0014d79bc655ce677b452ac92f9cbdb5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0014d79bc655ce677b452ac92f9cbdb5_JaffaCakes118
Size

216KB
MD5

0014d79bc655ce677b452ac92f9cbdb5
SHA1

3aa70892c1e38b95a4c61a935a6486e5090aa82b
SHA256

91486a67624b932ec3e6b56cc8b8982dc5428990270a0d3f006d9f89f48bb1da
SHA512

3a516614d23d182fae5d94b2d9a1909f865ffd186c6a1f40e7e491ae6bf2d35f422c9f163ad64cd2c0d7a027d15e1a61de73f3cc004846e2f311b851811e47c1
SSDEEP

3072:N1BNnTnja4KwT7sRABe4ywg8Xx3gnOAhirIr70LqnAI1RbEyiSyFHfHHr:H7Tja670gZPxQnOAhisr70LqR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0014d79bc655ce677b452ac92f9cbdb5_JaffaCakes118

Files

0014d79bc655ce677b452ac92f9cbdb5_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

aabf4ba1b626d1d85b514447bb190adb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BUILD_~1\jdk6_30\control\build\WINDOW~1\tmp\deploy\plugin\jpiexp\obj\jpiexp.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
RegEnumKeyA

kernel32

GetCurrentProcessId
WaitForSingleObject
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
TlsAlloc
TlsSetValue
TlsGetValue
lstrlenA
lstrlenW
InterlockedIncrement
InterlockedDecrement
OutputDebugStringA
ResetEvent
lstrcmpiA
GetLastError
LoadLibraryA
CreateEventA
GetProcAddress
TlsFree
DisableThreadLibraryCalls
MulDiv
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
GetLongPathNameA
GetShortPathNameA
CreateFileA
GetSystemDirectoryA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
LocalFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
ExitProcess
CloseHandle
lstrcpyA
SetEvent
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
lstrcatA

user32

RegisterWindowMessageA
GetClassInfoExA
wsprintfA
LoadCursorA
GetWindowThreadProcessId
GetWindowLongA
SetWindowLongA
PostMessageA
CallWindowProcA
UnregisterClassA
SetPropA
RemovePropA
SetWindowsHookExA
IsChild
UnhookWindowsHookEx
GetPropA
IsIconic
IsWindowVisible
BringWindowToTop
SetForegroundWindow
CallNextHookEx
CharNextA
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
FillRect
GetClientRect
GetDC
ReleaseDC
UnionRect
PtInRect
SendMessageA
CreateWindowExA
GetKeyState
RegisterClassExA
EnumThreadWindows
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
InvalidateRect
GetFocus
SetFocus
EnableWindow
GetParent
BeginPaint
EndPaint
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
PeekMessageA
DefWindowProcA

ole32

StringFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoTaskMemFree
OleRegGetMiscStatus
CoCreateInstance
OleRun

oleaut32

SysAllocStringByteLen
SysStringByteLen
OleCreatePropertyFrame
SysStringLen
VariantChangeType
SysAllocString
GetErrorInfo
DispCallFunc
VariantClear
VariantInit
SysFreeString
VarUI4FromStr

msvcr71

_wcsnicmp
__security_error_handler
__CppXcptFilter
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
memset
getenv
_stricmp
_splitpath
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcsncpy
memmove
??_U@YAPAXI@Z
_resetstkoflw
malloc
_local_unwind2
??2@YAPAXI@Z
wcslen
realloc
sprintf
__CxxFrameHandler
_CxxThrowException
_purecall
??_V@YAXPAX@Z
??3@YAXPAX@Z
free
_except_handler3

gdi32

DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
GetStockObject
CreateRectRgnIndirect
RestoreDC

Exports

Exports

?Equals@CJSObject@@CGJPAUJNIEnv_@@PAV_jobject@@JJJ@Z
?GetDispType@CJSObject@@CGPAV_jstring@@PAUJNIEnv_@@PAV_jobject@@JJ@Z
?GetStub@CJSObject@@CGPAV_jobject@@PAUJNIEnv_@@PAV2@J@Z
?InvokeStub@CJSObject@@CGPAV_jobject@@PAUJNIEnv_@@PAV2@JPAV_jstring@@JPAV_jobjectArray@@JJ@Z
?Java_sun_plugin_services_WIExplorerBrowserService_installBrowserListener@@YGEPAUJNIEnv_@@PAV_jobject@@@Z
?ReleaseStub@CJSObject@@CGXPAUJNIEnv_@@PAV_jobject@@JJ@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_Java_sun_plugin_com_DispatchImpl_getWindowHandle@12
_Java_sun_plugin_services_WPlatformService_createEvent@8
_Java_sun_plugin_services_WPlatformService_deleteEvent@12
_Java_sun_plugin_services_WPlatformService_dispatchNativeEvent@8
_Java_sun_plugin_services_WPlatformService_signalEvent@12
_Java_sun_plugin_services_WPlatformService_waitEvent@28
_Java_sun_plugin_viewer_IExplorerAppletStatusListener_notifyStatusChange@16
_Java_sun_plugin_viewer_context_IExplorerAppletContext_nativeInvokeScript@24
_Java_sun_plugin_viewer_frame_IExplorerEmbeddedFrame_activateBrowserWindow@12
_Java_sun_plugin_viewer_frame_IExplorerEmbeddedFrame_enableModeless@24
_Java_sun_plugin_viewer_frame_IExplorerEmbeddedFrame_transferFocus@16

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aabf4ba1b626d1d85b514447bb190adb

Headers

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

ole32

oleaut32

msvcr71

gdi32

Exports

Exports

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 112KB - Virtual size: 109KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 112KB - Virtual size: 109KB

.reloc
Size: 8KB - Virtual size: 6KB