add8df24a1c38150f1fbb52a60c2f531_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

add8df24a1c38150f1fbb52a60c2f531_JaffaCakes118
Size

272KB
MD5

add8df24a1c38150f1fbb52a60c2f531
SHA1

f438d40e40df0da3799b8cecc13a246976ec237a
SHA256

4b629433adccf6551963c73da2ca7bf320458d3b4148d4f0d3c1a4dbc4531abc
SHA512

a7255aa1679b30d12ee0efa5ae9a16e526c4acd491734422c8fc1fd859cc5551b6c23c0302c6104f600f39edef78ad5e88a4ae6722f3e8d23a97395a068a5358
SSDEEP

6144:Slf8aV+1AFV6rBU4CFUAx5tS8iYhVkSOAaJV:S18aV56OGAx5tS8iYhyV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
add8df24a1c38150f1fbb52a60c2f531_JaffaCakes118

Files

add8df24a1c38150f1fbb52a60c2f531_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

ec236edca0e9cd6d178b4dbcb2f859af

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\savxp\build\symbols\Release\DataControlPlugin.pdb

Imports

kernel32

DeleteFileW
LocalAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalFree
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FindNextFileW
lstrcmpW
GetUserDefaultLangID
InterlockedExchange
LoadLibraryExW
FindFirstFileW
FindClose
GetModuleFileNameW
EnterCriticalSection
lstrcpynW
InterlockedIncrement
FindResourceExW
LoadResource
DeleteCriticalSection
GetLocaleInfoW
LockResource
GetUserDefaultLCID
lstrlenA
SizeofResource
RaiseException
GetProcessHeap
HeapFree
InitializeCriticalSection
GlobalUnlock
FindResourceW
CreateThread
FormatMessageW
GlobalLock
HeapAlloc
GetVersionExW
FreeLibrary
lstrcmpiW
MultiByteToWideChar
Sleep
CloseHandle
WaitForSingleObject
OpenEventW
LocalFree
GetLastError
GlobalAlloc
FlushInstructionCache
InterlockedDecrement
FatalAppExitW
SetLastError
GetNumberFormatW
WideCharToMultiByte
GetCurrentProcess
GetProcAddress
GetCurrentThreadId
lstrcpyW
LoadLibraryW
lstrlenW
LeaveCriticalSection
TerminateProcess

user32

SetClipboardData
GetWindow
SetForegroundWindow
InflateRect
DialogBoxParamW
EmptyClipboard
CallNextHookEx
IsCharAlphaNumericW
IsCharLowerW
SetWindowPlacement
GetParent
GetNextDlgTabItem
ScreenToClient
GetFocus
SetFocus
GetTopWindow
GetWindowThreadProcessId
EndDialog
CharUpperW
IsCharAlphaW
GetWindowTextLengthW
GetSysColor
GetWindowPlacement
UnregisterClassA
CallWindowProcW
LoadCursorW
GetDlgItemInt
ShowWindow
SetWindowsHookExW
GetWindowTextW
SetDlgItemTextW
CreateWindowExW
GetKeyState
IsRectEmpty
GetCursorPos
SetDlgItemInt
GetWindowLongW
GetDlgItem
DrawStateW
CopyRect
GetSystemMetrics
MessageBeep
EnableWindow
DrawFocusRect
DefWindowProcW
IsClipboardFormatAvailable
DestroyIcon
EndPaint
DestroyWindow
OpenClipboard
FrameRect
SetWindowPos
UnhookWindowsHookEx
BeginPaint
SendDlgItemMessageW
GetDC
MapWindowPoints
GetClipboardData
IsWindowEnabled
GetWindowDC
GetClientRect
IsWindow
GetWindowRect
SetWindowLongW
TabbedTextOutW
CloseClipboard
DrawTextW
GetClassNameW
ReleaseDC
ClientToScreen
IsWindowVisible
MoveWindow
GetDlgCtrlID
InvalidateRect
SetTimer
PtInRect
CharLowerW
DrawIconEx
LoadImageW
SetCursor
GetGUIThreadInfo
SetWindowTextW
ReleaseCapture
OffsetRect
MessageBoxW
SystemParametersInfoW
GetCapture
GetTabbedTextExtentW
MapDialogRect
SetRectEmpty
GetActiveWindow
PostMessageW
KillTimer
SetCapture
SendMessageW
RedrawWindow

gdi32

SelectClipRgn
GetObjectType
SelectObject
DeleteDC
SetTextAlign
ExtCreatePen
Polygon
TextOutW
CombineRgn
DeleteObject
CreateRectRgn
CreateFontIndirectW
SetROP2
CreateRectRgnIndirect
SetBkMode
GetTextExtentPoint32W
CreateCompatibleBitmap
GetTextMetricsW
CreateCompatibleDC
GetStockObject
SetPixel
PtInRegion
SetViewportOrgEx
ExtTextOutW
SetBkColor
CreateSolidBrush
CreatePen
SetTextColor
RoundRect
GetClipRgn
GetTextExtentExPointW
GetBkColor
GetObjectW
BitBlt

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VariantCopy
SysStringLen
VariantInit
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SysAllocString
SysStringByteLen
VariantClear
SysAllocStringLen
SysAllocStringByteLen
GetRecordInfoFromGuids
VariantCopyInd
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayCreateVectorEx
SafeArrayRedim
SafeArrayAccessData
DispCallFunc
SafeArrayGetElement
SafeArrayGetVartype
VarBstrCmp
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy

atl80

ord43
ord44
ord48
ord40
ord47
ord11
ord10
ord32
ord15
ord64
ord42
ord61
ord23
ord49
ord22
ord18
ord31

shlwapi

ColorAdjustLuma
StrChrW

comctl32

_TrackMouseEvent
ImageList_Destroy
ImageList_GetIcon
ImageList_Create
ImageList_Draw
ImageList_GetImageCount
ImageList_ReplaceIcon
InitCommonControlsEx

msimg32

GradientFill

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
memset
_CxxThrowException
wcsrchr
??0exception@std@@QAE@XZ
memcpy_s
vswprintf_s
wcstol
_set_errno
_encoded_null
_wcsicmp
malloc
??1exception@std@@UAE@XZ
_vscwprintf
??2@YAPAXI@Z
iswdigit
_wtol
_wcsupr_s
_wtoi
??0exception@std@@QAE@ABV01@@Z
_recalloc
calloc
??0exception@std@@QAE@ABQBD@Z
isdigit
swprintf_s
free
??_V@YAXPAX@Z
_purecall
iswprint
wcschr
iswspace
memmove_s
swscanf_s
wcsstr
_errno
??3@YAXPAX@Z
_initterm
_initterm_e
_amsg_exit
__CxxFrameHandler3
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?what@exception@std@@UBEPBDXZ
memcpy
__clean_type_info_names_internal

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec236edca0e9cd6d178b4dbcb2f859af

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

atl80

shlwapi

comctl32

msimg32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 194KB - Virtual size: 193KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 1024B - Virtual size: 6KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 194KB - Virtual size: 193KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 1024B - Virtual size: 6KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 25KB - Virtual size: 25KB