bb5942ec6219b8d8cdf8faba4f82a123_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bb5942ec6219b8d8cdf8faba4f82a123_JaffaCakes118
Size

141KB
MD5

bb5942ec6219b8d8cdf8faba4f82a123
SHA1

57c3b1f0bd24479b3cacf8a8923db2bf386f58c0
SHA256

83abc5940e5cdd73322635100063e83cfd6a37cc5ba875a9041e81230f89c7a3
SHA512

e2c12f6dc4d95a8320cb743fc9ef6fc379fc41ec990cbcb6639023e033522605caf44c2df4c0b269f7f319455f43365fdb1229d1c61d0e92e46af6b20076c794
SSDEEP

3072:sPCO1s4TVAIMixAd5u/9qPKuxgVT7CO0Yh:sqO17TVXMP2gCuxOPCO0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb5942ec6219b8d8cdf8faba4f82a123_JaffaCakes118

Files

bb5942ec6219b8d8cdf8faba4f82a123_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9371db79d0ed0503f3c4086be733e6fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

icule44

?getGlyphs@LayoutEngine@icu_44@@QBEXQAIAAW4LEErrorCode@@@Z
?getGlyphPositions@LayoutEngine@icu_44@@QBEXQAMAAW4LEErrorCode@@@Z
?layoutEngineFactory@LayoutEngine@icu_44@@SAPAV12@PBVLEFontInstance@2@HHAAW4LEErrorCode@@@Z
?getCharIndices@LayoutEngine@icu_44@@QBEXQAHHAAW4LEErrorCode@@@Z

icuuc44

?setIndex32@UCharCharacterIterator@icu_44@@UAEHH@Z
?current@UCharCharacterIterator@icu_44@@UBE_WXZ
?current32@UCharCharacterIterator@icu_44@@UBEHXZ
?next@UCharCharacterIterator@icu_44@@UAE_WXZ
?next32@UCharCharacterIterator@icu_44@@UAEHXZ
?previous@UCharCharacterIterator@icu_44@@UAE_WXZ
?setIndex@UCharCharacterIterator@icu_44@@UAE_WH@Z
?hasPrevious@UCharCharacterIterator@icu_44@@UAECXZ
?move@UCharCharacterIterator@icu_44@@UAEHHW4EOrigin@CharacterIterator@2@@Z
?move32@UCharCharacterIterator@icu_44@@UAEHHW4EOrigin@CharacterIterator@2@@Z
?getText@UCharCharacterIterator@icu_44@@UAEXAAVUnicodeString@2@@Z
??1UCharCharacterIterator@icu_44@@UAE@XZ
ubidi_getVisualRun_44
ubidi_setLine_44
uprv_realloc_44
?createFromName@Locale@icu_44@@SA?AV12@PBD@Z
?getDynamicClassID@Locale@icu_44@@UBEPAXXZ
?last32@UCharCharacterIterator@icu_44@@UAEHXZ
?last@UCharCharacterIterator@icu_44@@UAE_WXZ
?first32PostInc@UCharCharacterIterator@icu_44@@UAEHXZ
?first32@UCharCharacterIterator@icu_44@@UAEHXZ
?firstPostInc@UCharCharacterIterator@icu_44@@UAE_WXZ
?first@UCharCharacterIterator@icu_44@@UAE_WXZ
?clone@UCharCharacterIterator@icu_44@@UBEPAVCharacterIterator@2@XZ
?hasNext@UCharCharacterIterator@icu_44@@UAECXZ
?next32PostInc@UCharCharacterIterator@icu_44@@UAEHXZ
?nextPostInc@UCharCharacterIterator@icu_44@@UAE_WXZ
?hashCode@UCharCharacterIterator@icu_44@@UBEHXZ
??8UCharCharacterIterator@icu_44@@UBECABVForwardCharacterIterator@1@@Z
?getDynamicClassID@UCharCharacterIterator@icu_44@@UBEPAXXZ
u_isWhitespace_44
u_iscntrl_44
??0Locale@icu_44@@QAE@PBD000@Z
??0UCharCharacterIterator@icu_44@@QAE@PB_WH@Z
?createLineInstance@BreakIterator@icu_44@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z
??1Locale@icu_44@@UAE@XZ
?getISO3Language@Locale@icu_44@@QBEPBDXZ
?getISO3Country@Locale@icu_44@@QBEPBDXZ
?getDefault@Locale@icu_44@@SAABV12@XZ
ubidi_openSized_44
ubidi_setPara_44
ubidi_countRuns_44
??2UMemory@icu_44@@SAPAXI@Z
ubidi_getLogicalRun_44
uscript_openRun_44
uscript_nextRun_44
uscript_closeRun_44
ubidi_close_44
??1UObject@icu_44@@UAE@XZ
uprv_malloc_44
uprv_free_44
ubidi_getDirection_44
ubidi_getParaLevel_44
??0UObject@icu_44@@QAE@XZ
??_VUMemory@icu_44@@SAXPAX@Z
??3UMemory@icu_44@@SAXPAX@Z
?previous32@UCharCharacterIterator@icu_44@@UAEHXZ

msvcr90

strcmp
__CxxFrameHandler3
strcat
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
??3@YAXPAX@Z
memcpy

kernel32

Sleep
LoadLibraryA
GetProcAddress
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange

Exports

Exports

??0FontRuns@icu_44@@AAE@ABV01@@Z
??0FontRuns@icu_44@@AAE@XZ
??0FontRuns@icu_44@@QAE@H@Z
??0FontRuns@icu_44@@QAE@PAPBVLEFontInstance@1@PBHH@Z
??0Line@ParagraphLayout@icu_44@@AAE@ABV012@@Z
??0Line@ParagraphLayout@icu_44@@AAE@XZ
??0LocaleRuns@icu_44@@AAE@ABV01@@Z
??0LocaleRuns@icu_44@@AAE@XZ
??0LocaleRuns@icu_44@@QAE@H@Z
??0LocaleRuns@icu_44@@QAE@PAPBVLocale@1@PBHH@Z
??0ParagraphLayout@icu_44@@AAE@ABV01@@Z
??0ParagraphLayout@icu_44@@AAE@XZ
??0ParagraphLayout@icu_44@@QAE@QB_WHPBVFontRuns@1@PBVValueRuns@1@2PBVLocaleRuns@1@ECAAW4LEErrorCode@@@Z
??0RunArray@icu_44@@AAE@ABV01@@Z
??0RunArray@icu_44@@AAE@XZ
??0RunArray@icu_44@@QAE@H@Z
??0RunArray@icu_44@@QAE@PBHH@Z
??0ValueRuns@icu_44@@AAE@ABV01@@Z
??0ValueRuns@icu_44@@AAE@XZ
??0ValueRuns@icu_44@@QAE@H@Z
??0ValueRuns@icu_44@@QAE@PBH0H@Z
??0VisualRun@ParagraphLayout@icu_44@@AAE@ABV012@@Z
??0VisualRun@ParagraphLayout@icu_44@@AAE@PBVLEFontInstance@2@W4UBiDiDirection@@HQBIQBMQBH@Z
??0VisualRun@ParagraphLayout@icu_44@@AAE@XZ
??1FontRuns@icu_44@@UAE@XZ
??1Line@ParagraphLayout@icu_44@@UAE@XZ
??1LocaleRuns@icu_44@@UAE@XZ
??1ParagraphLayout@icu_44@@UAE@XZ
??1RunArray@icu_44@@UAE@XZ
??1ValueRuns@icu_44@@UAE@XZ
??1VisualRun@ParagraphLayout@icu_44@@EAE@XZ
??4FontRuns@icu_44@@AAEAAV01@ABV01@@Z
??4Line@ParagraphLayout@icu_44@@AAEAAV012@ABV012@@Z
??4LocaleRuns@icu_44@@AAEAAV01@ABV01@@Z
??4ParagraphLayout@icu_44@@AAEAAV01@ABV01@@Z
??4RunArray@icu_44@@AAEAAV01@ABV01@@Z
??4ValueRuns@icu_44@@AAEAAV01@ABV01@@Z
??4VisualRun@ParagraphLayout@icu_44@@AAEAAV012@ABV012@@Z
??_7FontRuns@icu_44@@6B@
??_7Line@ParagraphLayout@icu_44@@6B@
??_7LocaleRuns@icu_44@@6B@
??_7ParagraphLayout@icu_44@@6B@
??_7RunArray@icu_44@@6B@
??_7ValueRuns@icu_44@@6B@
??_7VisualRun@ParagraphLayout@icu_44@@6B@
?add@FontRuns@icu_44@@QAEHPBVLEFontInstance@2@H@Z
?add@LocaleRuns@icu_44@@QAEHPBVLocale@2@H@Z
?add@RunArray@icu_44@@QAEHH@Z
?add@ValueRuns@icu_44@@QAEHHH@Z
?append@Line@ParagraphLayout@icu_44@@AAEXPBVLEFontInstance@3@W4UBiDiDirection@@HQBIQBMQBH@Z
?appendRun@ParagraphLayout@icu_44@@AAEXPAVLine@12@HHH@Z
?computeLevels@ParagraphLayout@icu_44@@AAEXE@Z
?computeLocales@ParagraphLayout@icu_44@@AAEXXZ
?computeMetrics@Line@ParagraphLayout@icu_44@@AAEXXZ
?computeMetrics@ParagraphLayout@icu_44@@AAEXXZ
?computeScripts@ParagraphLayout@icu_44@@AAEXXZ
?computeSubFonts@ParagraphLayout@icu_44@@AAEXPBVFontRuns@2@AAW4LEErrorCode@@@Z
?computeVisualRuns@ParagraphLayout@icu_44@@AAEPAVLine@12@XZ
?countRuns@Line@ParagraphLayout@icu_44@@QBEHXZ
?ensureCapacity@RunArray@icu_44@@AAEHXZ
?fgClassID@FontRuns@icu_44@@0DB
?fgClassID@Line@ParagraphLayout@icu_44@@0DB
?fgClassID@LocaleRuns@icu_44@@0DB
?fgClassID@ParagraphLayout@icu_44@@0DB
?fgClassID@RunArray@icu_44@@0DB
?fgClassID@ValueRuns@icu_44@@0DB
?fgClassID@VisualRun@ParagraphLayout@icu_44@@0DB
?getAscent@Line@ParagraphLayout@icu_44@@QBEHXZ
?getAscent@ParagraphLayout@icu_44@@UBEHXZ
?getAscent@VisualRun@ParagraphLayout@icu_44@@QBEHXZ
?getCharRun@ParagraphLayout@icu_44@@AAEHH@Z
?getCount@RunArray@icu_44@@QBEHXZ
?getDescent@Line@ParagraphLayout@icu_44@@QBEHXZ
?getDescent@ParagraphLayout@icu_44@@UBEHXZ
?getDescent@VisualRun@ParagraphLayout@icu_44@@QBEHXZ
?getDirection@VisualRun@ParagraphLayout@icu_44@@QBE?AW4UBiDiDirection@@XZ
?getDynamicClassID@FontRuns@icu_44@@UBEPAXXZ
?getDynamicClassID@Line@ParagraphLayout@icu_44@@UBEPAXXZ
?getDynamicClassID@LocaleRuns@icu_44@@UBEPAXXZ
?getDynamicClassID@ParagraphLayout@icu_44@@UBEPAXXZ
?getDynamicClassID@RunArray@icu_44@@UBEPAXXZ
?getDynamicClassID@ValueRuns@icu_44@@UBEPAXXZ
?getDynamicClassID@VisualRun@ParagraphLayout@icu_44@@UBEPAXXZ
?getFont@FontRuns@icu_44@@QBEPBVLEFontInstance@2@H@Z
?getFont@VisualRun@ParagraphLayout@icu_44@@QBEPBVLEFontInstance@3@XZ
?getGlyphCount@VisualRun@ParagraphLayout@icu_44@@QBEHXZ
?getGlyphToCharMap@VisualRun@ParagraphLayout@icu_44@@QBEPBHXZ
?getGlyphs@VisualRun@ParagraphLayout@icu_44@@QBEPBIXZ
?getLanguageCode@ParagraphLayout@icu_44@@AAEHPBVLocale@2@@Z
?getLeading@Line@ParagraphLayout@icu_44@@QBEHXZ
?getLeading@ParagraphLayout@icu_44@@UBEHXZ
?getLeading@VisualRun@ParagraphLayout@icu_44@@QBEHXZ
?getLimit@RunArray@icu_44@@QBEHH@Z
?getLimit@RunArray@icu_44@@QBEHXZ
?getLocale@LocaleRuns@icu_44@@QBEPBVLocale@2@H@Z
?getParagraphLevel@ParagraphLayout@icu_44@@QAEEXZ
?getPositions@VisualRun@ParagraphLayout@icu_44@@QBEPBMXZ
?getStaticClassID@FontRuns@icu_44@@SAPAXXZ
?getStaticClassID@Line@ParagraphLayout@icu_44@@SAPAXXZ
?getStaticClassID@LocaleRuns@icu_44@@SAPAXXZ
?getStaticClassID@ParagraphLayout@icu_44@@SAPAXXZ
?getStaticClassID@RunArray@icu_44@@SAPAXXZ
?getStaticClassID@ValueRuns@icu_44@@SAPAXXZ
?getStaticClassID@VisualRun@ParagraphLayout@icu_44@@SAPAXXZ
?getTextDirection@ParagraphLayout@icu_44@@QAE?AW4UBiDiDirection@@XZ
?getValue@ValueRuns@icu_44@@QBEHH@Z
?getVisualRun@Line@ParagraphLayout@icu_44@@QBEPBVVisualRun@23@H@Z
?getWidth@Line@ParagraphLayout@icu_44@@QBEHXZ
?grow@FontRuns@icu_44@@MAEXH@Z
?grow@LocaleRuns@icu_44@@MAEXH@Z
?grow@RunArray@icu_44@@MAEXH@Z
?grow@ValueRuns@icu_44@@MAEXH@Z
?init@FontRuns@icu_44@@MAEXH@Z
?init@LocaleRuns@icu_44@@MAEXH@Z
?init@RunArray@icu_44@@MAEXH@Z
?init@ValueRuns@icu_44@@MAEXH@Z
?isComplex@ParagraphLayout@icu_44@@CACW4UScriptCode@@@Z
?isComplex@ParagraphLayout@icu_44@@SACQB_WH@Z
?isDone@ParagraphLayout@icu_44@@QBECXZ
?nextLine@ParagraphLayout@icu_44@@QAEPAVLine@12@M@Z
?previousBreak@ParagraphLayout@icu_44@@AAEHH@Z
?reflow@ParagraphLayout@icu_44@@QAEXXZ
?reset@RunArray@icu_44@@QAEXXZ
pl_addFontRun_44
pl_addLocaleRun_44
pl_addValueRun_44
pl_closeFontRuns_44
pl_closeLine_44
pl_closeLocaleRuns_44
pl_closeValueRuns_44
pl_close_44
pl_countLineRuns_44
pl_create_44
pl_getAscent_44
pl_getDescent_44
pl_getFontRunCount_44
pl_getFontRunFont_44
pl_getFontRunLastLimit_44
pl_getFontRunLimit_44
pl_getLeading_44
pl_getLineAscent_44
pl_getLineDescent_44
pl_getLineLeading_44
pl_getLineVisualRun_44
pl_getLineWidth_44
pl_getLocaleRunCount_44
pl_getLocaleRunLastLimit_44
pl_getLocaleRunLimit_44
pl_getLocaleRunLocale_44
pl_getParagraphLevel_44
pl_getTextDirection_44
pl_getValueRunCount_44
pl_getValueRunLastLimit_44
pl_getValueRunLimit_44
pl_getValueRunValue_44
pl_getVisualRunAscent_44
pl_getVisualRunDescent_44
pl_getVisualRunDirection_44
pl_getVisualRunFont_44
pl_getVisualRunGlyphCount_44
pl_getVisualRunGlyphToCharMap_44
pl_getVisualRunGlyphs_44
pl_getVisualRunLeading_44
pl_getVisualRunPositions_44
pl_isComplex_44
pl_nextLine_44
pl_openEmptyFontRuns_44
pl_openEmptyLocaleRuns_44
pl_openEmptyValueRuns_44
pl_openFontRuns_44
pl_openLocaleRuns_44
pl_openValueRuns_44
pl_reflow_44
pl_resetFontRuns_44
pl_resetLocaleRuns_44
pl_resetValueRuns_44

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9371db79d0ed0503f3c4086be733e6fd

Headers

File Characteristics

Imports

icule44

icuuc44

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 100KB - Virtual size: 100KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 100KB - Virtual size: 100KB

.reloc
Size: 2KB - Virtual size: 1KB