df67d57f0abc8191b0f38e685d8c1288_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

df67d57f0abc8191b0f38e685d8c1288_JaffaCakes118
Size

164KB
MD5

df67d57f0abc8191b0f38e685d8c1288
SHA1

e3d5172567356e137116c0cc31c287c142f076f3
SHA256

43de2471e178c0128e4d5beec5c2de289f147a70ca56db639df1edb03a4df8ed
SHA512

6f35833822590dd22e59fc62851aac8cda6c1a32277c93b93ddee8423fc4ffd95b507c015ec36f1384b933af45a865a549a04e82963059423cc8d66bf5a0797c
SSDEEP

3072:u8TzUjE4J3cfKLSB96qj7MAsy2ULeGVTSbBuRl1wQ5vVEi1:VfwcfKc6zyBtxUBIl17tv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df67d57f0abc8191b0f38e685d8c1288_JaffaCakes118

Files

df67d57f0abc8191b0f38e685d8c1288_JaffaCakes118
.dll windows:4 windows x86 arch:x86

29ac07a139d42149a90a460b533df493

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wmvcore

WMCreateEditor

mfc42u

ord665
ord5180
ord535
ord354
ord860
ord3785
ord537
ord858
ord5706
ord861
ord942
ord6771
ord2810
ord4197
ord538
ord823
ord2910
ord1971
ord6381
ord353
ord4199
ord1165
ord1248
ord342
ord1179
ord5769
ord800
ord540
ord825
ord2385
ord5438

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
free
calloc
fopen
fseek
ftell
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
tmpfile
fwrite
rewind
fclose
isdigit
atoi
setlocale
malloc
wcstombs
_purecall
memmove
wprintf
_ui64tow
_wtoi64
wcslen
wcscpy
_wfopen
_wstat
fread
_waccess
wcscmp
_ftol
__CxxFrameHandler

kernel32

WideCharToMultiByte
MultiByteToWideChar
GetLastError

msvcirt

??0fstream@@QAE@XZ
??1fstream@@UAE@XZ
?close@fstream@@QAEXXZ
??_Dfstream@@QAEXXZ
?write@ostream@@QAEAAV1@PBDH@Z
?put@ostream@@QAEAAV1@E@Z
?flush@ostream@@QAEAAV1@XZ
?seekp@ostream@@QAEAAV1@JW4seek_dir@ios@@@Z
?tellp@ostream@@QAEJXZ
?close@ifstream@@QAEXXZ
?seekg@istream@@QAEAAV1@J@Z
?seekg@istream@@QAEAAV1@JW4seek_dir@ios@@@Z
?tellg@istream@@QAEJXZ
?read@istream@@QAEAAV1@PADH@Z
?peek@istream@@QAEHXZ
??0ifstream@@QAE@XZ
??1ifstream@@UAE@XZ
??1ios@@UAE@XZ
??_Difstream@@QAEXXZ
??0ifstream@@QAE@PBDHH@Z
?openprot@filebuf@@2HB
?open@ifstream@@QAEXPBDHH@Z
?open@fstream@@QAEXPBDHH@Z

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Xlen@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??_7out_of_range@std@@6B@
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

Exports

Exports

??0CMusicTag@@QAE@ABV0@@Z
??0CMusicTag@@QAE@XZ
??1CMusicTag@@UAE@XZ
??4CMusicTag@@QAEAAV0@ABV0@@Z
??_7CMusicTag@@6B@
?AddAttribWMATag@CMusicTag@@AAEJPAUIWMHeaderInfo3@@PAG1@Z
?ConvertMBtoWC@CMusicTag@@AAEJPADPAPAG@Z
?ConvertWCtoMB@CMusicTag@@AAEJPAPAGPAPAD@Z
?EditorOpenFile@CMusicTag@@AAEJPAGPAPAUIWMMetadataEditor@@PAPAUIWMHeaderInfo@@PAPAUIWMHeaderInfo3@@@Z
?GetAlbumImage@CMusicTag@@QAEPAEPAH@Z
?GetAll_ID3Tag@CMusicTag@@AAEXXZ
?GetAll_WMATag@CMusicTag@@AAEXXZ
?GetID3AblumImage@CMusicTag@@AAEPAEPAH@Z
?GetMusicTagData@CMusicTag@@AAEHXZ
?GetTagData@CMusicTag@@QAE?AUmusic_tag_info_t@@XZ
?GetWMAIndexByName@CMusicTag@@AAEHPAUIWMHeaderInfo3@@PAGW4WMT_ATTR_DATATYPE@@@Z
?GetWMAIndexData@CMusicTag@@AAEPAEPAUIWMHeaderInfo3@@GW4WMT_ATTR_DATATYPE@@@Z
?LoadPictureInBuffer@CMusicTag@@AAEJVCString@@PAPAEPAI@Z
?ModifyAttribIndexWMATag@CMusicTag@@AAEJPAUIWMHeaderInfo3@@GPAG@Z
?Open@CMusicTag@@QAEHVCString@@@Z
?SaveID3Image@CMusicTag@@AAEXPAVCString@@@Z
?SavePicture@CMusicTag@@QAEXVCString@@@Z
?SaveWMAImage@CMusicTag@@AAEXPAVCString@@@Z
?SetAll_ID3Tag@CMusicTag@@AAEXPAUmusic_tag_info_t@@@Z
?SetAll_WMATag@CMusicTag@@AAEXPAUmusic_tag_info_t@@@Z
?SetByString_WMATag@CMusicTag@@AAEXPAUIWMHeaderInfo3@@PAVCString@@1PAG@Z
?Update@CMusicTag@@QAEHPAUmusic_tag_info_t@@@Z
?WMAGetAttribute@CMusicTag@@AAE?AVCString@@PAUIWMHeaderInfo3@@PBGW4WMT_ATTR_DATATYPE@@@Z

Sections

.text
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29ac07a139d42149a90a460b533df493

Headers

File Characteristics

Imports

wmvcore

mfc42u

msvcrt

kernel32

msvcirt

msvcp60

Exports

Exports

Sections

.text Size: 112KB - Virtual size: 109KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 16KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 112KB - Virtual size: 109KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 16KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 8KB - Virtual size: 7KB