0dfaf5e3251b54fa6b862485c5bc8ec1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0dfaf5e3251b54fa6b862485c5bc8ec1_JaffaCakes118
Size

70KB
MD5

0dfaf5e3251b54fa6b862485c5bc8ec1
SHA1

ced6963fb81e57273c272c9073879c593d7b4c3e
SHA256

69ada65c413ff66ac5697310c93e1bf9be4a5294674a78ea9dad337a68068d11
SHA512

f83cdd98b0fdb02fc0ad9aef5d33b6562d459ad6a636e1b5fb546d47c6d7008c87c86b2a263605e9110ad2f64fc5cda8b5e7d4e0f784ac82c3535accdd3d7dc2
SSDEEP

1536:0jkeWvU3f2rXoFhLdu4rGGSY+A37feaCMJDmYsLIb4PvYqHB/Agt:IjWvU3+cFDu49SDADeak7dJHB/A2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0dfaf5e3251b54fa6b862485c5bc8ec1_JaffaCakes118

Files

0dfaf5e3251b54fa6b862485c5bc8ec1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36cd04c15c55baad3bbb6b167fdab93c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

owb_0_infra_tratastatus

?LeDadosScript@CTrataStatus@@QAEHPBD0@Z
?FinalizaProcessoAtualizacao@CTrataStatus@@QAE_NW4STATUS@@PBD@Z
??1CTrataStatus@@QAE@XZ
?OK@CTrataStatus@@QAE_NXZ
?ConexaoDB@CTrataStatus@@QAEXPAVCPollDatabase@@PBD@Z
??0CTrataStatus@@QAE@XZ
?LeDadosScript@CTrataStatus@@QAEXPBD0AAVCString@@@Z

utiloff

??1CUtilOff@@UAE@XZ

supserv

??1CServico@@UAE@XZ
?ValidaServico@CServico@@UAE?AW4SERV_RESULT@@AAVCServidor@@@Z
?ExecutaServico@CServico@@UAE?AW4SERV_RESULT@@AAVCServidor@@@Z
?TrataExecServico@CServico@@UAE?AW4SERV_RESULT@@AAVCServidor@@@Z
?PreRemoveSessao@CFiltroServ@@UAEXAAVCLog@@AAVCDatabaseL@@AAVCUmaSessao@@@Z
?PreCriaSessao@CFiltroServ@@UAEEAAVCServidor@@@Z
?NumTotInstancias@CServico@@UAEIXZ
??0CPagina@@QAE@PBD@Z
??1CElementoPagina@@UAE@XZ
??1CVariavel@@UAE@XZ
??1CDadosGlob@@UAE@XZ
?InitDados@CDadosGlob@@UAEHPAVCLogThread@@PAVCDatabaseL@@AAViterator@CPropertyTree@@@Z
?TrataErro@CPollDatabase@@UAEXHPADH@Z
?PreExecServ@CFiltroServ@@UAEEAAVCServidor@@PAVCServico@@@Z
?PosExecServ@CFiltroServ@@UAEXAAVCServidor@@PAVCServico@@@Z
??1CPoolServidoresL@@UAE@XZ
??1CPoolServidores@@UAE@XZ
??1CConfig@@UAE@XZ
?ExecThread@CLogThread@@UAEKXZ
??0CSockMgr@@QAE@I@Z
??0CThreadMgr@@QAE@H@Z
?ExecThread@CThreadMgr@@UAEKXZ
??0CConfig@@QAE@PBD@Z
?Root@CConfig@@QAE?AViterator@CPropertyTree@@XZ
?Get@CPropertyTree@@AAEPADPADPAUptree_node@1@@Z
??0CPollDatabase@@QAE@PBDHH@Z
?ChecaStatus@CPollDatabase@@QAEHXZ
??1CPollDatabase@@QAE@XZ
??1CElementoLista@@UAE@XZ
??1CPRecordset@@QAE@XZ
??1CFiltroServ@@UAE@XZ
??4CPagina@@QAEXAAV0@@Z
??1CContextoServidor@@UAE@XZ
?Status@CPollDatabase@@UAEXPAD@Z
??1CLog@@UAE@XZ
?InitServico@CServico@@UAEHAAVCServidor@@@Z
?NumInstancias@CServico@@UAEHXZ

format

??1CFormat@@UAE@XZ

regcript

InformaTamanhoLimpo
Decripta

consiste

??1CConsiste@@UAE@XZ

sincronismo

?FinalizaAcessoComum@CSincronismo@@QAEXXZ
?IniciaAcessoComum@CSincronismo@@QAEHK@Z
??1CSincronismo@@QAE@XZ
??0CSincronismo@@QAE@XZ

owb_0_infra_retornofornecedor

?ProcessaRetorno@Cowb_0_infra_RetornoFornecedor@@QAEHAAV?$CArray@UstDadosArq@@AAU1@@@PAVCPollDatabase@@HPAVCTrataStatus@@VCString@@@Z
??0Cowb_0_infra_RetornoFornecedor@@QAE@XZ

owb_0_infra_retornopagamento

??0Cowb_0_infra_RetornoPagamento@@QAE@XZ
?ProcessaRetorno@Cowb_0_infra_RetornoPagamento@@QAEHAAV?$CArray@UstDadosArq@@AAU1@@@PAVCPollDatabase@@HPAVCTrataStatus@@VCString@@@Z

owb_0_infra_retornocobranca

?ProcessaRetorno@Cowb_0_infra_RetornoCobranca@@QAEHAAV?$CArray@UstDadosArq@@AAU1@@@PAVCPollDatabase@@HPAVCTrataStatus@@VCString@@@Z
??0Cowb_0_infra_RetornoCobranca@@QAE@XZ

owb_0_infra_retornofolha

??0Cowb_0_infra_RetornoFolha@@QAE@XZ
?ProcessaRetorno@Cowb_0_infra_RetornoFolha@@QAEHAAV?$CArray@UstDadosArq@@AAU1@@@PAVCPollDatabase@@HPAVCTrataStatus@@VCString@@@Z

mfc42

ord715
ord6383
ord322
ord537
ord6394
ord801
ord535
ord3663
ord800
ord939
ord858
ord825
ord860
ord941
ord823
ord2818
ord2614
ord639
ord5440
ord5450
ord540

msvcrt

__set_app_type
__CxxFrameHandler
_purecall
_controlfp
_exit
_except_handler3
?terminate@@YAXXZ
_acmdln
_XcptFilter
exit
__setusermatherr
__getmainargs
_initterm
__p__fmode
_adjust_fdiv
__p__commode
_itoa

kernel32

Sleep
GetModuleHandleA
GetStartupInfoA

Exports

Exports

??0CConfig@@QAE@ABV0@@Z
??0CConsiste@@QAE@ABV0@@Z
??0CContextoServidor@@QAE@ABV0@@Z
??0CCookie@@QAE@ABV0@@Z
??0CDadosGlob@@QAE@ABV0@@Z
??0CElementoLista@@QAE@ABV0@@Z
??0CElementoPagina@@QAE@ABV0@@Z
??0CFiltroServ@@QAE@ABV0@@Z
??0CFormat@@QAE@ABV0@@Z
??0CLog@@QAE@ABV0@@Z
??0CLogThread@@QAE@ABV0@@Z
??0CPollDatabase@@QAE@ABV0@@Z
??0CPoolServidores@@QAE@ABV0@@Z
??0CPoolServidoresL@@QAE@ABV0@@Z
??0CServico@@QAE@ABV0@@Z
??0CSsField@@QAE@XZ
??0CThreadMgr@@QAE@ABV0@@Z
??0CUtilOff@@QAE@ABV0@@Z
??0CVariavel@@QAE@ABV0@@Z
??1CCookie@@QAE@XZ
??1CSsField@@UAE@XZ
??1CSsGlobal@@QAE@XZ
??1Cowb_0_infra_RetornoCobranca@@QAE@XZ
??1Cowb_0_infra_RetornoFolha@@QAE@XZ
??1Cowb_0_infra_RetornoFornecedor@@QAE@XZ
??1Cowb_0_infra_RetornoPagamento@@QAE@XZ
??4CConfig@@QAEAAV0@ABV0@@Z
??4CConsiste@@QAEAAV0@ABV0@@Z
??4CContextoServidor@@QAEAAV0@ABV0@@Z
??4CCookie@@QAEAAV0@ABV0@@Z
??4CDadosGlob@@QAEAAV0@ABV0@@Z
??4CElementoLista@@QAEAAV0@ABV0@@Z
??4CFiltroServ@@QAEAAV0@ABV0@@Z
??4CFormat@@QAEAAV0@ABV0@@Z
??4CLog@@QAEAAV0@ABV0@@Z
??4CLogThread@@QAEAAV0@ABV0@@Z
??4CPollDatabase@@QAEAAV0@ABV0@@Z
??4CPoolServidores@@QAEAAV0@ABV0@@Z
??4CPoolServidoresL@@QAEAAV0@ABV0@@Z
??4CServico@@QAEAAV0@ABV0@@Z
??4CSincronismo@@QAEAAV0@ABV0@@Z
??4CSockMgr@@QAEAAV0@ABV0@@Z
??4CThreadMgr@@QAEAAV0@ABV0@@Z
??4CUmServico@@QAEAAV0@AAV0@@Z
??4CUtilOff@@QAEAAV0@ABV0@@Z
??_7CConfig@@6B@
??_7CConsiste@@6B@
??_7CContextoServidor@@6B@
??_7CDadosGlob@@6B@
??_7CElementoLista@@6B@
??_7CElementoPagina@@6B@
??_7CFiltroServ@@6B@
??_7CFormat@@6B@
??_7CLog@@6B@
??_7CLogThread@@6B@
??_7CPollDatabase@@6B@
??_7CPoolServidores@@6B@
??_7CPoolServidoresL@@6B@
??_7CServico@@6B@
??_7CSsField@@6B@
??_7CThreadMgr@@6B@
??_7CUtilOff@@6B@
??_7CVariavel@@6B@
??_FCConfig@@QAEXXZ
??_FCPagina@@QAEXXZ
??_FCSockMgr@@QAEXXZ
??_FCThreadMgr@@QAEXXZ

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

36cd04c15c55baad3bbb6b167fdab93c

Headers

File Characteristics

Imports

owb_0_infra_tratastatus

utiloff

supserv

format

regcript

consiste

sincronismo

owb_0_infra_retornofornecedor

owb_0_infra_retornopagamento

owb_0_infra_retornocobranca

owb_0_infra_retornofolha

mfc42

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 21KB - Virtual size: 20KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 38KB - Virtual size: 38KB

.text
Size: 21KB - Virtual size: 20KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 38KB - Virtual size: 38KB