3dd69985748028edbf3ec4bea8d14f62_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3dd69985748028edbf3ec4bea8d14f62_JaffaCakes118
Size

92KB
MD5

3dd69985748028edbf3ec4bea8d14f62
SHA1

4bec42192e25b731dc250091fc36cc9b01eb9ccb
SHA256

ba5df7b147ff750b9ca9020fd782e933d3b2aeb90650b9517468e5bd4ea402d7
SHA512

91d2174a9f9d2bd4384314192208314c197fd9cb2a50ebfeeffa3d8c2579e6dbefefce0ff21c40e701674d6839240cb0701486ca773a1f01f0cdc3abcb4d69a1
SSDEEP

1536:BD2H8z60NtpH7fozmF4YI55qKlLOWJOWjxX9Lqa5:gHANHADDmaBLxxq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3dd69985748028edbf3ec4bea8d14f62_JaffaCakes118

Files

3dd69985748028edbf3ec4bea8d14f62_JaffaCakes118
.dll windows:1 windows x86 arch:x86

599619865801f1fd4498891314648257

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

FindWindowA
MessageBoxA

kernel32

ExitProcess
GetVersion
SetHandleCount
GetModuleHandleA
FindResourceA
LoadResource
LockResource
GetStartupInfoA
GetCommandLineA
GetProcAddress
LoadLibraryA
FreeLibrary
GetUserDefaultLCID
GetLocaleInfoA
GetModuleFileNameA
GetEnvironmentVariableA

vo28run

RTInit
RTExit
SysAddAtom
CreateAtomTable
AtomInit
MemInit
MemAlloc
__ConvertResult
_GetRTCount
LabelPush
LabelPop
LabelJump
__NotifyUnload
INCKidStackPtr
DECKidStackPtr
__chkstk
_S2P
_VODBErrInfoPtr
MemCopy
ErrorBlock
VODBCloseArea
_P2Logic
__chkstk
LabelJump
VODBEof
FCount
VODBFieldGet
AsString
SLen
MemSet
_GSMF
IsNil
_CCS
VODBRecordGet
Psz2String
VODBRecordPut
VODBGoTop
SetYield
_RegisterExit
VODBSkip
Upper
ArrayBuild
At
_NCARG
IsArray
IsString
_P2String
_PASS
_PDE_REF
Trim
Empty
_P2DW
VODBRDDInfo
_P2Array
UpperA
_PEQ_REF
_SSP
AAdd
UsualType
ALen
_DW2T
_ArrayGetCollection
SubStr3
At3
SubStr2
_P2Psz
SysAddAtomUpperA
CompString
File
VODBUseArea
Used
VODBAppend
VODBBof
VODBClearRelation
VODBCommit
VODBDeleted
VODBFound
VODBFieldInfo
VODBFlock
VODBGoBottom
VODBGoto
VODBInfo
VODBLastRec
VODBPack
VODBRddName
VODBRddSetDefault
VODBRecno
_P2L
VODBRlock
VODBUnlock
VODBZap
Left
Val
Psz2Float
SToD
_CPSE
VODBSeek
MemClear
StrZero
Min
_P2Ptr
FieldName
VODBFieldPut
FieldPosSym
FieldSym
Chr
RAt
SubStr
VODBMemoExt
FCopy
VODBCreate
VODBGetSelect
Cast2Psz
CreateInstance
IsPtr
ArrayCreate
Max
ArrayInit
ErrorBuild
GetDASPtr
ProcFile
ProcName
ProcLine
NTrim
Right
_P2Symbol
Eval
_PGenRef
Default
SetExclusive
_SAP
_SLOP
MemFree
_PUE
VODBSetSelect
NetErr
FieldPos
ValType
_PGT_REF
_PUE_REF
_P2Date
DToC
Integer
_SWP
VODBCloseAll
VODBAlias
VODBBuffRefresh
VODBClearFilter
VODBFilter
Evaluate
VODBSetFilter
VODBClearScope
VODBLocate
VODBSetLocate
VODBCommitAll
VODBContinue
VODBDelete
VODBRddCount
VODBRddList
VODBRecall
VODBRecordInfo
VODBRelation
VODBSetRelation
VODBRSelect
VODBSelect
VODBSetFound
VODBSort
VODBTrans
VODBTransRec
VODBUnlockAll
VODBOrdBagExt
VODBOrdCondSet
VODBOrdDestroy
VODBOrdListClear
VODBOrdListRebuild
VODBOrdSetFocus
PszLen
VODBOrdListAdd
Type
DynToOldSpace
AsPsz
_GetStringDXAX
VODBOrdCreate
VODBOrderInfo
SysGetAtomName
SetFixed
SetDecimal
GetDateFrmt
SetEpoch
VOGetPath
GetDefault
SetSoftSeek
SetUnique
SetDeleted
SetAnsi
_SetIntl
_SetDict
_PEQ
PCount
SetDecimalSep
SetThousandSep
SetTimeSep
_P2S
SetAmPm
SetAMExt
SetPMExt
_P2I
_INSTR
SetDateFrmt
SetCentury
_CPPSZ
CToD
SetHPLock
VOSetPath
SetDefault
MemoTran
PadR
PadR
PadL
PadC
SubStr
_Str
_TypeErrorGen
Space
_PAD_REF
_DebOut32
_GetFParam
_PAD
Abs
AllTrim
Asc
At
CDoW
CMonth
Day
Descend
DoW
DToS
HardCR
IsAlpha
IsDigit
IsLower
IsUpper
Len
LOG
Lower
LTrim
MemoLine
MLCount
Month
Rand
Replicate
Round
SQRT
StrTran
Stuff
Time
Today
Year
DeclareClass
IsNumeric
_ExecName
DeclareMethod
CBRTInit
CBRTEval
ErrorFunc
_P2Object
IsInstanceOf
IVarGet
IVarPut
_PDE
ErrString
Symbol2String
TypeString
IVarGetInfo
SetBeep
Tone
CanBreak
SetErrorLog
WorkDir
FOpen2
FSeek3
FPutS3
FCreate2
FError
GetDefaultDir
SetDefaultDir
_IError
FPutS
Version
voflFloatNull_RT
_P2T
__Str
_PGT
_W2T
_PLS
_L2T
_Hex
_T2DW
_HexByte
FClose
ErrorMessageBox
EmptyUsual
MathInit
ErrorLevel
_Quit
__CollectPublics
FieldGetAlias
FieldPutAlias
_SendSelf
_ArrayPutCollection
_GAS
uiLineNum_RT
Send
_PAS
ArrayGet
ADel
_CallClipFunc
ArrayPut
IsSymbol
String2Symbol
IsClass
AIns
_SendClassParams
_GetInst

cavoadam

_PrjGetString@24

Exports

Exports

FldConvert
ForceLink
StartupCavoRddB
TransferRecords
__VODLLClassInit
_voAddAtom
_voGetAtomName
_voGetSet
_voSet
_voSetInternational
_vodbAlias
_vodbAppend
_vodbBof
_vodbBuffRefresh
_vodbClearCondition
_vodbClearFilter
_vodbClearLocate
_vodbClearRelation
_vodbCloseAll
_vodbCloseArea
_vodbCommit
_vodbCommitAll
_vodbContinue
_vodbCreate
_vodbCreateIndex
_vodbDelete
_vodbDeleted
_vodbEof
_vodbExit
_vodbFcount
_vodbFieldGet
_vodbFieldGetSym
_vodbFieldInfo
_vodbFieldNames
_vodbFieldPosSym
_vodbFieldPut
_vodbFieldPutSym
_vodbFieldStruct
_vodbFieldSym
_vodbFilter
_vodbFlock
_vodbFound
_vodbGetBuffer
_vodbGetLastError
_vodbGetSelect
_vodbGoBottom
_vodbGoTo
_vodbGoTop
_vodbInfo
_vodbInit
_vodbLastRec
_vodbLocate
_vodbOrdBagExt
_vodbOrdCondSet
_vodbOrdCreate
_vodbOrdDestroy
_vodbOrdListAdd
_vodbOrdListClear
_vodbOrdListRebuild
_vodbOrdSetFocus
_vodbOrderField
_vodbOrderInfo
_vodbOrderNumber
_vodbPack
_vodbRDDSetDefault
_vodbRSelect
_vodbRddCount
_vodbRddList
_vodbRddName
_vodbRecall
_vodbRecno
_vodbRecordGet
_vodbRecordInfo
_vodbRecordPut
_vodbRelation
_vodbRlock
_vodbSeek
_vodbSelect
_vodbSetFilter
_vodbSetFound
_vodbSetIndex
_vodbSetLocate
_vodbSetOrder
_vodbSetRelation
_vodbSetSelect
_vodbSkip
_vodbSort
_vodbStruct
_vodbTrans
_vodbTransRec
_vodbUnlock
_vodbUnlockAll
_vodbUse
_vodbUsed
_vodbZap

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

599619865801f1fd4498891314648257

Headers

File Characteristics

Imports

user32

kernel32

vo28run

cavoadam

Exports

Exports

Sections

.text Size: 63KB - Virtual size: 63KB

.data Size: 11KB - Virtual size: 11KB

.idata Size: 7KB - Virtual size: 7KB

.edata Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 63KB - Virtual size: 63KB

.data
Size: 11KB - Virtual size: 11KB

.idata
Size: 7KB - Virtual size: 7KB

.edata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB