d547322ed8076e904975db61b265fd50_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d547322ed8076e904975db61b265fd50_JaffaCakes118
Size

128KB
MD5

d547322ed8076e904975db61b265fd50
SHA1

3a8c3f48af175ce261c8e02e10625e25e327e26c
SHA256

150f95e32a3234bf5cedfc2ac328b2e5594d297feebc140d43f894340eab1526
SHA512

0cf175322f13786252a77a44922248995cb294a8ebf8e52863d4276f289fccbd965d0f0f829c1c84c964f4c0f8f90500f5dd92ce7ed85042f586b54e1793c030
SSDEEP

3072:mZPBYHccL43h0sePHF/iAj0V4aDCfLqODl1Wf7jQWP43UV+F3vdaqrm3witoCr+9:uYHcs43qs6xi40V4aDCfLqODl1Wf7jQy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d547322ed8076e904975db61b265fd50_JaffaCakes118

Files

d547322ed8076e904975db61b265fd50_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e194fab8591cfc1d215861d054743527

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

msvcrt

_strdup
_stricmp
_write
__dllonexit
_assert
_errno
_iob
_vsnprintf
abort
calloc
fflush
fprintf
free
malloc
memchr
memcpy
memmove
memset
strcmp
strlen
strrchr

kernel32

AddAtomA
CloseHandle
CreateFileA
CreateFileMappingA
CreateRemoteThread
CreateSemaphoreA
CreateThread
CreateToolhelp32Snapshot
EnterCriticalSection
FindAtomA
FreeLibrary
GetAtomNameA
GetFileSize
GetLastError
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemInfo
GetThreadLocale
GetTickCount
GetVersionExA
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
ReadProcessMemory
ReleaseSemaphore
SetConsoleTitleA
SetConsoleTitleW
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
VirtualAllocEx
VirtualFreeEx
VirtualProtectEx
WaitForSingleObject
WriteConsoleA
WriteConsoleW
WriteProcessMemory

shell32

ShellExecuteA

user32

FindWindowA
FlashWindow
GetActiveWindow
MessageBoxA

wininet

HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile

winmm

sndPlaySoundA

perl58

Perl_Isv_yes_ptr
Perl_newXS
Perl_sv_setpv
Perl_form
Perl_get_sv
Perl_newSVpvn
Perl_Isv_no_ptr
Perl_av_push
Perl_newAV
Perl_Isv_undef_ptr
Perl_mg_set
Perl_sv_setiv
Perl_newRV
Perl_av_store
Perl_hv_store
Perl_newHV
Perl_av_extend
Perl_av_clear
Perl_av_len
Perl_newSViv
Perl_sv_2mortal
Perl_Tcurpad_ptr
Perl_Top_ptr
Perl_sv_2pv_flags
Perl_sv_2pv_nolen
Perl_sv_free
Perl_croak_nocontext
Perl_sv_2iv
Perl_sv_derived_from
Perl_sv_2uv
Perl_sv_setref_pv
Perl_sv_newmortal
Perl_croak
Perl_Tstack_base_ptr
Perl_Tmarkstack_ptr_ptr
Perl_get_context
Perl_Tstack_sp_ptr
Perl_sv_setpvn
Perl_stack_grow
Perl_Tstack_max_ptr
Perl_newSVuv
Perl_newSVpv
Perl_sv_setuv
Perl_av_fetch
Perl_sv_grow
Perl_sv_pvn_force_flags
Perl_warn_nocontext
Perl_sv_isobject
Perl_pop_scope
Perl_free_tmps
Perl_eval_pv
Perl_Ttmps_ix_ptr
Perl_Ttmps_floor_ptr
Perl_save_int
Perl_push_scope
Perl_hv_exists
Perl_get_hv
Perl_safesysmalloc
Perl_Imodglobal_ptr
Perl_hv_fetch
Perl_sv_2nv

Exports

Exports

CalcPath_destroy
CalcPath_init
CalcPath_new
CalcPath_pathStep
_Z12printConsolePKci
_Z13GetProcByNamePKc
_Z15setConsoleTitlePKci
_Z16XS_Utils_binFindP11interpreterP2cv
_Z16XS_Utils_timeOutP11interpreterP2cv
_Z16XS_Utils_xpmmakeP11interpreterP2cv
_Z18XS_PathFinding_runP11interpreterP2cv
_Z20XS_StdHttpReader_newP11interpreterP2cv
_Z20XS_Translation__loadP11interpreterP2cv
_Z20XS_Utils_makeDistMapP11interpreterP2cv
_Z21XS_HttpReader_DESTROYP11interpreterP2cv
_Z21XS_HttpReader_getDataP11interpreterP2cv
_Z21XS_HttpReader_getSizeP11interpreterP2cv
_Z21XS_PathFinding__resetP11interpreterP2cv
_Z21XS_PathFinding_createP11interpreterP2cv
_Z21XS_PathFinding_runrefP11interpreterP2cv
_Z21XS_PathFinding_runstrP11interpreterP2cv
_Z21XS_StdHttpReader_initP11interpreterP2cv
_Z21XS_WinUtils_InjectDLLP11interpreterP2cv
_Z21XS_WinUtils_playSoundP11interpreterP2cv
_Z22XS_HttpReader_getErrorP11interpreterP2cv
_Z22XS_HttpReader_pullDataP11interpreterP2cv
_Z22XS_PathFinding_DESTROYP11interpreterP2cv
_Z22XS_Translation__unloadP11interpreterP2cv
_Z22XS_XSTools_initVersionP11interpreterP2cv
_Z23XS_HttpReader_getStatusP11interpreterP2cv
_Z23XS_MirrorHttpReader_newP11interpreterP2cv
_Z23XS_PathFinding_runcountP11interpreterP2cv
_Z23XS_WinUtils_FlashWindowP11interpreterP2cv
_Z23XS_WinUtils_OpenProcessP11interpreterP2cv
_Z23XS_XSTools_majorVersionP11interpreterP2cv
_Z23XS_XSTools_minorVersionP11interpreterP2cv
_Z24XS_WinUtils_CloseProcessP11interpreterP2cv
_Z24XS_WinUtils_ShellExecuteP11interpreterP2cv
_Z24XS_WinUtils_printConsoleP11interpreterP2cv
_Z25XS_Translation__translateP11interpreterP2cv
_Z25XS_WinUtils_GetProcByNameP11interpreterP2cv
_Z25XS_WinUtils_listProcessesP11interpreterP2cv
_Z27XS_WinUtils_getLanguageNameP11interpreterP2cv
_Z27XS_WinUtils_setConsoleTitleP11interpreterP2cv
_Z28XS_WinUtils_VirtualProtectExP11interpreterP2cv
_Z29XS_WinUtils_ReadProcessMemoryP11interpreterP2cv
_Z30XS_WinUtils_WriteProcessMemoryP11interpreterP2cv
_Z31XS_WinUtils_SystemInfo_PageSizeP11interpreterP2cv
_Z36XS_WinUtils_SystemInfo_MaxAppAddressP11interpreterP2cv
_Z36XS_WinUtils_SystemInfo_MinAppAddressP11interpreterP2cv
_Z9InjectDLLmPKc
_ZN10FileReaderD0Ev
_ZN10FileReaderD1Ev
_ZN10FileReaderD2Ev
_ZN10Translator14getOrigMessageEj
_ZN10Translator21getTranslationMessageEjRj
_ZN10Translator9translateEPKcRj
_ZN10TranslatorC1EPKc
_ZN10TranslatorC2EPKc
_ZN10TranslatorD1Ev
_ZN10TranslatorD2Ev
_ZN13WinFileReader7getSizeEv
_ZN13WinFileReader7readIntEj
_ZN13WinFileReader7readStrEj
_ZN13WinFileReaderC1EPKc
_ZN13WinFileReaderC2EPKc
_ZN13WinFileReaderD0Ev
_ZN13WinFileReaderD1Ev
_ZN13WinFileReaderD2Ev
_ZN8OpenKore10HttpReader18DEFAULT_USER_AGENTE
_ZN8OpenKore10HttpReaderD0Ev
_ZN8OpenKore10HttpReaderD1Ev
_ZN8OpenKore10HttpReaderD2Ev
_ZN8OpenKore13StdHttpReader4initEv
_ZN8OpenKore13StdHttpReader6createEPKcS2_
_ZN8OpenKore13StdHttpReader8downloadEPKcRjS2_
_ZN8OpenKore13StdHttpReader8downloadEPKcS2_
_ZN8OpenKore13StdHttpReaderD0Ev
_ZN8OpenKore13StdHttpReaderD1Ev
_ZN8OpenKore16MirrorHttpReader8pullDataEPvj
_ZN8OpenKore16MirrorHttpReaderC1ERKSt4listIPKcSaIS3_EEjS3_
_ZN8OpenKore16MirrorHttpReaderC2ERKSt4listIPKcSaIS3_EEjS3_
_ZN8OpenKore16MirrorHttpReaderD0Ev
_ZN8OpenKore16MirrorHttpReaderD1Ev
_ZN8OpenKore16MirrorHttpReaderD2Ev
_ZN8OpenKore24_MirrorHttpReaderPrivate11threadEntryEPv
_ZN8OpenKore24_MirrorHttpReaderPrivate11threadEntryEPv@4
_ZN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader11threadEntryEPv
_ZN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader11threadEntryEPv@4
_ZN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader8pullDataEPvj
_ZN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReaderC1EPKcS3_
_ZN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReaderD0Ev
_ZN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReaderD1Ev
_ZNK8OpenKore16MirrorHttpReader7getDataERj
_ZNK8OpenKore16MirrorHttpReader7getSizeEv
_ZNK8OpenKore16MirrorHttpReader8getErrorEv
_ZNK8OpenKore16MirrorHttpReader9getStatusEv
_ZNK8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader7getDataERj
_ZNK8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader7getSizeEv
_ZNK8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader8getErrorEv
_ZNK8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReader9getStatusEv
_ZNSt10_List_baseIPKcSaIS1_EE8_M_clearEv
_ZNSt10_List_baseIPcSaIS0_EE8_M_clearEv
_ZTI10FileReader
_ZTI13WinFileReader
_ZTIN8OpenKore10HttpReaderE
_ZTIN8OpenKore13StdHttpReaderE
_ZTIN8OpenKore16MirrorHttpReaderE
_ZTIN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReaderE
_ZTS10FileReader
_ZTS13WinFileReader
_ZTSN8OpenKore10HttpReaderE
_ZTSN8OpenKore13StdHttpReaderE
_ZTSN8OpenKore16MirrorHttpReaderE
_ZTSN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReaderE
_ZTV10FileReader
_ZTV13WinFileReader
_ZTVN8OpenKore10HttpReaderE
_ZTVN8OpenKore13StdHttpReaderE
_ZTVN8OpenKore16MirrorHttpReaderE
_ZTVN8OpenKore71_GLOBAL__N_src_auto_XSTools_utils_std_http_reader.cpp_2E77F885_BD08EA3B13WinHttpReaderE
boot_FastUtils
boot_PathFinding
boot_Translation
boot_Utils__HttpReader
boot_WinUtils
boot_XSTools
o_http_reader_free
o_http_reader_free@4
o_http_reader_get_data
o_http_reader_get_data@8
o_http_reader_get_error
o_http_reader_get_error@4
o_http_reader_get_size
o_http_reader_get_size@4
o_http_reader_get_status
o_http_reader_get_status@4
o_http_reader_pull_data
o_http_reader_pull_data@12
o_mirror_http_reader_new
o_mirror_http_reader_new@4
o_std_http_reader_init
o_std_http_reader_init@0
o_std_http_reader_new
o_std_http_reader_new@4

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e194fab8591cfc1d215861d054743527

Headers

File Characteristics

Imports

msvcrt

kernel32

shell32

user32

wininet

winmm

perl58

Exports

Exports

Sections

.text Size: 97KB - Virtual size: 96KB

.data Size: 512B - Virtual size: 80B

.rdata Size: 12KB - Virtual size: 11KB

.bss Size: - Virtual size: 16KB

.edata Size: 7KB - Virtual size: 7KB

.idata Size: 4KB - Virtual size: 4KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 97KB - Virtual size: 96KB

.data
Size: 512B - Virtual size: 80B

.rdata
Size: 12KB - Virtual size: 11KB

.bss
Size: - Virtual size: 16KB

.edata
Size: 7KB - Virtual size: 7KB

.idata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 6KB - Virtual size: 5KB