b0138268e443a3fd88f81edf42ac3ebf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b0138268e443a3fd88f81edf42ac3ebf_JaffaCakes118
Size

441KB
MD5

b0138268e443a3fd88f81edf42ac3ebf
SHA1

e9c7e1530f80a828ddac6c4ece94060930761446
SHA256

9bbf970652781fcf7fd3c21717a0333eb1e060508ff591ea00120c0431a053c3
SHA512

2e536348999c72f5308bad4de6017db54d326d7a2f527c1071a39e27ecca587461634da85f459164083af4490b0de2951d8b0a4a8f5c4a78e936c55500c9cbf7
SSDEEP

6144:QApOIz/zu/fetNTI4WSYaSqXtMfl793ohjvSrfl/AOnpsD1pgkaHi80I2J5bJmdn:6w/yfet1HY1RQdPN2U3gzPcw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0138268e443a3fd88f81edf42ac3ebf_JaffaCakes118

Files

b0138268e443a3fd88f81edf42ac3ebf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7521b9ac131b259252e342b04a0d3202

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BUILD_~1\jdk6_11\control\build\WINDOW~1\tmp\deploy\plugin\jucheck\obj\jucheck.pdb

Imports

advapi32

RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyA
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CryptMsgClose
CertCloseStore

version

VerQueryValueA
GetFileVersionInfoA

user32

GetClientRect
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
MapDialogRect
SetWindowContextHelpId
GetWindowRect
PtInRect
SetCursor
GetDlgCtrlID
LoadBitmapA
EnableWindow
EndDialog
RegisterClassA
ShowWindow
PostQuitMessage
CreatePopupMenu
AppendMenuA
GetCursorPos
SetForegroundWindow
TrackPopupMenu
PostMessageA
GetSystemMetrics
LoadImageA
DialogBoxIndirectParamA
RegisterWindowMessageA
FillRect
GetWindowTextA
CallWindowProcA
UnregisterClassA
MessageBoxA
LoadStringA
CharNextA
wsprintfA
GetDesktopWindow
PeekMessageA
DispatchMessageA
DispatchMessageW
TranslateMessage
GetMessageA
GetMessageW
IsWindowUnicode
MsgWaitForMultipleObjects
SetWindowLongA
GetWindowLongA
EndPaint
BeginPaint
SetFocus
GetWindow
IsChild
GetFocus
DestroyAcceleratorTable
SendMessageA
DefWindowProcA
GetSysColor
SetCapture
GetWindowTextLengthA
SetWindowTextA
RegisterClassExA
GetClassInfoExA
LoadCursorA
CreateWindowExA
CreateAcceleratorTableA
GetParent
GetClassNameA
SetWindowPos
DestroyWindow
RedrawWindow
GetDlgItem
IsWindow
ReleaseCapture

gdi32

StretchBlt
SetTextColor
SaveDC
SetGraphicsMode
ModifyWorldTransform
SetViewportOrgEx
SetWindowOrgEx
DPtoLP
CreateFontIndirectA
RestoreDC
CreateSolidBrush
GetStockObject
GetObjectA
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
SetBkMode

comctl32

ord17

wintrust

WinVerifyTrust

wininet

InternetTimeToSystemTime
InternetReadFile
InternetGetConnectedState
InternetOpenA
InternetErrorDlg
HttpAddRequestHeadersA
InternetTimeFromSystemTime
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA

urlmon

URLDownloadToFileA

shell32

Shell_NotifyIconA
ShellExecuteA

kernel32

FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetCPInfo
GetOEMCP
GetTimeZoneInformation
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
CompareStringW
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
HeapReAlloc
SetEnvironmentVariableA
VirtualAlloc
GetEnvironmentStrings
RtlUnwind
CreatePipe
SetHandleInformation
ReadFile
GetCurrentProcessId
GetTickCount
LocalFree
GetEnvironmentVariableA
GetTempPathA
GetSystemInfo
LoadLibraryA
GetProcAddress
OpenEventA
GetSystemTime
CreateEventA
CreateThread
ResetEvent
WaitForMultipleObjects
SetEvent
LockResource
GlobalHandle
GlobalFree
SetLastError
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
VirtualProtect
CompareStringA
VirtualQuery
TerminateProcess
GlobalLock
GlobalUnlock
MulDiv
GetCurrentThreadId
FormatMessageA
DeleteFileA
CreateProcessA
GetExitCodeProcess
GlobalAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
lstrcpyA
lstrcatA
CreateFileA
GetFileSize
GetFileTime
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
CreateMutexA
lstrcmpiA
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetModuleHandleA
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
lstrcmpA
WriteFile
WaitForSingleObject
SetEndOfFile
SetFilePointer
CompareFileTime
SystemTimeToFileTime
Sleep
FileTimeToSystemTime

ole32

StringFromCLSID
OleUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
StringFromGUID2
CoInitializeSecurity
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
OleLockRunning

oleaut32

LoadTypeLi
LoadRegTypeLi
VariantInit
VariantClear
OleCreateFontIndirect
SysStringByteLen
SysStringLen
SysAllocString
SysAllocStringLen
VarUI4FromStr
SysFreeString

Sections

.text
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.krdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7521b9ac131b259252e342b04a0d3202

Headers

File Characteristics

PDB Paths

Imports

advapi32

crypt32

version

user32

gdi32

comctl32

wintrust

wininet

urlmon

shell32

kernel32

ole32

oleaut32

Sections

.text Size: 120KB - Virtual size: 117KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 204KB - Virtual size: 200KB

.krdata Size: 68KB - Virtual size: 68KB

.text
Size: 120KB - Virtual size: 117KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 204KB - Virtual size: 200KB

.krdata
Size: 68KB - Virtual size: 68KB