General

Malware Config

Signatures

Files

• ffce1494f2991769c263191c86bb5c8c_JaffaCakes118

  .exe regsvr32 windows:4 windows x86 arch:x86

  7757df96a551166841030b8c155efa55

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetModuleHandleW

  GetPrivateProfileIntW

  GetPrivateProfileSectionW

  GetPrivateProfileStringA

  GetPrivateProfileStringW

  GetProcAddress

  GetProcessHeap

  GetSystemDefaultUILanguage

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetTickCount

  GetUserDefaultUILanguage

  GetVersion

  GetVersionExA

  GetVersionExW

  GetWindowsDirectoryW

  GlobalFree

  HeapAlloc

  HeapFree

  InitializeCriticalSectionAndSpinCount

  InterlockedCompareExchange

  InterlockedDecrement

  InterlockedExchange

  IsDBCSLeadByte

  LeaveCriticalSection

  LoadLibraryA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalAlloc

  LocalFree

  GetModuleFileNameW

  LockResource

  MapViewOfFile

  MoveFileExW

  MoveFileW

  MultiByteToWideChar

  OpenEventW

  OutputDebugStringA

  OutputDebugStringW

  QueryPerformanceCounter

  ReadFile

  RemoveDirectoryW

  ResumeThread

  RtlUnwind

  SearchPathW

  SetFileAttributesW

  SetFilePointer

  SetLastError

  SetUnhandledExceptionFilter

  SizeofResource

  Sleep

  TerminateProcess

  UnhandledExceptionFilter

  UnmapViewOfFile

  WaitForSingleObject

  WideCharToMultiByte

  WriteFile

  WritePrivateProfileStringW

  lstrcmpW

  lstrcmpiA

  lstrlenA

  lstrlenW

  GetLocaleInfoW

  GetLocalTime

  GetLastError

  GetFileSize

  GetFileAttributesW

  GetFileAttributesExW

  GetExitCodeThread

  GetCurrentThreadId

  GetCurrentProcessId

  GetCurrentProcess

  GetComputerNameW

  FreeLibrary

  FlushFileBuffers

  FindResourceW

  FindResourceExW

  FindNextFileW

  FindFirstFileW

  FindClose

  FileTimeToSystemTime

  ExpandEnvironmentStringsW

  EnumUILanguagesW

  EnterCriticalSection

  DisableThreadLibraryCalls

  DeleteFileW

  DeleteCriticalSection

  CreateThread

  CreateFileW

  CreateFileMappingW

  CreateDirectoryW

  CopyFileW

  CompareStringW

  CompareStringA

  LocalReAlloc

  CloseHandle

  user32

  MsgWaitForMultipleObjects

  PeekMessageW

  PostMessageW

  SendDlgItemMessageW

  SendMessageTimeoutW

  SetCursor

  SetTimer

  TranslateMessage

  LoadStringW

  LoadImageW

  KillTimer

  GetWindow

  GetTopWindow

  GetSystemMetrics

  GetMessageW

  GetClassNameA

  EndDialog

  DispatchMessageW

  DialogBoxParamW

  DestroyIcon

  CharNextW

  CharLowerW

  LoadCursorW

  advapi32

  RegOpenKeyExW

  EnumServicesStatusExW

  DuplicateTokenEx

  CreateProcessAsUserW

  CopySid

  ConvertStringSidToSidW

  CloseServiceHandle

  AllocateAndInitializeSid

  AdjustTokenPrivileges

  RegQueryInfoKeyW

  RegQueryValueExA

  RegQueryValueExW

  RegSaveKeyW

  RegSetValueExW

  RevertToSelf

  SetFileSecurityW

  SetSecurityDescriptorOwner

  GetLengthSid

  GetTokenInformation

  ImpersonateLoggedOnUser

  InitializeSecurityDescriptor

  LookupPrivilegeNameW

  LookupPrivilegeValueW

  OpenProcessToken

  OpenSCManagerW

  RegCloseKey

  RegCreateKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumKeyW

  RegEnumValueW

  RegOpenKeyExA

  FreeSid

  shlwapi

  StrTrimW

  StrToIntW

  StrToIntExW

  StrStrW

  ChrCmpIA

  PathAddBackslashW

  PathAddExtensionW

  PathAppendW

  PathCombineW

  PathFileExistsW

  PathFindExtensionW

  PathFindFileNameW

  PathFindNextComponentW

  PathGetCharTypeW

  PathGetDriveNumberW

  PathIsDirectoryW

  PathIsFileSpecW

  PathIsPrefixW

  PathIsRootW

  PathIsUNCServerW

  PathIsURLW

  PathRemoveBackslashW

  PathRemoveBlanksW

  PathRemoveExtensionW

  PathRemoveFileSpecW

  PathRenameExtensionW

  PathSkipRootW

  PathUnquoteSpacesW

  SHDeleteEmptyKeyW

  SHDeleteKeyW

  SHDeleteValueW

  SHGetValueW

  StrStrIW

  SHSetValueW

  StrChrIW

  StrChrW

  StrCmpIW

  StrCmpNIW

  StrCmpNW

  StrCmpW

  StrDupW

  StrRChrW

  StrRetToStrW

  StrSpnW

  SHQueryValueExW

  ole32

  StringFromGUID2

  CreateBindCtx

  CoUninitialize

  CoTaskMemRealloc

  CoTaskMemFree

  CoTaskMemAlloc

  CoInitializeEx

  CoCreateInstance

  CoCreateGuid

  oleaut32

  VariantInit

  SysStringByteLen

  VariantCopy

  VariantClear

  VariantChangeType

  SysStringLen

  SafeArrayAccessData

  SafeArrayCreate

  SafeArrayDestroy

  SafeArrayPutElement

  SafeArrayUnaccessData

  SysAllocString

  SysAllocStringByteLen

  SysFreeString

  shell32

  SHGetDesktopFolder

  ShellExecuteExW

  SHChangeNotify

  setupapi

  SetupCloseInfFile

  SetupFindFirstLineW

  SetupFindNextLine

  SetupGetBinaryField

  SetupGetIntField

  SetupGetLineTextW

  SetupGetStringFieldW

  SetupOpenInfFileW

  Exports

  Exports

  ADsBuildEnumerator

  ADsBuildVarArrayInt

  ADsBuildVarArrayStr

  ADsDecodeBinaryData

  ADsEncodeBinaryData

  ADsEnumerateNext

  ADsFreeEnumerator

  ADsGetLastError

  ADsGetObject

  ADsOpenObject

  ADsSetLastError

  AdsFreeAdsValues

  AdsTypeToPropVariant

  AdsTypeToPropVariant2

  AllocADsMem

  AllocADsStr

  BinarySDToSecurityDescriptor

  ConvertSecDescriptorToVariant

  ConvertSecurityDescriptorToSecDes

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  FreeADsMem

  FreeADsStr

  PropVariantToAdsType

  PropVariantToAdsType2

  ReallocADsMem

  ReallocADsStr

  SecurityDescriptorToBinarySD

  Sections

  .text

  Size: 72KB - Virtual size: 72KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 116KB - Virtual size: 116KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 112KB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 32KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ