bea2d06c22431a0b7de56e2480c1a646_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bea2d06c22431a0b7de56e2480c1a646_JaffaCakes118
Size

232KB
MD5

bea2d06c22431a0b7de56e2480c1a646
SHA1

809656a4272f07ba97db2d92f66725f2275d4b73
SHA256

f5710be15a81ca5be4069bad0fd2a9749bcdd06511a110b659c5f43d86be6e4a
SHA512

e7527d148ecacf36a6f80ce03215a1da4c9188857414209d2f330946b3cae3d7218e490aa872c8ac3da784bbf74a757d1891e46b272189b94c060c7e23fc51fd
SSDEEP

3072:9ZDI7F+WORF5RBzjAi2G3K+Hl8qypHUlojVwUgw2nhQKVOzxFoGo82p/ADBCrN/V:LOqjnAq6/bp0UkTQxFoGQLrzxoek0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bea2d06c22431a0b7de56e2480c1a646_JaffaCakes118

Files

bea2d06c22431a0b7de56e2480c1a646_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b259d2f9ab25eee287b7e5f51e369e14

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Vss\Pl2507\src\Plx507\Release\PLX507.pdb

Imports

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

shlwapi

StrStrIA

kernel32

GetDriveTypeA
GetLastError
Sleep
WaitForSingleObject
ResetEvent
CreateEventA
FreeLibrary
CreateMutexA
OpenMutexA
InterlockedIncrement
SetEvent
GetLogicalDrives
InterlockedDecrement
QueryPerformanceCounter
GetVersionExA
ReadFile
WriteFile
SetFilePointer
IsBadCodePtr
IsBadReadPtr
CreateFileA
DeviceIoControl
CloseHandle
LoadLibraryA
GetProcAddress
HeapSize
ReleaseMutex
GetCPInfo
GetLocaleInfoA
ExitProcess
WideCharToMultiByte
RtlUnwind
RaiseException
ExitThread
ResumeThread
CreateThread
GetCurrentThreadId
GetCommandLineA
GetACP
GetOEMCP
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
DeleteCriticalSection
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedExchange
VirtualQuery
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
FlushFileBuffers
InitializeCriticalSection
VirtualProtect
GetSystemInfo

user32

wsprintfA
PostMessageA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey

cfgmgr32

CM_Get_Sibling
CM_Get_Device_IDA
CM_Get_Parent
CM_Get_Child
CM_Locate_DevNodeA

Exports

Exports

X507ATACBExecute
X507ATACBExecutePhysical
X507ATACBGetConfig
X507ChangePassword
X507CheckPassword
X507CloseDevice
X507CloseDevicePhysical
X507EepromRead
X507EepromReadPhysical
X507EepromWrite
X507EepromWritePhysical
X507EnumDevice
X507EnumDeviceNoCheck
X507EnumDevicePhysical
X507EraseFirmware
X507EraseFirmwarePhysical
X507ForceEnumDevice
X507Get1394SN
X507GetChipInfo
X507GetChipInfoPhysical
X507GetDriveList
X507GetGPIO
X507GetInstanceID
X507GetInstanceIDPhysical
X507GetSN
X507GetSecurityStatus
X507GetUSBInfo
X507Inquiry
X507InquiryPhysical
X507PausePolling
X507ReadFirmware
X507ReadFirmwarePhysical
X507ReadSector
X507Register3Message
X507RegisterEGPIOMessage
X507RegisterGPIOMessage
X507RegisterMessage
X507RegisterMessagePhysical
X507SafetyRemove
X507SendSCSICmd
X507SetGPIO
X507SupportOld1394
X507WriteCDRomData
X507WriteCDRomDataPhysical
X507WriteFirmware
X507WriteFirmwarePhysical
X507WriteReadOnlyData
X507WriteReadOnlyDataPhysical

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b259d2f9ab25eee287b7e5f51e369e14

Headers

File Characteristics

PDB Paths

Imports

setupapi

shlwapi

kernel32

user32

advapi32

cfgmgr32

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 12KB - Virtual size: 9KB

.data Size: 4KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 8KB - Virtual size: 6KB

.text Size: 112KB - Virtual size: 112KB

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 12KB - Virtual size: 9KB

.data
Size: 4KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 112KB - Virtual size: 112KB