d294085a13ae1b5b9fad913c44d6d861_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d294085a13ae1b5b9fad913c44d6d861_JaffaCakes118
Size

172KB
MD5

d294085a13ae1b5b9fad913c44d6d861
SHA1

ddc53a0359f0358b58c869baf430590d88f3d2ee
SHA256

c54dd08a9207b9cc5b271ceaf40f74754e10a83b81e95a1e679bcbae4ee1a791
SHA512

488805c6df09849baaf477f05a5a21c84e5fe6b9b2e44dd28a2b766ff3c403fb23ba93820ced44def817e413e410ab4adfc0f9c1b8288b95d897f62b00f3e04c
SSDEEP

3072:V1mC5YxBjhHYnBm1ZkvzEbgiSu0eS5ObqUIiNHCnXR+YvBnd+w6+w6+w6+yd+oPP:jDwBjh4A8vA8VmqZgHwB+EC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d294085a13ae1b5b9fad913c44d6d861_JaffaCakes118

Files

d294085a13ae1b5b9fad913c44d6d861_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

49c682e127ba3620d14b7828d144dfc4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BUILD_~1\jdk6_29\control\build\WINDOW~1\tmp\deploy\plugin\axbridge\obj\axbridge.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA

kernel32

OutputDebugStringA
lstrlenW
ResetEvent
CreateEventA
SetEvent
CloseHandle
GetLastError
LoadLibraryA
lstrcatA
GetProcAddress
SystemTimeToFileTime
GetSystemTime
MulDiv
FindResourceA
GetModuleFileNameA
LockResource
LoadResource
GetModuleHandleA
FreeLibrary
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
LocalFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
ExitProcess
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
lstrcpyA
GetCurrentProcess
FlushInstructionCache
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
SizeofResource

user32

IsWindowUnicode
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
PeekMessageA
LoadCursorA
wsprintfA
GetClassInfoExA
IsChild
SetWindowLongA
UnregisterClassA
SetPropA
GetWindowThreadProcessId
GetMessageW
RemovePropA
SetWindowsHookExA
UnhookWindowsHookEx
GetPropA
IsIconic
IsWindowVisible
BringWindowToTop
SetForegroundWindow
CallNextHookEx
GetSysColor
MoveWindow
CharNextA
WinHelpA
IsDialogMessageA
GetClientRect
GetKeyState
CallWindowProcA
GetDC
ReleaseDC
UnionRect
PtInRect
DefWindowProcA
GetWindowLongA
SetParent
GetDesktopWindow
CreateWindowExA
RegisterClassExA
IsWindow
ShowWindow
WindowFromDC
InvalidateRect
GetParent
GetFocus
SetFocus
DestroyWindow
EnableWindow
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
PostMessageA
BeginPaint
EndPaint
MsgWaitForMultipleObjects
SendMessageA

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CLSIDFromString
StringFromCLSID
OleSaveToStream
WriteClassStm
OleRegGetMiscStatus
OleLoadFromStream

oleaut32

SysAllocStringLen
OleCreatePropertyFrame
OleCreateFontIndirect
OleTranslateColor
SafeArrayCreate
LoadTypeLi
LoadRegTypeLi
SysAllocString
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysAllocStringByteLen
SysStringByteLen
VarUI4FromStr
SysFreeString

msvcr71

__security_error_handler
__CppXcptFilter
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
?terminate@@YAXXZ
memset
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
wcsncpy
memmove
sprintf
strncat
realloc
??2@YAPAXI@Z
??_U@YAPAXI@Z
_purecall
__CxxFrameHandler
_CxxThrowException
_resetstkoflw
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
free
_except_handler3

gdi32

BitBlt
SelectObject
CreateBitmap
CreateCompatibleDC
DeleteObject
DeleteMetaFile
PlayMetaFile
CloseMetaFile
SetMapMode
CreateMetaFileA
GetDeviceCaps
GetStockObject
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SaveDC
LPtoDP
CreateDCA
CreateRectRgnIndirect

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_Java_sun_plugin_com_DispatchImpl_getWindowHandle@12
_Java_sun_plugin_com_event_COMEventHandler_nativeNotifyEvent@20
_Java_sun_plugin_com_event_COMEventHandler_nativeNotifyProperty@16
_Java_sun_plugin_com_event_COMEventHandler_nativeNotifyVetoable@16
_Java_sun_plugin_services_WPlatformService_dispatchNativeEvent@8
_Java_sun_plugin_viewer_AxBridgeObject_notifyStatusChange@16
_Java_sun_plugin_viewer_frame_AxBridgeEmbeddedFrame_transferFocus@16
_Java_sun_plugin_viewer_frame_IExplorerEmbeddedFrame_activateBrowserWindow@12
_Java_sun_plugin_viewer_frame_IExplorerEmbeddedFrame_enableModeless@24

Sections

.text
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49c682e127ba3620d14b7828d144dfc4

Headers

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

ole32

oleaut32

msvcr71

gdi32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 61KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 60KB - Virtual size: 61KB

.rsrc Size: 12KB - Virtual size: 10KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 64KB - Virtual size: 61KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 60KB - Virtual size: 61KB

.rsrc
Size: 12KB - Virtual size: 10KB

.reloc
Size: 8KB - Virtual size: 6KB