fdffe1f7f995f68af9a7313355defb23_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fdffe1f7f995f68af9a7313355defb23_JaffaCakes118
Size

217KB
MD5

fdffe1f7f995f68af9a7313355defb23
SHA1

2312ae845c4c4275762dfea9f10d8bf480da3fd7
SHA256

aba4605a66cc2f5bd57472838a611ccc6413394ee3e0d52a3d7d1ff80203e497
SHA512

f0a02fb17d89515064a944bda9e48a316a2c4321511a3680e4d062b526fdab2e12d658767396d15c8d93eedec17ff6bc6446df093e21af58f4d80893b25826b1
SSDEEP

3072:M1yqUZ0kDWuLk1zLbeu/FiVOWhLKGBSdkppDS+cMiYlaGJHnpEtFkBR:qyqU0eMb8OWhKGBSixTfJHpESR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdffe1f7f995f68af9a7313355defb23_JaffaCakes118

Files

fdffe1f7f995f68af9a7313355defb23_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

5c09ad44b6f0ad33c07480451b4e61ab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\ZB6\Workspace\ZBEX6_3_1_8\zbr\Src\ImageTasks\ZbImageTaskInsertText\ReleaseMinDependency\Symbols\ZbImageTaskInsertText.pdb

Imports

msvcr80

_except_handler4_common
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
memmove_s
iswspace
wcsstr
towlower
__clean_type_info_names_internal
_crt_debugger_hook
_CxxThrowException
_except_handler3
memset
__CxxFrameHandler3
_adjust_fdiv
_amsg_exit
_initterm_e
memcpy
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
?terminate@@YAXXZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
wcsncmp
_itow_s
_wtoi
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_purecall
??2@YAPAXI@Z
_recalloc
free
wcscpy_s
wcscat_s
wcsncpy_s
_set_sbh_threshold
malloc
swprintf_s
_wcsicmp
wcschr
memcpy_s
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??3@YAXPAX@Z

comctl32

ImageList_LoadImageW
ImageList_Create
ImageList_AddMasked
ImageList_Destroy

imm32

ImmAssociateContext

kernel32

GetVersionExA
CreateProcessW
GetACP
GetLocaleInfoA
GetVersionExW
lstrlenW
FreeLibrary
lstrcmpiW
MultiByteToWideChar
LoadLibraryExW
GetModuleHandleW
DisableThreadLibraryCalls
GetLastError
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
RaiseException
EnterCriticalSection
InitializeCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
DeleteCriticalSection
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
MulDiv
GetUserDefaultLCID
LoadLibraryW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
lstrcpynW
SetLastError
GetCurrentThreadId
lstrcmpW
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetProcessHeap
HeapAlloc
GetThreadLocale
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress

user32

GetSysColor
EnableWindow
PostMessageW
IsDlgButtonChecked
ReleaseDC
GetDC
SetFocus
CheckDlgButton
GetWindowTextW
TrackPopupMenu
GetSubMenu
LoadMenuW
BeginPaint
ScreenToClient
SetCursor
LoadBitmapW
UnionRect
MessageBoxW
CharNextW
SendMessageW
SetWindowTextW
UnregisterClassA
LoadStringW
GetWindowTextLengthW
EndPaint
DialogBoxParamW
EndDialog
SetWindowPos
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
SetRectEmpty
EqualRect
FillRect
RedrawWindow
GetDlgItem
GetWindowRect
LoadIconW
SetCapture
GetCapture
MapWindowPoints
DefWindowProcW
ReleaseCapture
GetClientRect
LoadCursorW
IsRectEmpty
GetWindowLongW
CallWindowProcW
GetSysColorBrush
FrameRect
GetSystemMetrics
DrawFrameControl
InvalidateRect
IsWindow
DrawFocusRect
OffsetRect
InflateRect
CopyRect
GetParent
SetWindowLongW
GetCursorPos

gdi32

SetTextColor
CreateRectRgn
SelectClipRgn
CreatePen
SetBkMode
EnumFontFamiliesExW
Rectangle
MoveToEx
LineTo
GetStockObject
GdiFlush
SetWindowOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
SetBkColor
SelectObject
DeleteObject
GetOutlineTextMetricsW
ExtTextOutW
GetObjectW
CreateCompatibleDC
CreateFontIndirectW
GetTextExtentPoint32W
SetROP2

comdlg32

ChooseColorW

advapi32

RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CLSIDFromProgID

oleaut32

SysAllocStringByteLen
VarBstrCmp
VarBstrCat
SysStringByteLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
SysStringLen
SysFreeString

zbui_utils

?ZBUI_CompositeDisabledToolbar@@YAHPAUHBITMAP__@@@Z

zbui_controlsatl

??1CZBUI_ZoomSliderCtrl@@UAE@XZ
?SetRange@?$CTrackBarCtrlT@VCWindow@ATL@@@ATLControls@@QAEXHHH@Z
?SubclassWindow@?$CWindowImplBaseT@V?$CTrackBarCtrlT@VCWindow@ATL@@@ATLControls@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@QAEHPAUHWND__@@@Z
??0CZBUI_ZoomSliderCtrl@@QAE@XZ
?GetPos@?$CTrackBarCtrlT@VCWindow@ATL@@@ATLControls@@QBEHXZ
?SetPos@?$CTrackBarCtrlT@VCWindow@ATL@@@ATLControls@@QAEXH@Z
?UnsubclassWindow@?$CWindowImplBaseT@V?$CTrackBarCtrlT@VCWindow@ATL@@@ATLControls@@V?$CWinTraits@$0FGAAAAAA@$0A@@ATL@@@ATL@@QAEPAUHWND__@@H@Z

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IBEPBDXZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c09ad44b6f0ad33c07480451b4e61ab

Headers

File Characteristics

PDB Paths

Imports

msvcr80

comctl32

imm32

kernel32

user32

gdi32

comdlg32

advapi32

ole32

oleaut32

zbui_utils

zbui_controlsatl

msvcp80

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 73KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 64KB - Virtual size: 75KB

.rsrc Size: 42KB - Virtual size: 42KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 73KB - Virtual size: 73KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 64KB - Virtual size: 75KB

.rsrc
Size: 42KB - Virtual size: 42KB

.reloc
Size: 6KB - Virtual size: 5KB