a50eaea25bec86b48c36f4128503cabb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a50eaea25bec86b48c36f4128503cabb_JaffaCakes118
Size

386KB
MD5

a50eaea25bec86b48c36f4128503cabb
SHA1

26add2dec5ee9f2aafef03c8bfa8344f8f0e7359
SHA256

2d9bcb05a85780df39e1952a481af826f11d1284a5c582bd409e58432a94f888
SHA512

b9f407eb54a3080d59c0cfe304e99d9bd691c7474dfd5358927f0e622a070d51253a6eaf5a098469c90c8a662e687d9abdd3933ce2490c612589f642b039b486
SSDEEP

6144:Fso2NCcituDB1mHe6/9UGx9x9uPUimscTTAxhFP1s9Zjmf:NcituBc+6ic9uPUhAxhFP2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a50eaea25bec86b48c36f4128503cabb_JaffaCakes118

Files

a50eaea25bec86b48c36f4128503cabb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e83a7d19614782c12a158af557d689aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\work\sbie\apps\control\obj\i386\SbieCtrl.pdb

Imports

mfc42u

ord6278
ord3312
ord491
ord5426
ord6211
ord6193
ord5856
ord1165
ord772
ord5602
ord500
ord5977
ord1662
ord2644
ord5949
ord6563
ord5945
ord3356
ord3090
ord5947
ord3658
ord3621
ord2406
ord3566
ord1634
ord1633
ord5781
ord2858
ord2371
ord6051
ord1768
ord5286
ord3393
ord4418
ord3728
ord567
ord810
ord2966
ord5755
ord6188
ord5752
ord6182
ord4324
ord6185
ord6168
ord5869
ord5785
ord5790
ord5674
ord5732
ord5575
ord5567
ord6057
ord5860
ord3591
ord640
ord6190
ord6017
ord323
ord4266
ord4532
ord2115
ord3282
ord3291
ord6266
ord3909
ord1084
ord4688
ord3749
ord5142
ord3016
ord4847
ord6376
ord2078
ord326
ord4270
ord3737
ord818
ord2144
ord773
ord5603
ord6373
ord3614
ord4215
ord2576
ord3649
ord1637
ord1143
ord5677
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3396
ord4616
ord3733
ord561
ord815
ord2430
ord2613
ord5568
ord2910
ord4237
ord4718
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5278
ord2641
ord1658
ord4430
ord5248
ord4421
ord3618
ord674
ord3865
ord2455
ord6279
ord2447
ord2550
ord366
ord1105
ord4219
ord291
ord910
ord2574
ord4396
ord3635
ord693
ord2857
ord4238
ord697
ord395
ord4181
ord6896
ord3281
ord3905
ord6688
ord686
ord3991
ord2445
ord2088
ord384
ord2092
ord5625
ord3431
ord4118
ord2855
ord3397
ord3716
ord795
ord2567
ord4390
ord3569
ord609
ord1764
ord6362
ord2405
ord2016
ord4214
ord2573
ord4395
ord3634
ord692
ord6316
ord2769
ord3084
ord5639
ord2070
ord2091
ord2108
ord4282
ord4279
ord6867
ord6865
ord6238
ord1644
ord913
ord700
ord398
ord3434
ord2776
ord909
ord3638
ord696
ord3930
ord394
ord5586
ord3430
ord4180
ord1172
ord3568
ord5706
ord283
ord5871
ord4128
ord4292
ord2746
ord2836
ord2099
ord4199
ord5446
ord6390
ord5436
ord6379
ord613
ord3490
ord4078
ord1834
ord289
ord3688
ord2705
ord3995
ord6004
ord2579
ord4400
ord3389
ord3724
ord804
ord6777
ord4254
ord1900
ord1683
ord2520
ord5284
ord4433
ord2046
ord4425
ord771
ord497
ord2400
ord6868
ord2606
ord6655
ord4120
ord3470
ord3285
ord3298
ord5845
ord2876
ord6451
ord2877
ord6437
ord1258
ord2111
ord1761
ord4709
ord2629
ord1230
ord5784
ord472
ord755
ord470
ord2036
ord2440
ord1569
ord2634
ord3871
ord2756
ord926
ord860
ord6024
ord768
ord4253
ord2854
ord414
ord3979
ord713
ord3657
ord5817
ord5600
ord5855
ord924
ord5617
ord859
ord4124
ord927
ord6654
ord539
ord501
ord1083
ord536
ord4273
ord941
ord715
ord415
ord1081
ord1008
ord5597
ord2010
ord5616
ord1085
ord2757
ord6565
ord5605
ord3694
ord4829
ord5283
ord4371
ord4352
ord4942
ord4970
ord4899
ord5154
ord5156
ord5155
ord823
ord5618
ord542
ord3798
ord802
ord5679
ord4272
ord2755
ord4197
ord3087
ord6195
ord535
ord540
ord2810
ord922
ord940
ord925
ord825
ord2637
ord324
ord538
ord537
ord800
ord942
ord861
ord858
ord641
ord3592
ord4419
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord2506
ord4992
ord4370
ord5261
ord4229
ord2859
ord3133
ord1135
ord4294
ord5830

msvcrt

wcscat
malloc
wcscpy
_wcsicmp
wcscmp
__CxxFrameHandler
_wcsnicmp
wcschr
towlower
free
memcpy
memset
_wtoi64
wcslen
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
wcstol
swprintf
wcsrchr
wcsncpy
memcmp
exit
_wtoi
time
wcsstr
memmove
atof
strchr
toupper
_purecall
__RTDynamicCast
_c_exit
_exit
_XcptFilter
_cexit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
??1type_info@@UAE@XZ

advapi32

OpenEventLogW
LsaOpenPolicy
LsaQueryInformationPolicy
LsaFreeMemory
LsaClose
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CloseEventLog
ReadEventLogW
RegEnumValueW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW

kernel32

InterlockedDecrement
GetModuleHandleW
FindFirstFileW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetDriveTypeW
GetModuleFileNameW
DeleteFileW
CopyFileW
UnmapViewOfFile
InterlockedIncrement
CreateFileMappingW
RemoveDirectoryW
CreateDirectoryW
WriteFile
GetTempPathW
GetProcAddress
GetProcessTimes
OpenProcess
LoadLibraryW
GetStartupInfoW
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceW
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
InitializeCriticalSection
LocalAlloc
LocalFree
CloseHandle
GetFileTime
GetWindowsDirectoryW
GetLastError
CreateFileW
GetCurrentProcessId
CreateThread
HeapFree
GetProcessHeap
ProcessIdToSessionId
HeapAlloc
GetShortPathNameW
GetVersionExW
CreateMutexW
OpenMutexW
GetCommandLineW
WaitForSingleObject
GetFileAttributesW
FindClose
MapViewOfFile
FindNextFileW
FreeLibrary
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter

gdi32

GetCurrentObject
SetTextColor
GetClipBox
CreateFontIndirectW
GetObjectW
CreatePen
GetTextMetricsW
GetPixel
Rectangle
CreatePatternBrush
GetStockObject
Ellipse
BitBlt
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
PatBlt
LPtoDP
DPtoLP
GetWindowExtEx
GetViewportExtEx
GetMapMode
CreateSolidBrush
CreatePolygonRgn
CreateCompatibleDC
CreateCompatibleBitmap
SetPixel
DeleteDC
SelectObject
GetTextExtentPoint32W
DeleteObject
GetTextColor

user32

GetWindowLongW
SendMessageW
UnhookWindowsHookEx
SetCursor
ReleaseCapture
GetParent
CallNextHookEx
PostMessageW
IsWindowVisible
PtInRect
EnumChildWindows
WindowFromPoint
CallWindowProcW
SetWindowsHookExW
SetCapture
SetWindowLongW
SetWindowPos
MoveWindow
GetDC
CreateWindowExW
SetFocus
ScreenToClient
GetDlgItem
SetWindowTextW
ShowWindow
GetDlgCtrlID
GetWindow
SendDlgItemMessageW
MessageBoxW
EnableWindow
DestroyWindow
DestroyCursor
SetClassLongW
GetCursorPos
GetAsyncKeyState
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
LoadBitmapW
SetTimer
SetLayeredWindowAttributes
RegisterClassExW
LoadIconW
DefWindowProcW
CopyRect
EnableMenuItem
GetSubMenu
BeginPaint
EndPaint
UpdateWindow
InvalidateRect
TabbedTextOutW
DrawTextW
GrayStringW
GetMessagePos
SetForegroundWindow
DispatchMessageW
TranslateMessage
GetMessageW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetMenuItemCount
LoadMenuW
MsgWaitForMultipleObjects
PeekMessageW
SetMenuItemInfoW
GetMenuItemInfoW
RegisterWindowMessageW
SystemParametersInfoW
FindWindowW
CreatePopupMenu
DeleteMenu
AppendMenuW
SetMenuDefaultItem
GetMenuItemID
GetMenuStringW
InsertMenuW
ModifyMenuW
GetMenu
SetMenu
PostQuitMessage
wsprintfW
GetSystemMetrics
GetKeyState
FindWindowExW
DestroyIcon
EnumWindows
DrawStateW
GetSysColor
GetMenuItemRect
GetClassNameW
IsMenu
IsRectEmpty
GetDesktopWindow
IsWindow
GetSysColorBrush
GetIconInfo
LoadCursorW
GetWindowRect
GetClientRect
ClientToScreen
OffsetRect
GetWindowDC
SetRect
InvertRect
ReleaseDC
KillTimer
SetWindowRgn

ntdll

NtCreateFile
NtQueryDirectoryFile

psapi

GetModuleFileNameExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
Shell_NotifyIconW
DragQueryFileW
ShellExecuteExW
SHFileOperationW
ord165
SHGetFolderPathW
ShellExecuteW
ExtractIconExW

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageCount
ImageList_Remove
ImageList_GetImageInfo

comdlg32

ChooseColorW
GetOpenFileNameW

gdiplus

GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdiplusStartup

wininet

InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoCreateInstance

sbiedll

_SbieApi_MonitorControl@8
_SbieApi_GetWork@12
_SbieDll_GetStartError@0
_SbieDll_StartSbieSvc@4
_SbieApi_CallServer@4
_SbieApi_FreeReply@4
_SbieApi_GetVersion@4
_SbieDll_StartSbieDrv@4
_SbieDll_FormatMessage0@4
_SbieDll_FormatMessage1@8
_SbieApi_EnumBoxes@8
_SbieApi_ReloadConf@4
_SbieDll_KillAll@8
_SbieApi_QueryConf@20
_SbieApi_QueryBoxPath@28
_SbieDll_TranslateNtToDosPath@4
_SbieDll_GetAllUsersPath@0
_SbieDll_GetUserPath@0
_SbieDll_GetDrivePath@4
_SbieApi_EnumProcessEx@16
_SbieApi_QueryProcess@20
_SbieApi_MonitorGet@8
_SbieDll_GetLanguage@4
_SbieApi_SetLicense@8
_SbieApi_GetLicense@4
_SbieDll_FormatMessage@8
_SbieDll_FormatMessage2@12
_SbieDll_KillOne@4
_SbieDll_DeviceChange@8
_SbieApi_DisableForceProcess@8
_SbieDll_CanElevateOnVista@0
_SbieApi_CallZero@4
_SbieDll_RunFromHome@16

Sections

.text
Size: 227KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.clean
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e83a7d19614782c12a158af557d689aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

advapi32

kernel32

gdi32

user32

ntdll

psapi

shell32

comctl32

comdlg32

gdiplus

wininet

ole32

sbiedll

Sections

.text Size: 227KB - Virtual size: 227KB

.data Size: 2KB - Virtual size: 5KB

.clean Size: 57KB - Virtual size: 56KB

.rsrc Size: 98KB - Virtual size: 97KB

.text
Size: 227KB - Virtual size: 227KB

.data
Size: 2KB - Virtual size: 5KB

.clean
Size: 57KB - Virtual size: 56KB

.rsrc
Size: 98KB - Virtual size: 97KB