873f01336bf70e17ad4aec3de79d08b6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

873f01336bf70e17ad4aec3de79d08b6_JaffaCakes118
Size

543KB
MD5

873f01336bf70e17ad4aec3de79d08b6
SHA1

7ac3881f8ccf9b78b4a4d1a0bedb3959708a65b6
SHA256

72cebac3ef8f1e124d463e69a088773b3f85392e464ac10d1737c1a0e6730341
SHA512

8980631fe6642063189658c00fdc22862e9121559753b01e18b289c2716939cf03865df0efd3a116a1e7d5cb1e6ccf691f272e44602ec37eeb2be54fe753f486
SSDEEP

12288:an4n6eDqMk+P4GHYkG0Ydf1Fg7OXbyj4HhoKl/Ncm:y4Dqlj50McabyqaKlS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
873f01336bf70e17ad4aec3de79d08b6_JaffaCakes118

Files

873f01336bf70e17ad4aec3de79d08b6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

9442a8f06f2dc3ea10374e8ecd6888f3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\疯神\20150411\AhnManager\Release\AhnHelper.pdb

Imports

shlwapi

StrRChrW
StrStrW

kernel32

GetConsoleOutputCP
WriteConsoleA
GetModuleHandleA
lstrcmpiA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
Sleep
GetCurrentThreadId
SetEvent
ExitThread
GetLastError
GetCurrentProcessId
CreateNamedPipeA
FindResourceW
QueryDosDeviceW
lstrcmpiW
GetModuleHandleW
SetLastError
CopyFileA
GetTickCount
GetTempPathA
CloseHandle
OpenProcess
ResumeThread
CreateProcessA
CreateProcessW
lstrcpyA
HeapFree
HeapAlloc
GetProcessHeap
GetProcAddress
ExitProcess
VirtualProtect
WriteConsoleW
IsBadReadPtr
UnmapViewOfFile
GetCurrentDirectoryA
MapViewOfFile
CreateFileMappingA
LoadLibraryA
OpenFileMappingA
OpenThread
lstrcatA
GetSystemDirectoryA
TlsFree
UnhandledExceptionFilter
GetCommandLineA
CreateFileA
TlsAlloc
DisableThreadLibraryCalls
FreeLibrary
TlsGetValue
TlsSetValue
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
VirtualAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetVersionExA
GetSystemInfo
WriteProcessMemory
GetThreadContext
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
ReadFile
SetFilePointer
VirtualFree
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
RaiseException
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

user32

GetSystemMetrics
MessageBoxA
wsprintfA
EnumWindows
CallNextHookEx
SetWindowTextA
UnhookWindowsHookEx
SetWindowsHookExA

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW

psapi

GetMappedFileNameA
GetProcessImageFileNameA

ntdll

RtlUnwind
ZwSetContextThread
ZwQueryVirtualMemory
RtlCaptureStackBackTrace
RtlNtStatusToDosError
ZwQueryObject
ZwQueryInformationThread
ZwProtectVirtualMemory
ZwQueryInformationProcess

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

Exports

Exports

AhnAddRemoterInjects
AhnCreateProcessA
AhnCreateProcessWithSDK
AhnDllWithSHR
AhnExportEx
AhnGetMainThreadId
AhnInstallHook
AhnUnHook
AntiLDRSetModuleInfo
WahApcUserInfo
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification
_AhnAddRemoterInjects@8
_AhnCreateProcessA@12
_AhnCreateProcessWithSDK@28
_AhnGetScanAddress@12
_AhnInstallHook@12
_AhnUnHook@4
_AntiHookCreateRmoterThread@8
_AntiHookCreateRmoterThreadEx@12
_AntiHookGetMainThreadId@0
_AntiHookGetProcAddress@8
_AntiHookGetProcAddressEx@8
_AntiHookGetProcAddressForTable@8
_AntiHookGetReturnAddress@4
_AntiHookGetSelfModuleByAddress@4
_AntiHookGetSelfModuleHandle@0
_AntiHookGetSelfModuleName@4
_AntiHookSetThreadToMain@0
_AntiHookSetToken@0
_ODBG_Plugindata
_ODBG_Plugininit

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.date0
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 430KB - Virtual size: 430KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9442a8f06f2dc3ea10374e8ecd6888f3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

version

psapi

ntdll

advapi32

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 5KB - Virtual size: 17KB

.date0 Size: 512B - Virtual size: 24B

.vmp0 Size: 430KB - Virtual size: 430KB

.reloc Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 5KB - Virtual size: 17KB

.date0
Size: 512B - Virtual size: 24B

.vmp0
Size: 430KB - Virtual size: 430KB

.reloc
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB