General

Malware Config

Signatures

Files

• eafd7686bd1c75a1e42f6de0588a88ed_JaffaCakes118

  .exe regsvr32 windows:4 windows x86 arch:x86

  341e840e027b01535119e0a77d108731

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  LocalFree

  LockResource

  MapViewOfFile

  MoveFileExW

  MoveFileW

  MulDiv

  MultiByteToWideChar

  OpenFileMappingW

  OpenMutexW

  OpenProcess

  QueryDosDeviceW

  ReadFile

  ReleaseMutex

  ResetEvent

  SetCurrentDirectoryW

  SetEndOfFile

  SetErrorMode

  SetEvent

  SetFileAttributesW

  LocalAlloc

  SetLastError

  SetThreadPriority

  SizeofResource

  Sleep

  TerminateThread

  UnmapViewOfFile

  VirtualAlloc

  VirtualFree

  WaitForMultipleObjects

  WaitForSingleObject

  WideCharToMultiByte

  WriteFile

  WritePrivateProfileSectionW

  WritePrivateProfileStringW

  lstrcmpA

  lstrcpynW

  lstrlenA

  lstrlenW

  LoadResource

  LoadLibraryW

  LoadLibraryA

  LeaveCriticalSection

  InterlockedIncrement

  InterlockedDecrement

  InitializeCriticalSection

  HeapAlloc

  GetWindowsDirectoryW

  CloseHandle

  GetVersionExW

  GetVersion

  GetTickCount

  GetTempPathW

  GetTempFileNameW

  GetSystemTimeAsFileTime

  GetSystemTime

  GetStartupInfoW

  GetShortPathNameW

  GetProcessHeap

  GetProcAddress

  GetPrivateProfileStringW

  GetPrivateProfileSectionW

  GetModuleHandleW

  GetModuleHandleA

  GetModuleFileNameW

  GetLogicalDrives

  GetLogicalDriveStringsW

  GetLocalTime

  GetLastError

  GetFullPathNameW

  GetFileSize

  GetFileAttributesW

  GetDriveTypeW

  GetCurrentThreadId

  GetCurrentThread

  GetCurrentProcessId

  GetCurrentProcess

  GetCurrentDirectoryW

  GetCommandLineW

  FreeLibrary

  FindResourceW

  FindNextFileW

  FindFirstFileW

  FindClose

  FileTimeToSystemTime

  EnterCriticalSection

  DuplicateHandle

  DeviceIoControl

  DeleteFileW

  DeleteCriticalSection

  CreateThread

  CreateMutexW

  CreateFileW

  CreateFileMappingW

  CreateFileA

  CreateEventW

  CreateDirectoryW

  CopyFileW

  SetFilePointer

  user32

  SetActiveWindow

  SendMessageW

  ScreenToClient

  ReleaseDC

  RegisterWindowMessageW

  PtInRect

  PostMessageW

  PeekMessageW

  MsgWaitForMultipleObjects

  MessageBoxW

  MessageBeep

  LoadStringW

  LoadMenuW

  LoadImageW

  LoadIconW

  KillTimer

  IsWindowEnabled

  IsWindow

  IsIconic

  SetCursor

  GetWindowRect

  GetWindowLongW

  GetWindow

  GetSystemMetrics

  GetSystemMenu

  GetSysColor

  GetSubMenu

  GetParent

  GetForegroundWindow

  GetFocus

  GetDC

  GetCursorPos

  GetClientRect

  GetClassNameW

  GetActiveWindow

  ExitWindowsEx

  EnumChildWindows

  EnableWindow

  EnableMenuItem

  SetForegroundWindow

  SetTimer

  TranslateMessage

  UpdateWindow

  InvalidateRect

  DrawIcon

  DrawFocusRect

  DispatchMessageW

  CopyRect

  AppendMenuW

  FillRect

  gdi32

  StretchBlt

  RealizePalette

  GetObjectW

  GetDeviceCaps

  CreateCompatibleDC

  CreateDIBitmap

  CreateFontIndirectW

  CreateHalftonePalette

  CreateICW

  CreatePalette

  DeleteDC

  DeleteObject

  GetDIBColorTable

  advapi32

  OpenSCManagerW

  RegOpenKeyExA

  RegOpenKeyA

  RegEnumValueW

  RegEnumKeyW

  SetThreadToken

  SetSecurityDescriptorDacl

  RevertToSelf

  RegSetValueExW

  RegSetValueExA

  RegQueryValueExW

  RegQueryValueExA

  RegQueryInfoKeyW

  AdjustTokenPrivileges

  AllocateAndInitializeSid

  CloseServiceHandle

  DeleteService

  DuplicateToken

  EqualSid

  FreeSid

  GetSecurityDescriptorDacl

  GetSidLengthRequired

  GetSidSubAuthority

  GetTokenInformation

  InitializeSecurityDescriptor

  InitializeSid

  LookupPrivilegeValueW

  OpenProcessToken

  RegEnumKeyExW

  OpenServiceW

  OpenThreadToken

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyA

  RegDeleteKeyW

  RegDeleteValueA

  RegDeleteValueW

  RegEnumKeyExA

  RegOpenKeyExW

  shell32

  SHGetMalloc

  SHGetFileInfoW

  SHGetDesktopFolder

  SHBrowseForFolderW

  SHGetPathFromIDListW

  comctl32

  ImageList_DrawEx

  ImageList_GetImageCount

  ImageList_ReplaceIcon

  ImageList_Draw

  ImageList_SetOverlayImage

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  SetInputScope

  SetInputScopeXML

  SetInputScopes

  TF_CUASAppFix

  TF_CheckThreadInputIdle

  TF_ClearLangBarAddIns

  TF_CreateCategoryMgr

  TF_CreateCicLoadMutex

  TF_CreateDisplayAttributeMgr

  TF_CreateInputProcessorProfiles

  TF_CreateLangBarItemMgr

  TF_CreateLangBarMgr

  TF_CreateThreadMgr

  TF_DllDetachInOther

  TF_GetGlobalCompartment

  TF_GetInputScope

  TF_GetLangIcon

  TF_GetMlngHKL

  TF_GetMlngIconIndex

  TF_GetThreadFlags

  TF_GetThreadMgr

  TF_InatExtractIcon

  TF_InitMlngInfo

  TF_InitSystem

  TF_InvalidAssemblyListCache

  TF_InvalidAssemblyListCacheIfExist

  TF_IsCtfmonRunning

  TF_IsFullScreenWindowAcitvated

  TF_IsInMarshaling

  TF_MlngInfoCount

  TF_PostAllThreadMsg

  TF_RegisterLangBarAddIn

  TF_RunInputCPL

  TF_UninitSystem

  TF_UnregisterLangBarAddIn

  Sections

  .text

  Size: 236KB - Virtual size: 236KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 48KB - Virtual size: 48KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ