e158ea5f4894401ddaa0d961cdb6fc8a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e158ea5f4894401ddaa0d961cdb6fc8a_JaffaCakes118
Size

35KB
MD5

e158ea5f4894401ddaa0d961cdb6fc8a
SHA1

c155bff5a9ba7da071d00c99930aa7607c7fb6f0
SHA256

3eb50322ef324f4e9bbe82f9e50ec1248b9e1be5a601dd142a7d4f7a0f72f53c
SHA512

f273fd2ed8863a25c89914a8734795f1413af64f7c85b24d2dc639236936fd3e7906e3a4989b173693c4cec22cc21d38f4053c24de95c864278b25be39d07d4c
SSDEEP

768:qaXCQvWE11ynwjs4CaDRUgIpilUEPV7/0Iw:jXHuE11ywjs4xjAiaEPV7sIw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e158ea5f4894401ddaa0d961cdb6fc8a_JaffaCakes118

Files

e158ea5f4894401ddaa0d961cdb6fc8a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6545745c969306c67deea7a75985d052

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

cygkdecore-5

_Z12kDebugStream9QtMsgTypeiPKciS1_
_ZN6KDebug13hasNullOutputE9QtMsgTypebib

cygwin1

__wrap__ZdlPv
__wrap__Znwj
_impure_ptr
atexit
calloc
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
fprintf
free
fwrite
malloc
pclose
popen
realloc
sscanf
strcmp

cyggcc_s-1

_Unwind_Resume

cygstdc++-6

_ZdlPv
_Znwj
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_v0

cygqtcore-4

_Z17qt_message_output9QtMsgTypePKc
_Z4endlR11QTextStream
_Z5qFreePv
_Z7qstrcmpRK10QByteArrayPKc
_Z8qWarningPKcz
_ZN10QByteArray6resizeEi
_ZN10QByteArray7reallocEi
_ZN10QByteArrayC1EPKc
_ZN11QMetaObject11changeGuardEPP7QObjectS1_
_ZN11QMetaObject11removeGuardEPP7QObject
_ZN11QTextStream8readLineEx
_ZN11QTextStream8setCodecEPKc
_ZN11QTextStreamC1EP9QIODevice
_ZN11QTextStreamD1Ev
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN11QTextStreamlsEf
_ZN11QTextStreamlsEj
_ZN14QTemporaryFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN14QTemporaryFileC1ERK7QString
_ZN14QTemporaryFileC1Ev
_ZN14QTemporaryFileD1Ev
_ZN5QChar9fromAsciiEc
_ZN5QFile10encodeNameERK7QString
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN5QFile5closeEv
_ZN5QFileC1ERK7QString
_ZN5QFileD1Ev
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject13connectNotifyEPKc
_ZN7QObject16disconnectNotifyEPKc
_ZN7QObject5eventEP6QEvent
_ZN7QString11shared_nullE
_ZN7QString16fromAscii_helperEPKci
_ZN7QString4freeEPNS_4DataE
_ZN7QString6appendE5QChar
_ZN7QString6appendERKS_
_ZN7QString6setNumExi
_ZN7QString9fromAsciiEPKci
_ZN7QStringaSERKS_
_ZN9QIODevice4readEPcx
_ZN9QIODevice7readAllEv
_ZN9QIODevice8readLineEPcx
_ZN9QIODevice8readLineEx
_ZN9QIODevice9ungetCharEc
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZNK10QByteArray7indexOfEPKci
_ZNK11QTextStream5atEndEv
_ZNK14QTemporaryFile8fileNameEv
_ZNK7QString11toLocal8BitEv
_ZNK9QIODevice10isReadableEv
_ZNK9QIODevice10isWritableEv
_ZNK9QIODevice6isOpenEv

cygqtgui-4

_ZN14QImageIOPlugin11qt_metacallEN11QMetaObject4CallEiPPv
_ZN14QImageIOPlugin11qt_metacastEPKc
_ZN14QImageIOPluginC2EP7QObject
_ZN14QImageIOPluginD2Ev
_ZN15QImageIOHandler11jumpToImageEi
_ZN15QImageIOHandler15jumpToNextImageEv
_ZN15QImageIOHandler9setDeviceEP9QIODevice
_ZN15QImageIOHandler9setFormatERK10QByteArray
_ZN15QImageIOHandler9setOptionENS_11ImageOptionERK8QVariant
_ZN15QImageIOHandlerC2Ev
_ZN15QImageIOHandlerD2Ev
_ZN6QImage4loadERK7QStringPKc
_ZN8QPainter11setClipRectERK5QRectN2Qt13ClipOperationE
_ZN8QPainter3endEv
_ZN8QPainter5beginEP12QPaintDevice
_ZN8QPainter9drawImageERK7QPointFRK6QImage
_ZN8QPainterC1Ev
_ZN8QPainterD1Ev
_ZN8QPrinter10setCreatorERK7QString
_ZN8QPrinter11setFullPageEb
_ZN8QPrinter15setOutputFormatENS_12OutputFormatE
_ZN8QPrinter17setOutputFileNameERK7QString
_ZN8QPrinterC1ENS_11PrinterModeE
_ZN8QPrinterD1Ev
_ZNK14QImageIOPlugin10metaObjectEv
_ZNK15QImageIOHandler10imageCountEv
_ZNK15QImageIOHandler14nextImageDelayEv
_ZNK15QImageIOHandler14supportsOptionENS_11ImageOptionE
_ZNK15QImageIOHandler16currentImageRectEv
_ZNK15QImageIOHandler18currentImageNumberEv
_ZNK15QImageIOHandler6deviceEv
_ZNK15QImageIOHandler6optionENS_11ImageOptionE
_ZNK15QImageIOHandler9loopCountEv
_ZNK15QImageIOHandler9setFormatERK10QByteArray
_ZNK6QImage5widthEv
_ZNK6QImage6heightEv
_ZNK8QPrinter14outputFileNameEv

kernel32

GetModuleHandleA
GetProcAddress

Exports

Exports

_ZN10EPSHandler4readEP6QImage
_ZN10EPSHandler5writeERK6QImage
_ZN10EPSHandler7canReadEP9QIODevice
_ZN10EPSHandlerC1Ev
_ZN10EPSHandlerC2Ev
_ZN10EPSHandlerD0Ev
_ZN10EPSHandlerD1Ev
_ZN10QByteArrayD1Ev
_ZN5QListI7QStringE13detach_helperEi
_ZN5QListI7QStringE13detach_helperEv
_ZN5QListI7QStringE18detach_helper_growEii
_ZN5QListI7QStringE6appendERKS0_
_ZN5QListI7QStringED2Ev
_ZN6KDebug23hasNullOutputQtDebugMsgEi
_ZN6KDebugclEi
_ZN6QDebugD1Ev
_ZN6QDebuglsEPKc
_ZN6QDebuglsEf
_ZN6QDebuglsEj
_ZN7QStringD1Ev
_ZN9EPSPluginD0Ev
_ZN9EPSPluginD1Ev
_ZNK10EPSHandler4nameEv
_ZNK10EPSHandler7canReadEv
_ZNK9EPSPlugin12capabilitiesEP9QIODeviceRK10QByteArray
_ZNK9EPSPlugin4keysEv
_ZNK9EPSPlugin6createEP9QIODeviceRK10QByteArray
_ZTI10EPSHandler
_ZTI14QImageIOPlugin
_ZTI15QImageIOHandler
_ZTI17QFactoryInterface
_ZTI31QImageIOHandlerFactoryInterface
_ZTI7QObject
_ZTI9EPSPlugin
_ZTISt9bad_alloc
_ZTISt9exception
_ZTS10EPSHandler
_ZTS14QImageIOPlugin
_ZTS15QImageIOHandler
_ZTS17QFactoryInterface
_ZTS31QImageIOHandlerFactoryInterface
_ZTS7QObject
_ZTS9EPSPlugin
_ZTSSt9bad_alloc
_ZTSSt9exception
_ZTV10EPSHandler
_ZTV9EPSPlugin
_ZThn8_N9EPSPluginD0Ev
_ZThn8_N9EPSPluginD1Ev
_ZThn8_NK9EPSPlugin4keysEv
_ZThn8_NK9EPSPlugin6createEP9QIODeviceRK10QByteArray
_nm___ZN7QString11shared_nullE
_nm___ZN9QListData11shared_nullE
qt_plugin_instance
qt_plugin_query_verification_data

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 280B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6545745c969306c67deea7a75985d052

Headers

File Characteristics

Imports

cygkdecore-5

cygwin1

cyggcc_s-1

cygstdc++-6

cygqtcore-4

cygqtgui-4

kernel32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.data Size: 3KB - Virtual size: 2KB

.rdata Size: 512B - Virtual size: 84B

/4 Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 280B

.edata Size: 2KB - Virtual size: 1KB

.idata Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 1016B

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 3KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 84B

/4
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 280B

.edata
Size: 2KB - Virtual size: 1KB

.idata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 1016B