da50da281cd214d645b989b9c408c24b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

da50da281cd214d645b989b9c408c24b_JaffaCakes118
Size

166KB
MD5

da50da281cd214d645b989b9c408c24b
SHA1

0493728a74a796001c5ddba73d95444ca821b655
SHA256

194e4551d9c138d13be23c22a9d7d730cb2be9894a193e4560585eeb57468fd8
SHA512

37ce7d9f426c8da06e46761488a05f6bdd2af890dd7b565363b2f6ebc0a92a0a1aeacdfac0cd7df568266c0ab31da120ddcf5fd301dfe646df224b25c5a9fff7
SSDEEP

3072:dm5FxU2455Qg2Jb/ua0fV+QGWZPRAPmmYttLY:o3w55v2lMfk9WZPRAPmB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da50da281cd214d645b989b9c408c24b_JaffaCakes118

Files

da50da281cd214d645b989b9c408c24b_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

cba72c3f44692f305e655af1e6e85b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

IsWindow
SendMessageA
CreateWindowExA
SetRect
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard

kernel32

lstrcpyA
GetProcAddress
LoadLibraryA
GetTickCount
WinExec

msvcrt

localtime
time
wcsstr
wcscpy
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strrev
_strcmpi
wcstombs
_itoa
system
_ultoa
_errno
atoi
sprintf
strncmp
strncpy
rename
strrchr
_except_handler3
free
malloc
strchr
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
ceil
memmove
??3@YAXPAX@Z
strftime
_strnicmp

ws2_32

gethostname
__WSAFDIsSet
recvfrom
sendto
bind
getsockname
ntohs
inet_addr
inet_ntoa
send
closesocket
recv
select
socket
gethostbyname
htons
connect
WSACleanup
WSAStartup
setsockopt

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

msvcirt

?open@fstream@@QAEXPBDHH@Z
?close@fstream@@QAEXXZ
??1fstream@@UAE@XZ
??_Dfstream@@QAEXXZ
??0ofstream@@QAE@XZ
?openprot@filebuf@@2HB
??0fstream@@QAE@XZ
?read@istream@@QAEAAV1@PADH@Z
??_Dofstream@@QAEXXZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?write@ostream@@QAEAAV1@PBDH@Z
?open@ofstream@@QAEXPBDHH@Z

Exports

Exports

BeginUpdate2
ConnectionAccept
ConnectionClose
ConnectionInitAsync
ConnectionListen
ConnectionObjectSize
ConnectionPeek
ConnectionRead
ConnectionReadAsync
ConnectionVer
ConnectionWrite
ConnectionWriteAsync
ConnectionWriteStatus
CreateMxPsObj
CreateMxPwObj
CreateMxSkObj
DeleteMxPsObj
DeleteMxPwObj
DeleteMxSkObj
Detoured
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FreeUnzipBuf
GetDllVersionA
GetGameZipPtr
GetModuleVersion
GetProductVersion
InstallCrashReport
Main
PrepareUnzipFile
QGMessageBox
QGMessageBoxA
QGMessageBoxB
QGMessageBoxC
QGMessageBoxD
QGMessageBoxE
QGMessageBoxEx
QGMessageBoxURLWithClick
QGShowGIF
QQExceptionFilter
RD_XXXX
RSA_PublicEncrypt
RSA_PublicEncryptEx
ServiceMain
SetHTTPControl
SetProperty
SetZipLevel
SoDAShareCommitFile
SoDAShareEditID3
SoDAShareFinish
SoDAShareGetIPCPort
SoDAShareSetID3
SoDAShareSetID3Path
SoDAShareSetRegPath
SoDAShareSetUserID
SoDAShareStart
StartRouter
TimeProvClose
TimeProvCommand
TimeProvOpen
UnZip
UnZipEx
UnZipFile
VisCurTime_
VisDraw_
VisFileName_
VisFree_
VisGetProperty_
VisInit_
VisSetFormat_
VisSetProperty_
VisTotalTime_
ZipFolder
ZipFolderEx
_main@4
comdl2
comdl3
hime
mp_dc
mp_gt
mp_gv
mp_ms
mp_pf
mp_pl
mp_ps
mp_rd
run

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cba72c3f44692f305e655af1e6e85b20

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

ws2_32

msvcp60

msvcirt

Exports

Exports

Sections

.text Size: 117KB - Virtual size: 117KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 22KB - Virtual size: 26KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 117KB - Virtual size: 117KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 22KB - Virtual size: 26KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB