bf8ccb0fca96644d583eb073e4c7a3fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bf8ccb0fca96644d583eb073e4c7a3fe_JaffaCakes118
Size

1.0MB
MD5

bf8ccb0fca96644d583eb073e4c7a3fe
SHA1

fb1bef16c0ac9018038605644ee9366a0a036967
SHA256

403c004a78b67c999981a57329df9fec1c8fb2c3ce36ea3660386b22d624941c
SHA512

a6c4cdb221e60e43f36e2d577d66f564c0de364141191d1b4dcaa588df4988a2631c7be054e9ce24c766ed8745e5bbb9147c00f5067b64be1fd442d01a76a5c3
SSDEEP

24576:X7q+YVIaklsz3lTryeZGumURAQD3Acmv9UzbnJNojMRVkF:KKaklI1GLuzA5uvnYFF

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack002/Rewrite/ISAPI_Rewrite.dll	aspack_v212_v242
static1/unpack002/Rewrite/rwhelper.dll	aspack_v212_v242

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Rewrite/ISAPI_Rewrite.dll
unpack002/Rewrite/ISRWConfig.exe
unpack002/Rewrite/RXTest.exe
unpack002/Rewrite/RewriteMSG.dll
unpack002/Rewrite/mtbnotif.dll
unpack002/Rewrite/rwhelper.dll

Files

bf8ccb0fca96644d583eb073e4c7a3fe_JaffaCakes118
.rar
php极速链程序开源版v2.20110303/.htaccess
php极速链程序开源版v2.20110303/Rewrite.rar
.rar
Rewrite/ISAPI_Rewrite.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetFilterVersion
HttpFilterProc
TerminateFilter

Sections

Size: 69KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 59KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 110KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Rewrite/ISAPI_Rewrite.lic
Rewrite/ISRWConfig.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 63KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 15KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 59KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Rewrite/RXTest.exe
.exe windows:4 windows x86 arch:x86

4d776397629b75a4e57c5e1988cb4423

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetThreadLocale
GetVersionExA
InterlockedIncrement
lstrlenW
GetModuleHandleA
MultiByteToWideChar
GetModuleFileNameA
GetLastError
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
SetFilePointer
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetCPInfo
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetLocaleInfoA
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetProcAddress
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
RtlUnwind
ExitProcess
LoadLibraryA
GetStringTypeA
GetUserDefaultLCID
LCMapStringW
LCMapStringA
GetStringTypeW
GetACP
SetStdHandle
InterlockedExchange
FlushFileBuffers
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
InterlockedDecrement
HeapFree
LeaveCriticalSection
lstrcmpiA
EnterCriticalSection
lstrlenA
lstrcpyA
GetProcessHeap
HeapAlloc
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSection
WriteFile
RaiseException

user32

PeekMessageA
CreateDialogParamA
LoadStringA
GetMessageA
DispatchMessageA
ShowWindow
GetActiveWindow
GetFocus
DrawFocusRect
EndPaint
BeginPaint
FillRect
InvalidateRect
PtInRect
SetCursor
SetCapture
GetCapture
ReleaseCapture
GetCursorPos
ScreenToClient
CallWindowProcA
GetSystemMetrics
LoadImageA
DialogBoxParamA
SetRectEmpty
DestroyCursor
DefWindowProcA
MessageBeep
SetFocus
PostQuitMessage
CharLowerA
CharUpperA
IsDialogMessageA
SetDlgItemTextA
DestroyWindow
GetClassNameA
CreateCursor
IsWindow
OffsetRect
ReleaseDC
GetDC
UnregisterClassA
DrawTextA
CharNextA
GetWindow
GetWindowRect
SystemParametersInfoA
MapWindowPoints
SetWindowPos
GetDlgItem
GetParent
GetClientRect
SendMessageA
GetWindowTextLengthA
GetWindowTextA
GetWindowLongA
CreateWindowExA
SetWindowLongA
EndDialog
TranslateMessage

gdi32

DeleteDC
SelectObject
DeleteObject
GetObjectA
CreateFontIndirectA
SetTextColor
SetBkMode

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Rewrite/RewriteMSG.dll
.dll windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Rewrite/httpd.ini
Rewrite/mtbnotif.dll
.dll regsvr32 windows:4 windows x86 arch:x86

51e2eea593f29536d344ac6544f56c04

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\helicon\ISAPI_Rewrite\mtbnotif\ReleaseUMinDependency\mtbnotif.pdb

Imports

kernel32

WaitForSingleObject
SetEvent
CreateEventW
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GetModuleFileNameW
DisableThreadLibraryCalls
ResetEvent
lstrcatW
CloseHandle
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
lstrcpyW
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
lstrcpynW
InterlockedExchange
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
LoadLibraryA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
IsBadCodePtr
GetVersionExA
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
SetUnhandledExceptionFilter
VirtualQuery
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsBadReadPtr

user32

LoadStringW
CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW

ole32

CoCreateInstance
ProgIDFromCLSID
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree

oleaut32

UnRegisterTypeLi
CreateErrorInfo
VarUI4FromStr
RegisterTypeLi
SetErrorInfo
LoadTypeLi
SysAllocString
SysFreeString

shlwapi

PathFindExtensionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Rewrite/proxycfg.vbs
.vbs
Rewrite/rwhelper.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetExtensionVersion
HttpExtensionProc
TerminateExtension

Sections

Size: 38KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 58KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 112KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Rewrite/rwhelper.dll.manifest
.xml
Rewrite/使用说明.txt
php极速链程序开源版v2.20110303/admin.php
php极速链程序开源版v2.20110303/cc.php
php极速链程序开源版v2.20110303/config.inc.php
php极速链程序开源版v2.20110303/httpd.ini
php极速链程序开源版v2.20110303/img/logo.gif
.gif
php极速链程序开源版v2.20110303/inc/Template.inc.php
php极速链程序开源版v2.20110303/inc/Template_class.php
.ps1
php极速链程序开源版v2.20110303/inc/Template_debug.php
php极速链程序开源版v2.20110303/inc/common.inc.php
.ps1
php极速链程序开源版v2.20110303/inc/common.inc_de.php
.ps1
php极速链程序开源版v2.20110303/inc/db_mysql.class.php
.js
php极速链程序开源版v2.20110303/inc/httpget.class.php
.js
php极速链程序开源版v2.20110303/inc/links.class.php
.js
php极速链程序开源版v2.20110303/inc/links.inc.php
php极速链程序开源版v2.20110303/inc/splitword.func.php
.js
php极速链程序开源版v2.20110303/inc/uri.inc.php
php极速链程序开源版v2.20110303/inc/uri.inc_de.php
php极速链程序开源版v2.20110303/inc/wwwdic.csv
php极速链程序开源版v2.20110303/index.php
php极速链程序开源版v2.20110303/index_de.php
php极速链程序开源版v2.20110303/install.php
php极速链程序开源版v2.20110303/js/clickout.js
.js
php极速链程序开源版v2.20110303/js/js.js
.js
php极速链程序开源版v2.20110303/js/tj.js
.js
php极速链程序开源版v2.20110303/keys.txt
php极速链程序开源版v2.20110303/template/end.html
php极速链程序开源版v2.20110303/template/end2.html
php极速链程序开源版v2.20110303/template/index.html
php极速链程序开源版v2.20110303/template/list.html
php极速链程序开源版v2.20110303/template/site.html
php极速链程序开源版v2.20110303/template/top.html
.html
php极速链程序开源版v2.20110303/up.php
php极速链程序开源版v2.20110303/www/1.txt
php极速链程序开源版v2.20110303/www/2.txt
php极速链程序开源版v2.20110303/www/3.txt
php极速链程序开源版v2.20110303/www/w.php
php极速链程序开源版v2.20110303/新云软件.url
.url
php极速链程序开源版v2.20110303/系统使用说明.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

Size: 69KB - Virtual size: 144KB

Size: 25KB - Virtual size: 28KB

Size: 59KB - Virtual size: 72KB

.rsrc Size: 1KB - Virtual size: 4KB

Size: 7KB - Virtual size: 12KB

.data Size: 110KB - Virtual size: 112KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

Size: 63KB - Virtual size: 120KB

Size: 15KB - Virtual size: 36KB

Size: 59KB - Virtual size: 80KB

.rsrc Size: 28KB - Virtual size: 28KB

.data Size: 116KB - Virtual size: 116KB

.adata Size: - Virtual size: 4KB

4d776397629b75a4e57c5e1988cb4423

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

Sections

.text Size: 100KB - Virtual size: 96KB

.rdata Size: 20KB - Virtual size: 17KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 16KB - Virtual size: 14KB

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 1024B - Virtual size: 616B

.reloc Size: 512B - Virtual size: 8B

51e2eea593f29536d344ac6544f56c04

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 44KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 5KB - Virtual size: 5KB

Headers

File Characteristics

Exports

Exports

Sections

Size: 38KB - Virtual size: 72KB

Size: 13KB - Virtual size: 16KB

Size: 58KB - Virtual size: 68KB

.rsrc Size: 1024B - Virtual size: 4KB

Size: 4KB - Virtual size: 8KB

.data Size: 112KB - Virtual size: 116KB

.adata Size: - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 4KB

.data
Size: 110KB - Virtual size: 112KB

.adata
Size: - Virtual size: 4KB

.rsrc
Size: 28KB - Virtual size: 28KB

.data
Size: 116KB - Virtual size: 116KB

.adata
Size: - Virtual size: 4KB

.text
Size: 100KB - Virtual size: 96KB

.rdata
Size: 20KB - Virtual size: 17KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 616B

.reloc
Size: 512B - Virtual size: 8B

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 4KB

.data
Size: 112KB - Virtual size: 116KB

.adata
Size: - Virtual size: 4KB