de5a7df19d30b9e48f87c94397212e19_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

de5a7df19d30b9e48f87c94397212e19_JaffaCakes118
Size

1.1MB
MD5

de5a7df19d30b9e48f87c94397212e19
SHA1

e65d9f53f0bf39806b2189788fb88199364c02fc
SHA256

c1a501aff33c666b21e18a74ed2cd87c0f12b817fa8cbdfef4c934fda6b4a2d5
SHA512

67dd2469cf5cffb84cd2630cdde2b2b07a0010c36a11ae432eaa108e5e65ffa9abd4e4ac651c17c547e6db09819927c8d9f247ba7c93e3a96b76cb803e04cc33
SSDEEP

24576:izMiZn8pSzxDGskp/daLTIaNK5O0lS2Cjf6:iFn8pSYDldaLTfK5OASVjy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de5a7df19d30b9e48f87c94397212e19_JaffaCakes118

Files

de5a7df19d30b9e48f87c94397212e19_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

7085816a898f1750a6eaf8e1009fa629

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\100929_104220_build_Client_Build_PabstBlueRibbon_3.0.497.0\source\source_BrowserExtension\bin\ShopperReports_Release\ShopperReports.pdb

Imports

kernel32

InterlockedExchange
CompareStringA
LoadLibraryA
GetCurrentProcessId
GetThreadLocale
GetModuleHandleA
GetTickCount
GetProcessHeap
HeapAlloc
LoadResource
SizeofResource
FreeLibrary
InterlockedDecrement
SetThreadLocale
InterlockedIncrement
GetLastError
DeleteCriticalSection
InitializeCriticalSection
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
SetEnvironmentVariableA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
HeapCreate
GetModuleFileNameA
GetStdHandle
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
LCMapStringA
GetCommandLineA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemInfo
VirtualProtect
RtlUnwind
GetSystemTimeAsFileTime
HeapSize
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapReAlloc
GetCurrentThread
IsBadWritePtr
VirtualQuery
SetUnhandledExceptionFilter
ReleaseSemaphore
GlobalHandle
GlobalFree
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
GetFileSize
SetEndOfFile
CreateThread
TerminateThread
SetThreadPriority
ResumeThread
GetFileTime
SystemTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrlenA
SetFileTime
Sleep
LockResource
FileTimeToSystemTime
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
ResetEvent
SetEvent
ReleaseMutex
WaitForSingleObject
HeapFree
CloseHandle

advapi32

GetTokenInformation
OpenProcessToken
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey

user32

MoveWindow
GetWindowRect
IsIconic
IsWindowVisible
EqualRect
UnregisterClassA
EnumWindows
UnhookWindowsHookEx
GetSystemMetrics
SetRect
GetWindowThreadProcessId
AnimateWindow
OffsetRect
EnumChildWindows
ShowWindow
SetTimer
MapWindowPoints
DestroyWindow
IsWindow
GetParent
SetRectEmpty
GetSysColorBrush
SetWindowRgn
InflateRect
CopyRect
BringWindowToTop
GetKeyState
ReplyMessage
GetTopWindow
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
GetSysColor
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetDlgItem
ReleaseCapture
FillRect
EndPaint
BeginPaint
GetDesktopWindow
DestroyAcceleratorTable
SetFocus
GetFocus
TranslateMessage
UpdateWindow
KillTimer

gdi32

CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
GetDeviceCaps
CreateSolidBrush
SetDIBColorTable
CreateDIBSection
GetStockObject
CreateRectRgn
CombineRgn
CreatePolygonRgn
DeleteDC
CreateCompatibleDC
FillRgn
OffsetRgn
CreateRoundRectRgn

pltfrm

?GetParams@XUrlFormat@@QAE?AVCComBSTR@ATL@@XZ
?SetUrl@XUrlFormat@@QAEXPA_W@Z
?GetServer@XUrlFormat@@QAE?AVCComBSTR@ATL@@XZ
?GetPath@XUrlFormat@@QAE?AVCComBSTR@ATL@@XZ
??0XUrlFormat@@QAE@PAUIXMLDOMNode@MSXML2@@@Z
?GetUrlWithoutFormat@XUrlFormat@@QAE?AVCComBSTR@ATL@@XZ
??1XUrlFormat@@UAE@XZ
?GetCid@InstlrUtl@@YA?AVCComBSTR@ATL@@XZ
?GetIeUserAgent@UsrAgnt@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@_N@Z
?ExtractParam@InstlrUtl@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V23@0_N@Z
?GetFrmtdDateTime@PlatformUtils@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@_J@Z
?GetUsrInf@InstlrUtl@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABV23@PAUIGuru@@@Z
?getUsrAgnt@UsrAgnt@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@_N@Z
?SetUrl@XUrlFormat@@QAEXPAUIXMLDOMNode@MSXML2@@@Z
??0XUrlFormat@@QAE@XZ
?BstrFromClsid@PlatformUtils@@YA?AVCComBSTR@ATL@@ABU_GUID@@@Z
?SetGuru@XUrlFormat@@QAEXPAUIGuru@@@Z

iphlpapi

GetAdaptersInfo

comctl32

ImageList_ReplaceIcon
ImageList_GetImageCount
_TrackMouseEvent

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
StringFromCLSID
StringFromGUID2
CoCreateGuid
ProgIDFromCLSID
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
OleRun
GetRunningObjectTable
CreateItemMoniker
CoTaskMemFree

oleaut32

LoadTypeLi
VarBstrCmp
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
VectorFromBstr
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
OleCreateFontIndirect
CreateErrorInfo
SetErrorInfo
SafeArrayPutElement
SafeArrayCreate
BstrFromVector
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VarUI4FromStr
LoadRegTypeLi
VariantCopy
VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
VarBstrCat
VariantChangeType

shlwapi

PathFileExistsW

ws2_32

WSACleanup
freeaddrinfo
WSAEnumNetworkEvents
WSACloseEvent
getaddrinfo
WSASetLastError
WSASocketW
closesocket
WSAStartup
WSACreateEvent
WSASetEvent
WSAEventSelect
WSAGetLastError
WSAConnect
WSAGetOverlappedResult
WSASend
WSARecv
WSAResetEvent

gdiplus

GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCloneImage
GdipDisposeImage

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

sensapi

IsNetworkAlive

version

GetFileVersionInfoSizeA
GetFileVersionInfoA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllSendIdsRequestAbort
DllSendIdsRequestAlreadyInstalled
DllSendIdsRequestCancel
DllSendIdsRequestInstalledOnVista
DllSendIdsRequestOk
DllSendUninstallReport
DllUnregisterServer

Sections

.text
Size: 651KB - Virtual size: 650KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7085816a898f1750a6eaf8e1009fa629

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

gdi32

pltfrm

iphlpapi

comctl32

ole32

oleaut32

shlwapi

ws2_32

gdiplus

shell32

sensapi

version

Exports

Exports

Sections

.text Size: 651KB - Virtual size: 650KB

.rdata Size: 226KB - Virtual size: 226KB

.data Size: 41KB - Virtual size: 55KB

.rsrc Size: 103KB - Virtual size: 103KB

.reloc Size: 70KB - Virtual size: 70KB

.text
Size: 651KB - Virtual size: 650KB

.rdata
Size: 226KB - Virtual size: 226KB

.data
Size: 41KB - Virtual size: 55KB

.rsrc
Size: 103KB - Virtual size: 103KB

.reloc
Size: 70KB - Virtual size: 70KB