp80

Sections

.text Size: 564KB - Virtual size: 562KB

.rdata Size: 172KB - Virtual size: 169KB

.data Size: 120KB - Virtual size: 248KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 564KB - Virtual size: 562KB

.rdata
Size: 172KB - Virtual size: 169KB

.data
Size: 120KB - Virtual size: 248KB

.rsrc
Size: 4KB - Virtual size: 2KB