0f4191cca90961b5d3b0ee9995f1332f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0f4191cca90961b5d3b0ee9995f1332f_JaffaCakes118
Size

159KB
MD5

0f4191cca90961b5d3b0ee9995f1332f
SHA1

682892fb4fd2bbf97d1a41d84493e7e360996045
SHA256

db2c468704d4ec815482c2754b38fb27be338c91b70aa2a77c277433ab066126
SHA512

56b7af2496ead53eb5d2067da2bd1543190461490fdf7cc83f53d0bdde7a11ac5ef4d7a434071bd306f9542cb5702f72f1881a9242fcb8041489401a3df5d836
SSDEEP

3072:ov10XxE9Zy/snmZdSW/pxm11WSk0a7soBdPll9Jch:yOy9ZUsnmzmHxk0a7ssdPla

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f4191cca90961b5d3b0ee9995f1332f_JaffaCakes118

Files

0f4191cca90961b5d3b0ee9995f1332f_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

a2508574f7f0149fcfb62e4eff1b0151

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

IsWindow
SendMessageA
CreateWindowExA

kernel32

GetTickCount
Sleep
WinExec
LoadLibraryA
GetProcAddress
lstrcpyA

msvcrt

_initterm
_adjust_fdiv
_strrev
_strcmpi
_itoa
calloc
_beginthreadex
wcsstr
time
localtime
strftime
wcstombs
_ultoa
_errno
atoi
sprintf
strncmp
strncpy
strrchr
_except_handler3
free
malloc
strchr
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
ceil
memmove
??3@YAXPAX@Z
??1type_info@@UAE@XZ
wcscpy
_strnicmp

ws2_32

gethostname
__WSAFDIsSet
recvfrom
sendto
bind
getsockname
ntohs
inet_addr
inet_ntoa
send
closesocket
recv
select
socket
gethostbyname
connect
setsockopt
WSACleanup
WSAStartup
htons

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z

msvcirt

?write@ostream@@QAEAAV1@PBDH@Z
??0fstream@@QAE@XZ
?open@fstream@@QAEXPBDHH@Z
?read@istream@@QAEAAV1@PADH@Z
?close@fstream@@QAEXXZ
??1fstream@@UAE@XZ
??_Dfstream@@QAEXXZ
??0ofstream@@QAE@XZ
??_Dofstream@@QAEXXZ
??1ios@@UAE@XZ
??1ofstream@@UAE@XZ
?close@ofstream@@QAEXXZ
?open@ofstream@@QAEXPBDHH@Z
?openprot@filebuf@@2HB

Exports

Exports

AlphaBlend
BeginUpdate2
ConnectionAccept
ConnectionClose
ConnectionInitAsync
ConnectionListen
ConnectionObjectSize
ConnectionPeek
ConnectionRead
ConnectionReadAsync
ConnectionVer
ConnectionWrite
ConnectionWriteAsync
ConnectionWriteStatus
CreateMxPsObj
CreateMxPwObj
CreateMxSkObj
DeleteMxPsObj
DeleteMxPwObj
DeleteMxSkObj
Detoured
DllCanUnloadNow
DllGetClassObject
DllInitialize
DllRegisterServer
DllUnregisterServer
EnterThisPlease
FreeUnzipBuf
GetDllVersionA
GetGameZipPtr
GetModuleVersion
GetProductVersion
GradientFill
InstallCrashReport
Main
PrepareUnzipFile
QGMessageBox
QGMessageBoxA
QGMessageBoxB
QGMessageBoxC
QGMessageBoxD
QGMessageBoxE
QGMessageBoxEx
QGMessageBoxURLWithClick
QGShowGIF
QQExceptionFilter
RD_XXXX
SetHTTPControl
SetProperty
SetZipLevel
SoDAShareCommitFile
SoDAShareEditID3
SoDAShareFinish
SoDAShareGetIPCPort
SoDAShareSetID3
SoDAShareSetID3Path
SoDAShareSetRegPath
SoDAShareSetUserID
SoDAShareStart
TransparentBlt
UnZip
UnZipEx
UnZipFile
ZipFolder
ZipFolderEx
_main@4
comdl2
comdl3
hime
mp_dc
mp_gt
mp_gv
mp_ms
mp_pf
mp_pl
mp_ps
mp_rd
run
vSetDdrawflag

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2508574f7f0149fcfb62e4eff1b0151

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

ws2_32

msvcp60

msvcirt

Exports

Exports

Sections

.text Size: 114KB - Virtual size: 113KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 22KB - Virtual size: 25KB

.rsrc Size: 1024B - Virtual size: 976B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 114KB - Virtual size: 113KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 22KB - Virtual size: 25KB

.rsrc
Size: 1024B - Virtual size: 976B

.reloc
Size: 8KB - Virtual size: 8KB