de09d78934d7a17d3675b15cc1ed89e0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

de09d78934d7a17d3675b15cc1ed89e0_JaffaCakes118
Size

2.8MB
MD5

de09d78934d7a17d3675b15cc1ed89e0
SHA1

b92c7deeb83ed322147afbd19f33fd7d5ed5726d
SHA256

f424334b9b223f8eff36ae75942f04a807f58e9754797b3213861aa0c296e989
SHA512

82bf7d7aa5d4a7d190fcbf82e9a1f71788b2377e8ed0a0be80651ba479e86bc9cf4ed7951e54acfb475046405718f5c306dd9b0cd5e8e7baf7f35c7e5ed85902
SSDEEP

49152:oKcc3rysBzrswhd0ITGd90wk6tQ73ixCkN9dPn+MmAvgNjffyv8lyQvh96zQs7A:X3hhUxhGhzfSN7A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de09d78934d7a17d3675b15cc1ed89e0_JaffaCakes118

Files

de09d78934d7a17d3675b15cc1ed89e0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2fa5d8de02b17d4ae5159fbbc8919473

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\coretech\source\springsteen\amt\build\alm\vc8\out\release_Win32\adobelm\adobelm.pdb

Imports

winhttp

WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpSetStatusCallback
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl

shlwapi

PathRemoveBackslashA
PathRemoveFileSpecW

kernel32

SetLastError
InterlockedDecrement
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapSize
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FlushFileBuffers
GetFullPathNameW
GetCurrentDirectoryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryA
GetLocaleInfoA
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
FreeLibrary
InterlockedExchange
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
CreateFileW
SetEndOfFile
GetDriveTypeA
GetFullPathNameA
CompareStringA
TlsGetValue
SetEnvironmentVariableA
GetLocalTime
GetModuleFileNameW
GetModuleHandleW
GetFileSize
lstrlenW
FlushInstructionCache
lstrcpyW
lstrcmpiW
GlobalUnlock
GlobalLock
lstrlenA
LoadLibraryW
GetFileAttributesW
GetVersion
OutputDebugStringA
MulDiv
GetComputerNameW
GetSystemInfo
GlobalMemoryStatus
GetWindowsDirectoryA
WaitForSingleObject
ResetEvent
InterlockedIncrement
ReleaseMutex
CreateMutexA
GetCommandLineW
GetEnvironmentVariableA
GetEnvironmentVariableW
SetErrorMode
SetHandleInformation
FormatMessageA
GetSystemDirectoryA
GetProcessTimes
FindFirstFileA
FindNextFileW
FindNextFileA
GetVolumeInformationA
GetPrivateProfileStringA
GetPrivateProfileIntA
DeviceIoControl
GetSystemTime
SystemTimeToFileTime
LocalAlloc
LocalFree
SearchPathA
CreateSemaphoreA
OpenSemaphoreA
ReleaseSemaphore
lstrcmpA
lstrcpyA
CreateProcessA
GetProcAddress
GetModuleHandleA
InterlockedCompareExchange
IsProcessorFeaturePresent
GetModuleFileNameA
GetStdHandle
WriteFile
GetProcessHeap
GetVersionExA
GetCommandLineA
GetCurrentThreadId
FindFirstFileW
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
GetDateFormatA
GetTimeFormatA
HeapReAlloc
RtlUnwind
HeapAlloc
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
GetSystemTimeAsFileTime
GetTempPathW
GetTimeZoneInformation
WideCharToMultiByte
VirtualProtect
VirtualQuery
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
GetLastError
WaitForMultipleObjects
SetEvent
GlobalFree
MultiByteToWideChar
GetTickCount
GetComputerNameExW
CreateThread
GetVersionExW
CloseHandle
TlsFree
TlsSetValue
CreateEventA
TlsAlloc
DuplicateHandle
MoveFileA
MoveFileW
DeleteFileA
DeleteFileW
ExitThread
ResumeThread
GetFileAttributesA
CreatePipe
SetEnvironmentVariableW
IsDBCSLeadByteEx
CompareStringW

user32

SetActiveWindow
GetMessageW
DispatchMessageW
TranslateMessage
IsDialogMessageW
DestroyIcon
MessageBoxW
GetNextDlgTabItem
GetAsyncKeyState
GetPropW
SetPropW
CopyImage
LoadImageW
GetSystemMetrics
DeleteMenu
GetMenuItemID
GetMenuItemCount
GetAncestor
GetDlgItemTextW
PostQuitMessage
MessageBoxA
GetActiveWindow
SendMessageA
GetWindowLongA
SetDlgItemTextA
GetDlgItemTextA
EndDialog
SetWindowTextA
wsprintfA
CreateDialogIndirectParamA
DialogBoxIndirectParamA
SetForegroundWindow
BringWindowToTop
ShowWindow
MoveWindow
EnableWindow
IsWindowVisible
LockWindowUpdate
MapWindowPoints
MessageBeep
GetSystemMenu
EnableMenuItem
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
LoadStringW
OpenClipboard
UnregisterClassW
SendDlgItemMessageW
GetFocus
GetCapture
ReleaseCapture
GetCursorPos
SetCursor
DrawFocusRect
CallWindowProcW
PtInRect
GetDlgCtrlID
SetCapture
UnregisterClassA
UpdateWindow
ScreenToClient
DestroyWindow
LoadCursorW
SetRectEmpty
OffsetRect
DefWindowProcW
ReleaseDC
GetDC
CharNextW
DrawTextW
GetSysColor
SetWindowPos
IsWindow
GetParent
InvalidateRect
GetClientRect
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
CreateWindowExW
SetWindowLongW
SetWindowTextW
KillTimer
SetTimer
GetDlgItem
PostMessageW
SendMessageW
GetSysColorBrush
GetUpdateRect
FillRect
EndPaint
GetTopWindow
SetFocus
RegisterClassW
InflateRect
EnumChildWindows
GetClassNameW
SystemParametersInfoW
GetWindowLongW
CheckDlgButton
GetClassLongW
SetDlgItemTextW
SetClassLongW
BeginPaint
IsWindowEnabled

gdi32

GetDeviceCaps
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
CreatePen
MoveToEx
LineTo
Rectangle
SetMapMode
CreateCompatibleBitmap
CreateSolidBrush
SetLayout
GetBitmapBits
GetPixel
SetPixel
GetLayout
BitBlt
StretchBlt
SetBrushOrgEx
CreatePatternBrush
RoundRect
SetTextColor
SetBkMode
GetStockObject
CreateFontIndirectW
CreateDIBSection
CreateCompatibleDC
GetObjectW
SetDIBColorTable
SelectObject
GetTextExtentExPointW
DeleteObject
DeleteDC

comdlg32

GetOpenFileNameA

advapi32

RegQueryValueExA
RegEnumKeyExA
GetUserNameW
GetUserNameA
RegSetValueExW
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegEnumValueA
RegOpenKeyExW
RegDeleteValueA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExW

shell32

ShellExecuteW
ShellExecuteA

gdiplus

GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits

msimg32

AlphaBlend

imm32

ImmReleaseContext
ImmGetContext
ImmSetOpenStatus

wsock32

htonl
gethostname
inet_addr
getservbyname
htons
ioctlsocket
ntohl
gethostbyname
gethostbyaddr
getservbyport
ntohs
WSACleanup
WSAStartup
getsockname
getsockopt
__WSAFDIsSet
select
connect
socket
closesocket
recv
send
inet_ntoa
setsockopt
WSAGetLastError

comctl32

ord17
_TrackMouseEvent

netapi32

Netbios

Exports

Exports

AdobeLM_GetVersion
AdobeLM_Info_GetErrorCode
AdobeLM_Info_GetLicense
AdobeLM_Info_SetLicense
AdobeLM_Initialize
AdobeLM_License_PreLoadValidationWF
AdobeLM_License_RunReturnWF
AdobeLM_License_RunValidationWF
AdobeLM_Terminate

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textidx
Size: 616KB - Virtual size: 614KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CONST
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_dir
Size: 4KB - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fnp_mar
Size: 4KB - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2fa5d8de02b17d4ae5159fbbc8919473

Headers

File Characteristics

PDB Paths

Imports

winhttp

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

gdiplus

msimg32

imm32

wsock32

comctl32

netapi32

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.textidx Size: 616KB - Virtual size: 614KB

CONST Size: 4KB - Virtual size: 80B

.rdata Size: 228KB - Virtual size: 226KB

.data Size: 152KB - Virtual size: 497KB

.data1 Size: 4KB - Virtual size: 260B

.fnp_dir Size: 4KB - Virtual size: 116B

.fnp_mar Size: 4KB - Virtual size: 1B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 124KB - Virtual size: 122KB

.text Size: 168KB - Virtual size: 168KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.textidx
Size: 616KB - Virtual size: 614KB

CONST
Size: 4KB - Virtual size: 80B

.rdata
Size: 228KB - Virtual size: 226KB

.data
Size: 152KB - Virtual size: 497KB

.data1
Size: 4KB - Virtual size: 260B

.fnp_dir
Size: 4KB - Virtual size: 116B

.fnp_mar
Size: 4KB - Virtual size: 1B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 124KB - Virtual size: 122KB

.text
Size: 168KB - Virtual size: 168KB