18b48e3f8deec8f20ac8ee67cab5bb11_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

18b48e3f8deec8f20ac8ee67cab5bb11_JaffaCakes118
Size

1.4MB
MD5

18b48e3f8deec8f20ac8ee67cab5bb11
SHA1

c06490cb19ccce30c154c335c79ed0a01a9357ff
SHA256

465bedf40db4a0b3925a0de10b743d26ae7776eca29db7928011101025fcc894
SHA512

54e35a9900bafa77dbecb6d90e31966fa092fa34506f1d07eabc9fcc511397875afdb67a4680f99f17819c470f34ca2154ffa5ba8dadc30993244a2047e8701a
SSDEEP

24576:y0WnqaqYvWg86aVJCpJ1B8bOpmfsLeA1xCArWZpyczCrdpxxf905Led:y7lqYP8PVaJ1aNfPAn6yczCr7z905LC

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AmlMaple.dll
unpack001/AmlMaple.exe
unpack001/FlgCrt.dll

Files

18b48e3f8deec8f20ac8ee67cab5bb11_JaffaCakes118
.zip
AmlMaple.dll
.dll windows:4 windows x86 arch:x86

d959285c6e5aac756e7471bfb19e2137

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
LoadLibraryA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
GetVersionExA
lstrcmpA
lstrlenA
VirtualProtect
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentThreadId
GetModuleFileNameA
GetLocaleInfoA
FreeLibrary
GetCurrentProcess
WriteProcessMemory
VirtualQuery
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
GetProcAddress
GetSystemInfo
IsBadReadPtr
GetModuleHandleA

user32

SendMessageA
GetKeyboardLayoutList
SystemParametersInfoA
FillRect
GetKeyboardLayout
CallNextHookEx
CreateCaret
DestroyCaret
UnhookWindowsHookEx
GetFocus
HideCaret
GetCaretPos
ShowCaret
PostMessageA
SetWindowsHookExA
DrawTextA
InvalidateRect
GetClassNameA
UnhookWinEvent

gdi32

DeleteDC
DeleteObject
CreateSolidBrush
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
SetBkMode
SetTextColor

msvcrt

__dllonexit
_mbsrev
strlen
memset
memcpy
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_splitpath
strcpy
strcat
_mbsupr
_mbscmp
_local_unwind2
_except_handler3
__CxxFrameHandler
_onexit

imagehlp

ImageDirectoryEntryToData

Exports

Exports

AM_GetAbbr
AM_GetFlags
AM_Install
AM_SetColorData
AM_SetFlags
AM_Uninstall

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.amlclrs
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AmlMaple.exe
.exe windows:4 windows x86 arch:x86

37528d85f7c7bf114bfae6a6d7424ced

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetTickCount
IsBadWritePtr
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
GetThreadLocale
CopyFileA
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
FlushInstructionCache
GetCurrentProcess
lstrcpyA
lstrcpynA
Sleep
FindNextFileA
ResumeThread
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileSectionNamesA
VirtualAlloc
VirtualFree
LockResource
LoadResource
FindResourceA
IsBadCodePtr
HeapFree
HeapAlloc
GetProcessHeap
GetLocalTime
GetTimeZoneInformation
SetStdHandle
IsBadReadPtr
GetModuleFileNameA
FlushFileBuffers
SetFilePointer
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
HeapCreate
GetEnvironmentVariableA
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
SetLastError
TlsAlloc
ExitThread
TlsGetValue
TlsSetValue
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
HeapReAlloc
RaiseException
RtlUnwind
GetMailslotInfo
SetEvent
TerminateThread
CreateEventA
CreateMailslotA
MultiByteToWideChar
WideCharToMultiByte
GetComputerNameA
FreeLibrary
GetLastError
FormatMessageA
GetLocaleInfoA
FindFirstChangeNotificationA
WaitForMultipleObjects
FindNextChangeNotification
FindCloseChangeNotification
lstrcmpA
GetVersionExA
LoadLibraryA
WaitForSingleObject
CreateThread
FindFirstFileA
FindClose
WriteFile
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
OpenMutexA
IsBadStringPtrA
CreateMutexA
OutputDebugStringA
DebugBreak
lstrlenA
InterlockedDecrement
CreateFileA
GetFileSize
CloseHandle
ReadFile
GetPrivateProfileStringA
InterlockedIncrement
GetProcAddress
InterlockedExchange
lstrcatA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetCapture
CreateCursor
DrawFocusRect
GetFocus
RemoveMenu
ModifyMenuA
SetMenuItemInfoA
GetKeyboardLayout
WindowFromPoint
DestroyCursor
GetIconInfo
CreateIconIndirect
SendMessageTimeoutA
LoadMenuA
GetSubMenu
IsIconic
RegisterClassA
PostQuitMessage
SetCapture
DrawIconEx
EnumChildWindows
SetRect
CheckMenuItem
GetMenuItemCount
AdjustWindowRectEx
GetMenuStringA
PtInRect
ClientToScreen
GetCursorPos
GetDlgItemInt
SetDlgItemInt
AdjustWindowRect
CreatePopupMenu
AppendMenuA
SetMenuDefaultItem
TrackPopupMenu
SetForegroundWindow
GetActiveWindow
DestroyAcceleratorTable
OffsetRect
SetFocus
GetSystemMetrics
SetCursorPos
IsCharAlphaNumericA
CharUpperBuffA
InflateRect
UpdateWindow
PostMessageA
SetClassLongA
ScreenToClient
CreateDialogParamA
GetDC
ReleaseDC
CallWindowProcA
IsWindowEnabled
SetRectEmpty
DrawTextA
EndPaint
BeginPaint
GetWindowLongA
SetWindowLongA
EnableMenuItem
GetMenuItemID
FindWindowA
IsWindow
GetWindowThreadProcessId
DestroyWindow
MessageBoxA
UnhookWindowsHookEx
LoadCursorA
ShowWindow
GetParent
wvsprintfA
InvalidateRect
DefWindowProcA
GetSysColor
CreateWindowExA
GetClientRect
SetTimer
KillTimer
EnableWindow
GetSysColorBrush
DialogBoxParamA
GetDlgItem
EndDialog
GetDlgCtrlID
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindowRect
MapWindowPoints
SetWindowPos
GetWindow
ReleaseCapture
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDesktopWindow
FillRect
wsprintfA
MessageBeep
DestroyIcon
GetKeyboardLayoutList
SetCursor
LoadIconA
GetClassNameA
RegisterWindowMessageA
SendMessageA
SystemParametersInfoA
GetMessageA
TranslateMessage
DispatchMessageA
LoadImageA
CopyIcon
CharUpperA
LoadStringA
CharNextA
DestroyMenu
MessageBoxW

comctl32

ImageList_ReplaceIcon
ord17
ImageList_Create
ImageList_Destroy
ImageList_SetBkColor

shell32

DragAcceptFiles
DragQueryFileA
DragFinish
Shell_NotifyIconA
ShellExecuteA
SHAppBarMessage

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA

gdi32

CreateFontIndirectA
GetStockObject
SelectObject
DeleteObject
CreateSolidBrush
CreateCompatibleBitmap
DeleteDC
CreateCompatibleDC
CreateDCA
SetTextColor
SetBkMode
SetBkColor
ExtTextOutA
RestoreDC
GetTextExtentPoint32A
SaveDC
GetTextMetricsA
LineTo
MoveToEx
FillRgn
CreatePolygonRgn
CreatePen
BitBlt
CreateBitmap
GetObjectType
GetObjectA

oleacc

AccessibleObjectFromEvent
AccessibleObjectFromWindow

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ws2_32

gethostbyname
gethostname
WSAStartup
inet_ntoa

Exports

Exports

��!��K�o��|�k ��o�<\��&b�O�to� /P��9�_4� c;�.�m�lw�e��N�<��Ҕ|}��n��o��=��)5��y��9��/g��~f��O"��B9�]e�-��x�a��M$�w[�O�|hU�lFӋ�:�Հ�8�n��F�8�'Y�c��1�^m��ݻ�.��ʶd�)�Dγ>R�5�v� h�B�^E��U�b��5� ԉߦ/�[`AL��A��ٰ��7D �/N�X��趮��a��b�T�MNؾ�B�tr5��}�-�)��Z��F�u��<ր��EO�V�[˵4ə��GWPa��J�gs�`k�..��sʸ��p(Z��4�W�u�s�p��3��Eh`/�W�_\e��)U��r�I�� v�{��}��y�U3��z�7}s�7��BJ%1��~� � ��|�mB��~��E�� '��ATF_�>�%��r;P�ܖ��k��i=�/��!U��J/L6��V;z�+�LK�2@�ʃ{� ��L��u�E>F��G ��%�WG�^��#�>�yr'P��pI�8��ӟ�s��0�w,� 5F3�$ڧb��{�D�rq��Z3�d�o0��N��{��0��1۝Ts��>`4pmu��p�&�� l e��z߽�8��;v 0;�Z��MS��eՖ��-��ꙁ童��0�8�b5b)A 1Ĉ�a��vp��<'�%P�Q��&�0�b]�J��W�2u�$��6�(�v�v&�"cր;��Cv�8s��kQ��^��@,��G#� %F�� L.�)��P��wn�T�l�r�� OӚ��yĎ��Y��e1��B��?�#�е|FCkNzue'�G�ɺe��)��0׎�"K��m�� $Q��W3��7�t�Qn�}�� .͜�"[赽lt8�6�L�t��a�]ClDu�q�?q��/&��=4{��&�U3t� h�s�ܨ��(�)�q7y��g�(��l9��W��$��Q�b8��⿨ �m�ܶnj2�@�aو�e�#�v�J��޹�7h��*iʠ!��Å[�z��/r�J�.;-�^��tq|�[��'��7a��T��Fq�ר��=[��71\�a��:,5�ZN-=U��N��N�:5�}��#N��b\<��96.�<��,�Z��4B�OK�X��o�jPli%�a��g L�Z�v�p0��CF��h�~��_��ly��(Eݛ�� }l܆��Bx`o�L��k�@z��8E �U�@�j��f�6�q�*I��$�]�R�旱)��W��#�{��w��;P>�A�n�FӢ�٣k��`�R�S0l(�D\ǔu�-��j��j6��lǔ'��s�тCQ�G��m��nb�ٜ��R�{��ca�L*�.��I��}�uGO/FLϡ��[ ��N!3��_PE��*�3E0��q<��cu]!u��]��f)B�i�}󡯾�fom��D��NX��I1b�\��n@��܂il{ʉ�c�A0��.�� hŦ��?��'�ٳ�!��f Wj�8��`A;�I��*�#��o[X-�O0��Q�?k)w�pr�[��50-��@x��W�R��<7�ؗf�&홎�� YϾm��p<Ҧ�>��3^�f��(��֙�Qɞqw,@��[�+�b�8��N�nU��>I�=�{� m��Ÿ�'��y�}e0��2�D�Ļ5D��!m�lN��jK� v��j� g�k�"��v@)�{R��h�G�B��c�b�xC��qw+e��9k��ѥ�r%��+��ɘ�Ut޹ֲ�}��vJu�O�+��7@ٴ�f S-��4�^�S�K�?#�.u!H��C��(+C\/�00樍��s�NyH��O��[*8kgfh�hZ�v�׵��GR�M4,0��x�A�� BN��(�U�B�~)��T�x�b��ï�o ɖ��mD��:��%a�}mS�3J��G�2m�̵=G�u��j�8+��5� ��n��tIUֳ2��l�[�I��+�� B`��'�w�e��G�%��yU��Jg��HA��"_� �)#��G\��<<�/6�W%��C�6�VC��8rJ��rd��4�Xۭp��HfKծ�;�!�4�S1��L�� Q/��ut��H��J�!3�Z�� 5\��x��-[g �-�R��!��>i�ʆ��ɇ��?lǛ��ϲ��s��Z�vٻݵ2��a�uWa��4h��/A��W(�F��;��p�T�:��Q��9|��`,Ƨ��',��\@�[�ш� -��8݋�%sQI �|CM��]l#�uǮ��mDh�={3�r��o�͏��2өee��n�F�H��|u�7;+O/�7R�$ѕ w15�3��>��4n��~�%i�ճFR密�U�� N��7��Е��]�l(��/_K�8��Y��NΟ|j�[xW�5�R��P?�yk$��+.\�R�ɚE0.&�c�YKL�J�y�j~��>F�s�fӦ�m��7ܷ|�h�{$H��f�HV��4��qn��Pu��*{؏qKA%��j�wgN��ٓ�;�w±�<Ɣ�F� ��i��Y��V�1ʻ�1��x��f��6+� @��{�u�z��^�c�:ֵ��H��z9�uJ3�,v��ba��o" ��̺[�٬W��j�Bx��+T��Ao��:�+�i_�Fg�),��_��WG��C�]��l;@��_�,�]ȇDZ��0�L��>V��N��k�e�y��1 S��y�4{��~t�s^IL�5��

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.VMP0
Size: 968KB - Virtual size: 967KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.VMP1
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Bulgarian.lng
Byelorussian.lng
FlgCrt.dll
.dll windows:4 windows x86 arch:x86

eb87bbb4456ceded987b530f714e456b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary

user32

IsWindowUnicode
IsWindow
GetKeyboardLayout
GetWindowThreadProcessId
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA

Exports

Exports

Install
InstallWndHook
UnInstall

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 514B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.amlmacc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
French.lng
German.lng
Help_By.chm
.chm
Help_En.chm
.chm
Help_Ru.chm
.chm
Italian.lng
LocalizationExample.lng
ReadMe.txt
Russian.lng
Spanish.lng
Ukrainian.lng
history.txt
licence_en.txt

Sharing

General

Malware Config

Signatures

Files

d959285c6e5aac756e7471bfb19e2137

Headers

File Characteristics

Imports

kernel32

user32

gdi32

msvcrt

imagehlp

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 552B

.CRT Size: 512B - Virtual size: 20B

.amlclrs Size: 512B - Virtual size: 80B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 830B

37528d85f7c7bf114bfae6a6d7424ced

Headers

File Characteristics

Imports

kernel32

user32

comctl32

shell32

advapi32

gdi32

oleacc

version

ws2_32

Exports

Exports

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 17KB - Virtual size: 25KB

.rsrc Size: 85KB - Virtual size: 84KB

.VMP0 Size: 968KB - Virtual size: 967KB

.tls Size: 512B - Virtual size: 24B

.VMP1 Size: 57KB - Virtual size: 56KB

eb87bbb4456ceded987b530f714e456b

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 514B

.data Size: 512B - Virtual size: 108B

.amlmacc Size: 512B - Virtual size: 20B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 210B

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 552B

.CRT
Size: 512B - Virtual size: 20B

.amlclrs
Size: 512B - Virtual size: 80B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 830B

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 17KB - Virtual size: 25KB

.rsrc
Size: 85KB - Virtual size: 84KB

.VMP0
Size: 968KB - Virtual size: 967KB

.tls
Size: 512B - Virtual size: 24B

.VMP1
Size: 57KB - Virtual size: 56KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 514B

.data
Size: 512B - Virtual size: 108B

.amlmacc
Size: 512B - Virtual size: 20B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 210B