b5b7c197d6cebb16923a2fb351c9d15d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b5b7c197d6cebb16923a2fb351c9d15d_JaffaCakes118
Size

1.5MB
MD5

b5b7c197d6cebb16923a2fb351c9d15d
SHA1

5c630fa5677c29ccfd6c6f3f3d64d6a1b4c4e1f6
SHA256

45d26dd7cbc92a85db9e1a8dd18cc200effee015a8f3d428177a406a139c6bb2
SHA512

a256f35a44456155df4c2c69e68dbc26d91dc06e6bda05a42a592be11697e74e60986d3edd7e1cfc99030b769dc388f94e47182e0e75256166107d648be1e345
SSDEEP

12288:4AxFfjNRCaXhhb3UccXKSHiItMrJ+rOo90aO2:ySSXMrJm+aO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5b7c197d6cebb16923a2fb351c9d15d_JaffaCakes118

Files

b5b7c197d6cebb16923a2fb351c9d15d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

fca000da9087813a8badb56264865ee4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

bc32fn

CallDllFunction2
CountDBStruct4
SetCondition
DelDBStruct5
FindDBStruct5
WriteDBStruct6
BCRound
ZENDFIL
GetDBStruct5
CallBCFunction
ZDB_VALRECORD
GetDB5
CountDB3
ZBCERR
CheckDll
EUROTruncDecimal
ZDECEURO
ZEXEURO
SkipLeftBlk
TruncDecimal
FormatDouble
UpdateDBStruct6
SetUpdateMode
WriteDB5
WS
PHB
ZIDLOGPGM
UpdateDB5
SearchString
GetPartOfString
StrToUpper
ZOPERATORE
WSP
InvertDate
ZNOKEY
SetString
SkipLRBlk
FormatImp
InvertPeriod
GetDBKStruct4
ZVER_CONFIG
CopyDBStruct4
InListString2
TABClosePrinting
TABCloseSettings
TABJumpRowsExt
TABWriteLineExt
TABCheckIntrExt
GetTimeExt
PRINTINFO
TABSet
szTmpBuf
DefineOutputDev
ZPROFIS_INSTAL
GetLeftChar
FRMClosePrintingGraph
SetOutParmsPrinter6
SetPrintPageParms3
ResetFormVar3
ZPRNOLASTPAG
ZPRLASTPAG
ZPRNOFIRSTPAG
ZPRFIRSTPAG
ZPRFLEXIST
CheckFormSez2
fndate
fnyear
CheckProto2
GR
PHD
ComposeFileName
FindDB5
fd1
fd5
AllocLocalData
CheckProto
pszSUBProto
RADDR
RPED
RFLV
RPEE
TABOffset
pvTerminateProgram
VARLIST
pFrmtBuffer
FreeLocalData
DBDatabase
DBClose
DBXAccess
BcxExit
PROGC
ZPREXTEND
bPrintFileName
BcDll
bGetActualArgsExv
ZEXVARG
PropertiesEx
ZTRADVER
ZMINVER
ZMINVERUX
pszCurrentModule
ANNOEXT
FormatNumber
StrAdd
SkipRightBlk
DelDB4

bc32ui

WgsSetDefinedKeys
WgsSetEnabledKeys
WgsRestoreInputData
DefineButtonIvt
DefineTree6
DefineVarsEx2
FindItemTree2
InsertVarsEx2
ExpandItemTree
ZTNODO
InsertItemTree3
DefineMultiPage6
ZVIDCOMP
DeleteItemTree
SetFuncKeyHide
GetStrTestDynValue
GetDblTestDynValue
DefinePos4
DefineDynamicStruct5
DefineStyle4
SetWindowConditions3
DefineEdit11
LoadControlStruct
GetStyle
DefineLabel3
DefineFormat
DefineButton6
DefineGroupBox3
ZINIDEC
DefLine
ResetVid6
SetEditConditions3
ZVIDNAME
SetFuncKeyEnable
SYSDATEXT
ZVIDMPAGCLICK
ResetVid7
RunWindow6
DefineGrid27
InsertColGrid9
DefineTVString
DefineCellGrid15
InsertRowGrid9
ZGRIGA
SyncronizeWindow5
ExitWindow
SetButtonCoupon2
SetButtonHide2
SetButtonEnable2
GettingRowGrid
ZGRIGHE_TOT
DefineGrid25
ZHELPCONTEXT
DeleteRowGrid2
FreeBlob
SetGroupBoxHide
SetGridList
SetLabelHide
SetCellConditions3
ZGCOL
DefineComboOptions
DefineTVDouble
SetLabelEnable
ZapDynamicStruct
KillDynamicStruct
CANVID
DecodForm
RunWindow4
DefineGrid24
InsertRowGrid8
DefinePrintJob3
AddDynamicStruct
ZDSELEM
FindDynamicStruct
SetDynamicStruct
GetDynamicStruct2
InitFormPrint5
InitDizForm3
SetVarDizValue3
PrintForm7
WgsSetUncheckedKeys
WgsMessageBoxEx
ABCPRB
TraceDebug2
EntrySub2
pszID
DefineWindow10
DefineComposite3
DefFuncKey3
RRI
ZDECOD
RCI
ZVIDCOMPVIS
ExitSub
DeleteWindow
ABC
DBCreateVars2
DBDefineStructs
EntryInitProgramData
RCSRCH
SearchSTR
ExitInitProgramData
EntryTerminateProgram
DBRemoveVars
RCCHAN
WgsInitData
RI
RO
RIF
KYM
RRA
RTAB
cRowsRI
cColsRI
wKeyFlags
pszDecodMessage
ExitTerminateProgram
DefineResource
RunWindow5

kernel32

GetVersion
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
DisableThreadLibraryCalls
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
RtlUnwind
GetCommandLineA

Exports

Exports

DFLMGES
DMSDATES
DM_S_DEC_GRIGLIA
DM_S_GCC
DM_S_GCC_LETT_ANNI_PREC
DM_S_GCK
DM_S_GCN
DM_S_GCN_ACCO
DM_S_GCS
DM_S_GESTIONE
DM_S_GES_BAR_MX
DM_S_GES_BAR_NX
DM_S_GES_CHECK_CF
DM_S_GES_DET_RILEVA
DM_S_GES_ELENCO_QUADRI
DM_S_GES_GRIGLIA
DM_S_GES_GRIGLIA_TOT
DM_S_GES_NX_CTR
DM_S_GES_PERDITE
DM_S_GES_PERD_DERIVA_ISTIRAP
DM_S_GES_PERD_NFMF
DM_S_GES_RICHIAMO_QUADRI
DM_S_GES_RIP_CS_ABRUZZO
DM_S_GES_RIP_NFMF
DM_S_GES_RIP_NF_CS
DM_S_GES_RIP_NXMX_CC
DM_S_GES_RIP_NXMX_CC_CK_GRI
DM_S_GES_RIP_NXMX_CC_INS_RIGO
DM_S_GES_RIP_NXMX_CS
DM_S_GES_STRU_DEF
DM_S_GES_STRU_GES
DM_S_GES_TIPO_CONS
DM_S_GES_TIPO_CONS_QUADRI
DM_S_GES_TIPO_CONS_QUADRI_CK
DM_S_GMF
DM_S_GMX
DM_S_GNF
DM_S_GNI
DM_S_GNX
DM_S_GPP
DM_S_LSINT
DM_S_OPZ_LET_IMP_SAL
DM_S_RCI
DM_S_SQU
DM_S_STM_LET_IMP_SAL
vb_DMSDATES
vb_DM_S_DEC_GRIGLIA
vb_DM_S_GCC
vb_DM_S_GCC_LETT_ANNI_PREC
vb_DM_S_GCK
vb_DM_S_GCN
vb_DM_S_GCN_ACCO
vb_DM_S_GCS
vb_DM_S_GESTIONE
vb_DM_S_GES_BAR_MX
vb_DM_S_GES_BAR_NX
vb_DM_S_GES_CHECK_CF
vb_DM_S_GES_DET_RILEVA
vb_DM_S_GES_ELENCO_QUADRI
vb_DM_S_GES_GRIGLIA
vb_DM_S_GES_GRIGLIA_TOT
vb_DM_S_GES_NX_CTR
vb_DM_S_GES_PERDITE
vb_DM_S_GES_PERD_DERIVA_ISTIRAP
vb_DM_S_GES_PERD_NFMF
vb_DM_S_GES_RICHIAMO_QUADRI
vb_DM_S_GES_RIP_CS_ABRUZZO
vb_DM_S_GES_RIP_NFMF
vb_DM_S_GES_RIP_NF_CS
vb_DM_S_GES_RIP_NXMX_CC
vb_DM_S_GES_RIP_NXMX_CC_CK_GRI
vb_DM_S_GES_RIP_NXMX_CC_INS_RIGO
vb_DM_S_GES_RIP_NXMX_CS
vb_DM_S_GES_STRU_DEF
vb_DM_S_GES_STRU_GES
vb_DM_S_GES_TIPO_CONS
vb_DM_S_GES_TIPO_CONS_QUADRI
vb_DM_S_GES_TIPO_CONS_QUADRI_CK
vb_DM_S_GMF
vb_DM_S_GMX
vb_DM_S_GNF
vb_DM_S_GNI
vb_DM_S_GNX
vb_DM_S_GPP
vb_DM_S_LSINT
vb_DM_S_OPZ_LET_IMP_SAL
vb_DM_S_RCI
vb_DM_S_SQU
vb_DM_S_STM_LET_IMP_SAL

Sections

.text
Size: 632KB - Virtual size: 631KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 460KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fca000da9087813a8badb56264865ee4

Headers

File Characteristics

Imports

bc32fn

bc32ui

kernel32

Exports

Exports

Sections

.text Size: 632KB - Virtual size: 631KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 264KB - Virtual size: 264KB

.rsrc Size: 460KB - Virtual size: 457KB

.reloc Size: 124KB - Virtual size: 120KB

.text
Size: 632KB - Virtual size: 631KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 264KB - Virtual size: 264KB

.rsrc
Size: 460KB - Virtual size: 457KB

.reloc
Size: 124KB - Virtual size: 120KB