29041a65543deb3e0181cc818eb5e1e6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29041a65543deb3e0181cc818eb5e1e6_JaffaCakes118
Size

561KB
MD5

29041a65543deb3e0181cc818eb5e1e6
SHA1

23e05f99c53d0247490b0d4f21198f64ee4ae3fa
SHA256

01ef864272d4b126c823fa15d630f1e6b36a2eccb93e3097511b654cd487cb40
SHA512

0ad39b2191e5e20c06ddcbd216eb608e079ba161cd5f702465bb8f099a7a5b7a4f31bd47221818fcdf41cdb2d5c1b906fbc1f2d86d29077076d3c0660a5fd165
SSDEEP

12288:VSXWhbOWlSnkH/nCfKCDLu39/bCjS3a23wOMYyKMtYFbEqnusqnu:1bCnkHvCfhDLu39WG3z3wOMkbw+us+u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29041a65543deb3e0181cc818eb5e1e6_JaffaCakes118

Files

29041a65543deb3e0181cc818eb5e1e6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

390e738c8373b5c427b070a737c2a96c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Hudson\workspace\Release-2011.05\checkout\rc\MOD\rcc_host\Release\clienthost_u_u.pdb

Imports

kernel32

GetTimeZoneInformation
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryA
GetFullPathNameA
GetExitCodeProcess
CreatePipe
GetFileAttributesA
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
VirtualAlloc
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
IsValidCodePage
GetOEMCP
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsAlloc
GetLocaleInfoW
CompareStringW
CompareStringA
GetDateFormatA
GetTimeFormatA
ExitProcess
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
DuplicateHandle
CreateProcessA
GetProcessHeap
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
RaiseException
RtlUnwind
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentThread
LocalAlloc
LocalFree
CreateDirectoryA
SetCurrentDirectoryA
SetCurrentDirectoryW
GetTempPathW
FindResourceA
BeginUpdateResourceA
UpdateResourceW
EndUpdateResourceW
LoadResource
LockResource
SizeofResource
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindFirstFileA
MultiByteToWideChar
RemoveDirectoryA
FindNextFileA
FindClose
GetTempPathA
FindResourceW
EnumResourceTypesW
lstrcpynW
GetModuleHandleA
lstrcpynA
lstrcpyW
CreateFileW
CopyFileW
SetFileAttributesW
CreateThread
TerminateThread
DeleteFileW
GetComputerNameW
WaitForMultipleObjects
GetCurrentProcess
GetWindowsDirectoryW
GetVersionExW
GetVolumeInformationW
GetVersion
IsBadReadPtr
LoadLibraryA
WriteFile
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReadFile
CreateFileA
SetFilePointer
CloseHandle
DeleteFileA
FreeLibrary
LoadLibraryW
GetProcAddress
MulDiv
lstrcmpW
GetCurrentProcessId
Sleep
GetModuleFileNameW
GetCurrentDirectoryW
lstrcatW
GetTickCount
GetModuleHandleW
GetModuleFileNameA
GetLastError
lstrlenW
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
WideCharToMultiByte
TlsGetValue
SetEnvironmentVariableA

user32

ExitWindowsEx
IsCharAlphaNumericA
GetDesktopWindow
GetParent
GetWindow
GetMenu
GetFocus
AttachThreadInput
GetWindowThreadProcessId
SetWindowPos
InvalidateRect
GetForegroundWindow
SetForegroundWindow
IsWindowUnicode
SetParent
GetClassNameW
GetWindowTextLengthW
MessageBoxW
IsCharAlphaNumericW
DestroyIcon
EndDialog
RedrawWindow
SetWindowLongW
GetWindowLongW
OffsetRect
GetSystemMetrics
CharUpperBuffA
CharUpperBuffW
CharNextA
CharNextW
DialogBoxParamA
EnumChildWindows
LockWindowUpdate
GetDialogBaseUnits
GetWindowRgn
DefDlgProcA
GetClassNameA
LoadBitmapA
wsprintfA
SetWindowTextW
SetDlgItemTextW
LoadIconA
DialogBoxParamW
wsprintfW
CreateWindowExW
ShowWindow
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
UnregisterClassW
RegisterClassW
SystemParametersInfoW
DrawTextW
DrawTextA
FrameRect
BeginDeferWindowPos
IsWindow
DeferWindowPos
EndDeferWindowPos
GetSystemMenu
TrackPopupMenuEx
FillRect
GetWindowTextW
LoadImageW
LoadBitmapW
EnableMenuItem
GetWindowPlacement
IsWindowVisible
SetWindowRgn
GetClientRect
DrawIconEx
SetRect
MapWindowPoints
InflateRect
KillTimer
SetTimer
LoadCursorW
SetCursor
GetDlgItem
BeginPaint
EndPaint
SendMessageW
PostMessageW
IsWindowEnabled
IsIconic
GetDCEx
GetWindowDC
ReleaseDC
AdjustWindowRectEx
GetWindowRect
PtInRect
DefDlgProcW

gdi32

ExcludeClipRect
CreateSolidBrush
SetTextColor
BitBlt
DeleteObject
DeleteDC
GetClipBox
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
SelectObject
GetMapMode
SetMapMode
GetWindowExtEx
SetWindowExtEx
GetViewportExtEx
DPtoLP
SetViewportOrgEx
GetBkColor
SetBkColor
ExtTextOutW
CreateDIBSection
CreateBitmap
GetObjectW
CreateRoundRectRgn
CreateRectRgnIndirect
StretchBlt
GetStockObject
CreateFontIndirectW
ExtSelectClipRgn
SetRectRgn
OffsetRgn
CreateRectRgn
GetTextExtentExPointW
GetTextExtentExPointA
GetTextExtentPoint32W
GetTextExtentPoint32A
SetBkMode
SetViewportExtEx

advapi32

FreeSid
RegCreateKeyExA
RegEnumValueW
RegEnumValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyW
RegCreateKeyA
RegCloseKey
RegDeleteValueW
RegDeleteValueA
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
OpenSCManagerW
CloseServiceHandle
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
IsValidSid
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW

shell32

SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ShellExecuteA

ole32

CoTaskMemFree

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen

shlwapi

PathCompactPathA
PathCompactPathW
PathAppendA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueW
VerQueryValueA

Exports

Exports

Data
Start
Stop

Sections

.text
Size: 440KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

390e738c8373b5c427b070a737c2a96c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

Exports

Exports

Sections

.text Size: 440KB - Virtual size: 437KB

.rdata Size: 84KB - Virtual size: 82KB

.data Size: 36KB - Virtual size: 43KB

.rsrc Size: 128KB - Virtual size: 127KB

.reloc Size: 24KB - Virtual size: 23KB

.text
Size: 440KB - Virtual size: 437KB

.rdata
Size: 84KB - Virtual size: 82KB

.data
Size: 36KB - Virtual size: 43KB

.rsrc
Size: 128KB - Virtual size: 127KB

.reloc
Size: 24KB - Virtual size: 23KB