e168255195f0edc8f5c9613c6ccc697d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e168255195f0edc8f5c9613c6ccc697d_JaffaCakes118
Size

270KB
MD5

e168255195f0edc8f5c9613c6ccc697d
SHA1

47439e6a28c52167bdecdf4784e4b665489c5406
SHA256

c84b33ae2b4ce960f901ca7182586bb33fcaea11cc50589af9897f36272ea417
SHA512

7b88ee94a373de1b9370e99718aa0f0ff4b7a86b5f23c1ce54a72ec14134cd1452d1ebc3026cf75dabf7dc417d4f9ac60b4f656a9611b948ad3503cc952eb6ca
SSDEEP

6144:xFoaMShqy+RC8EkfIcXnsYQQ25muk/N9XLYVFQwI4aFOlcfJ3b:LdD+RCefIjjlLQ8a/Jr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e168255195f0edc8f5c9613c6ccc697d_JaffaCakes118

Files

e168255195f0edc8f5c9613c6ccc697d_JaffaCakes118
.dll windows:5 windows x64 arch:x64

e7fc647d80534ca7012a0a924b857716

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

zlib1

deflateEnd
deflate
deflateInit2_
inflateEnd
inflate
inflateInit_

qtgui4

??1QImageIOPlugin@@UEAA@XZ
?qt_metacall@QImageIOPlugin@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QImageIOPlugin@@UEAAPEAXPEBD@Z
?metaObject@QImageIOPlugin@@UEBAPEBUQMetaObject@@XZ
??0QImageIOPlugin@@QEAA@PEAVQObject@@@Z
?setDevice@QImageIOHandler@@QEAAXPEAVQIODevice@@@Z
?setFormat@QImageIOHandler@@QEAAXAEBVQByteArray@@@Z
?currentImageRect@QImageIOHandler@@UEBA?AVQRect@@XZ
??0QImageIOHandler@@QEAA@XZ
??1QImageIOHandler@@UEAA@XZ
??BQColor@@QEBA?AVQVariant@@XZ
?setFormat@QImageIOHandler@@QEBAXAEBVQByteArray@@@Z
?convertToFormat@QImage@@QEBA?AV1@W4Format@1@V?$QFlags@W4ImageConversionFlag@Qt@@@@@Z
?width@QImage@@QEBAHXZ
?height@QImage@@QEBAHXZ
??0QImage@@QEAA@XZ
?setRgb@QColor@@QEAAXHHHH@Z
?invalidate@QColor@@AEAAXXZ
?red@QColor@@QEBAHXZ
?blue@QColor@@QEBAHXZ
?green@QColor@@QEBAHXZ
??4QImage@@QEAAAEAV0@AEBV0@@Z
??0QImage@@QEAA@HHW4Format@0@@Z
??4QImage@@QEAAAEAV0@$$QEAV0@@Z
?fill@QImage@@QEAAXI@Z
?device@QImageIOHandler@@QEBAPEAVQIODevice@@XZ
??1QImage@@UEAA@XZ
?scanLine@QImage@@QEAAPEAEH@Z

qtcore4

?peek@QIODevice@@QEAA?AVQByteArray@@_J@Z
??0QByteArray@@QEAA@PEBD@Z
?constData@QVariant@@QEBAPEBXXZ
?userType@QVariant@@QEBAHXZ
??0QVariant@@QEAA@XZ
??1QVariant@@QEAA@XZ
??0QVariant@@QEAA@AEBV0@@Z
??0QVariant@@QEAA@_N@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXPEBD@Z
?disconnectNotify@QObject@@MEAAXPEBD@Z
?shared_null@QListData@@2UData@1@A
?removeGuard@QMetaObject@@SAXPEAPEAVQObject@@@Z
?changeGuard@QMetaObject@@SAXPEAPEAVQObject@@PEAV2@@Z
??0QString@@QEAA@AEBV0@@Z
?free@QString@@CAXPEAUData@1@@Z
?isReadable@QIODevice@@QEBA_NXZ
?isOpen@QIODevice@@QEBA_NXZ
?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z
?detach@QListData@@QEAAPEAUData@1@H@Z
?append@QListData@@QEAAPEAPEAXXZ
??1QString@@QEAA@XZ
?fromLatin1_helper@QString@@CAPEAUData@1@PEBDH@Z
?qFree@@YAXPEAX@Z
??1QByteArray@@QEAA@XZ
?write@QIODevice@@QEAA_JPEBD_J@Z
?qDebug@@YAXPEBDZZ
?qWarning@@YAXPEBDZZ
?handler@QVariant@@1PEBUHandler@1@EB
?qstrcmp@@YAHAEBVQByteArray@@PEBD@Z
?read@QIODevice@@QEAA_JPEAD_J@Z

msvcr100

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
_CxxThrowException
pow
memset
memcpy
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
strncmp
__CxxFrameHandler3
free
calloc

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
DecodePointer
EncodePointer

Exports

Exports

qt_plugin_instance
qt_plugin_query_verification_data

Sections

.text
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e7fc647d80534ca7012a0a924b857716

Headers

DLL Characteristics

File Characteristics

Imports

zlib1

qtgui4

qtcore4

msvcr100

kernel32

Exports

Exports

Sections

.text Size: 215KB - Virtual size: 215KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 12KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 215KB - Virtual size: 215KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB