8a1665932b2e83bafd157cec98495a88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8a1665932b2e83bafd157cec98495a88_JaffaCakes118
Size

500KB
MD5

8a1665932b2e83bafd157cec98495a88
SHA1

a078b3fd093822f9b63f1f37e5ce4441b578ad0b
SHA256

4fefc4bdfa5076c29a8a3ec73b7404e9c2345049e576186fa7df59ab8ccf5e0c
SHA512

c12403c934fe107fc307b1664cb7600151bfc6f4b50cf7a6a2ee8b8c608bcacfd3ed8ad649f43a2fd49af109dfc7414ea8f67bfd03f0bfff9623f56976a26438
SSDEEP

12288:W0eBVr/Hqh8cMjd7W0joqp6a7SYCCKPymkknXGnWZ:uBdqZs7W0j56jYFKPyTkXEI

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
8a1665932b2e83bafd157cec98495a88_JaffaCakes118
unpack001//tbu09716/tbhelper.dll
unpack001//tbu09716/toolbar.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

8a1665932b2e83bafd157cec98495a88_JaffaCakes118
.exe windows:4 windows x86 arch:x86

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_Create
ord17
ImageList_AddMasked
ImageList_Destroy

kernel32

GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
SetErrorMode
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
GetModuleHandleA
LoadLibraryA
CreateThread
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
ExitProcess

user32

CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
SetFocus
ScreenToClient
GetWindowRect
GetWindowLongA
SetClassLongA
IsWindowEnabled
SetWindowPos
LoadCursorA
SetCursor
GetDlgItemTextA
MapWindowPoints
GetMessagePos
LoadBitmapA
CallWindowProcA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
GetSysColor
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
PostQuitMessage
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
GetWindowTextA
DrawTextA
EndPaint
InvalidateRect

gdi32

SetBkColor
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush
CreateFontA
SetBkMode
SetTextColor
CreateBrushIndirect
SelectObject

advapi32

RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey

shell32

ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/tbu09716//!
/tbu09716/basis.xml
.xml
/tbu09716/pass_icon_new.bmp
/tbu09716/standard_icons_new.bmp
/tbu09716/tbhelper.dll
.dll regsvr32 windows:4 windows x86 arch:x86

494044dc74faee61464c6e58bf545e63

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFindExtensionA
PathFileExistsA

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetOpenA

rpcrt4

UuidFromStringA

urlmon

URLDownloadToFileA

kernel32

Sleep
CreateThread
CloseHandle
TerminateThread
WriteFile
CreateFileA
GetLastError
DeleteFileA
InterlockedIncrement
InterlockedDecrement
lstrlenA
IsBadStringPtrA
FindResourceA
DeleteCriticalSection
RaiseException
MultiByteToWideChar
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
DisableThreadLibraryCalls
SetEndOfFile
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
lstrcatA
lstrcpyA
GlobalUnlock
GlobalLock
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
EnterCriticalSection
OpenEventA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
GetProcessHeap
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
ReadFile
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
VirtualFree
HeapCreate
HeapDestroy
HeapFree
LocalFree
GetCurrentProcessId
SetEvent
HeapReAlloc
lstrcpyW
OutputDebugStringA
OutputDebugStringW
lstrcpynW
WaitForSingleObject
GetCurrentThreadId
VirtualAlloc
UnmapViewOfFile
IsBadReadPtr
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
GetVersion
OpenFileMappingA
GetModuleFileNameW
RtlUnwind
IsBadWritePtr
HeapValidate
GetSystemTimeAsFileTime
DebugBreak
GetStdHandle
GetProcAddress
LoadLibraryA
VirtualProtect
VirtualQuery
GetCommandLineA
ExitProcess
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetLastError
HeapAlloc
GetEnvironmentStringsW

user32

DispatchMessageW
DispatchMessageA
MsgWaitForMultipleObjects
CharLowerBuffA
TranslateMessage
GetClipboardData
CloseClipboard
CharNextA
UnregisterClassA
LoadStringA
PeekMessageA
IsWindowUnicode
GetMessageA
OpenClipboard
GetMessageW

advapi32

RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
OpenThreadToken
RevertToSelf
SetThreadToken
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA

ole32

CreateStreamOnHGlobal
CoInitialize
CLSIDFromProgID
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoReleaseMarshalData
CoMarshalInterface
CoUnmarshalInterface
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2

oleaut32

VariantCopy
VarBstrCmp
UnRegisterTypeLi
RegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantInit
SysAllocStringLen
SysFreeString
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysAllocString

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 212KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu09716/toolbar.crc
/tbu09716/toolbar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2ab572b977f26a92420146adbb8ccc99

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA

shlwapi

PathFileExistsA
PathFindExtensionA
PathRemoveFileSpecA

winmm

PlaySoundA

setupapi

SetupIterateCabinetA

dbghelp

SymGetModuleBase
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymInitialize
SymLoadModule

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

SetFilePointer
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
InterlockedDecrement
InterlockedIncrement
lstrlenA
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
CloseHandle
HeapFree
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
GetTempPathA
SetCurrentDirectoryA
LoadLibraryA
DebugBreak
IsBadCodePtr
SetUnhandledExceptionFilter
IsBadWritePtr
GetCurrentProcessId
lstrcpynA
FormatMessageA
IsBadReadPtr
ReadProcessMemory
GetModuleFileNameA
CreateFileA
FreeEnvironmentStringsA
GlobalUnlock
GlobalLock
WinExec
VerLanguageNameA
RemoveDirectoryA
MoveFileExA
DeleteFileA
WriteFile
CopyFileA
MoveFileA
GetTempFileNameA
lstrcpyA
lstrcatA
lstrlenW
FindFirstFileA
FindNextFileA
FindClose
GlobalFree
GlobalAlloc
lstrcmpA
MulDiv
FreeLibrary
Sleep
GetTickCount
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
TerminateProcess
ReadFile
GetFullPathNameA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetCurrentDirectoryA
SetEnvironmentVariableA
CreateThread
ResumeThread
ExitThread
HeapReAlloc
RtlUnwind
LocalFree
LocalAlloc
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
FlushFileBuffers
GetSystemTimeAsFileTime
GetCommandLineA
SetEndOfFile
ExitProcess
GetOEMCP
GetCPInfo
TlsAlloc
CompareStringA
CompareStringW
OpenProcess
GetStartupInfoA
GetFileType
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapSize
GetStringTypeA
GetStringTypeW
GetStdHandle
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetDriveTypeA
GetTimeZoneInformation
SetHandleCount
TlsFree

user32

GetSubMenu
LoadMenuA
CharUpperA
EnableMenuItem
GetMenuItemInfoA
OffsetRect
ClientToScreen
MapWindowPoints
GetAsyncKeyState
SetWindowRgn
InflateRect
IsWindowEnabled
SystemParametersInfoA
GetCapture
GetDlgCtrlID
DrawFocusRect
DrawEdge
UpdateWindow
LoadImageA
SetWindowsHookExA
TrackPopupMenu
UnhookWindowsHookEx
EndMenu
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDC
ReleaseDC
GetDesktopWindow
RedrawWindow
BeginPaint
FillRect
EndPaint
IsChild
GetSysColor
DestroyAcceleratorTable
CharLowerA
RegisterWindowMessageA
RegisterHotKey
UnregisterHotKey
SetWindowPos
InsertMenuA
PeekMessageA
GetMessagePos
DrawFrameControl
LoadBitmapA
GetCursorPos
PostMessageA
DialogBoxIndirectParamA
GetWindow
IsWindowVisible
WindowFromPoint
CallNextHookEx
SetCursor
ScreenToClient
PtInRect
GetClassNameA
DestroyCursor
SetDlgItemTextA
IsDlgButtonChecked
CheckDlgButton
EndDialog
SetFocus
SetActiveWindow
GetWindowTextLengthA
GetWindowTextA
GetWindowRect
GetClientRect
TranslateMessage
DispatchMessageA
CharUpperBuffA
DialogBoxParamA
GetActiveWindow
SetLastErrorEx
GetWindowLongA
CallWindowProcA
DefWindowProcA
CharNextA
wvsprintfA
SetTimer
LoadCursorFromFileA
CharLowerBuffA
OpenClipboard
EmptyClipboard
CloseClipboard
MessageBoxA
UnregisterClassA
SetWindowLongA
RegisterClassExA
LoadCursorA
wsprintfA
GetClassInfoExA
LoadStringA
GetParent
ShowWindow
MoveWindow
SetWindowTextA
CreateWindowExA
SendMessageA
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuA
DrawTextA
CopyRect
GetMenu
AdjustWindowRectEx
GetSystemMetrics
KillTimer
GetKeyState

gdi32

GetTextExtentPoint32A
SelectObject
ExtTextOutA
SetBkMode
CreateRectRgn
GetTextMetricsA
CreateBrushIndirect
CreateRectRgnIndirect
CreatePatternBrush
SetBkColor
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetTextColor
GetTextExtentPointA
GetStockObject
GetObjectA
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
CreateFontA

shell32

ShellExecuteA
SHAddToRecentDocs
SHGetFolderPathA
SHEmptyRecycleBinA
DragQueryFileA

ole32

CLSIDFromString
CLSIDFromProgID
OleInitialize
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
RegisterDragDrop
ReleaseStgMedium
StringFromGUID2
OleUninitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
OleLockRunning
CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SysFreeString
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VarBstrCmp
SysAllocString
VariantInit
SysStringByteLen
VariantClear
UnRegisterTypeLi
LoadTypeLi
OleCreateFontIndirect
LoadRegTypeLi
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
DispCallFunc
SafeArrayPutElement
SafeArrayCreate
VariantCopy
VariantChangeType
VarUI4FromStr
RegisterTypeLi
VarBstrCat

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg

Sections

.text
Size: 672KB - Virtual size: 670KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/tbu09716/version.txt

Sharing

General

Malware Config

Signatures

Files

81c812ed76d4690c8678b3a4f0737a5f

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 19KB - Virtual size: 20KB

494044dc74faee61464c6e58bf545e63

Headers

File Characteristics

Imports

shlwapi

wininet

rpcrt4

urlmon

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 212KB - Virtual size: 208KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 8KB - Virtual size: 13KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 16KB - Virtual size: 13KB

2ab572b977f26a92420146adbb8ccc99

Headers

File Characteristics

Imports

wininet

shlwapi

winmm

setupapi

dbghelp

version

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 672KB - Virtual size: 670KB

.rdata Size: 124KB - Virtual size: 122KB

.data Size: 20KB - Virtual size: 28KB

.SHARED Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 19KB - Virtual size: 20KB

.text
Size: 212KB - Virtual size: 208KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 8KB - Virtual size: 13KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 16KB - Virtual size: 13KB

.text
Size: 672KB - Virtual size: 670KB

.rdata
Size: 124KB - Virtual size: 122KB

.data
Size: 20KB - Virtual size: 28KB

.SHARED
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 44KB - Virtual size: 42KB