f57661b0b0fb7f940918ada0c0151f74_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f57661b0b0fb7f940918ada0c0151f74_JaffaCakes118
Size

203KB
MD5

f57661b0b0fb7f940918ada0c0151f74
SHA1

d9ea40290b2ac2a148dbe48ae8c21a94c33876b5
SHA256

ec2ec8150aec2fb89eff0863ea38b821995e0d1d38d551429d5e44b07a8b9e46
SHA512

4f63f73563b4999d6de250c9bd29e3f6122ea3db978af93917e99fc99cdd111a4610ed00aaccd8b9cc93f647088a52c00c9a84c337121d7cf4eaa5b78ac8136d
SSDEEP

3072:BV9hAi/4iLoUCRUckAbTC0shNZtndkf7FZGYCjS2JpUKmw:BN8t1BTC0sDU2U27F

Score

1^/10

Malware Config

Signatures

Files

f57661b0b0fb7f940918ada0c0151f74_JaffaCakes118
.dll windows:5 windows x86 arch:x86

eb56315761c7403edcd69d2606de3da5

Code Sign

6b:33:9f:da:07:cd:02:7e:b3:7f:f1:52:59:f1:5d:8c
Certificate

Issuer

CN=fvGjrF9V10D6Ftl

Not Before

02/04/2012, 07:34

Not After

31/12/2039, 23:59

Subject

CN=fvGjrF9V10D6Ftl

Extended Key Usages

ExtKeyUsageCodeSigning

db:68:8e:77:41:34:64:bd:4c:9b:b8:13:f0:af:d7:5c:58:d5:e5:8d
Signer

Actual PE Digest

db:68:8e:77:41:34:64:bd:4c:9b:b8:13:f0:af:d7:5c:58:d5:e5:8d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetWindowsDirectoryA
GetProcAddress
lstrcatA
CreateFileA
LoadLibraryA
LoadLibraryW
VirtualAlloc

user32

LoadCursorA
RegisterClassExA
CreateWindowExA
LoadIconA

gdi32

GetStockObject

comdlg32

ReplaceTextW
ReplaceTextA
PrintDlgW
PrintDlgExW
PrintDlgExA
PrintDlgA
PageSetupDlgW
PageSetupDlgA
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA
GetFileTitleW
GetFileTitleA
FindTextW
FindTextA
CommDlgExtendedError
ChooseFontW
ChooseFontA
ChooseColorW
ChooseColorA

ole32

WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserFree
UtGetDvtd32Info
UtGetDvtd16Info
UtConvertDvtd16toDvtd32
UpdateDCOMSettings
StringFromGUID2
StgPropertyLengthAsVariant
StgOpenStorageEx
StgOpenStorage
StgIsStorageILockBytes
StgIsStorageFile
StgGetIFillLockBytesOnILockBytes
StgCreateStorageEx
StgCreatePropStg
StgCreateDocfileOnILockBytes
StgConvertVariantToProperty
StgConvertPropertyToVariant
SetDocumentBitStg
SetConvertStg
STGMEDIUM_UserSize
SNB_UserUnmarshal
SNB_UserSize
SNB_UserMarshal
SNB_UserFree
RevokeDragDrop
ReleaseStgMedium
ReadStringStream
ReadFmtUserTypeStg
ReadClassStm
ReadClassStg
PropVariantCopy
PropVariantClear
OpenOrCreateStream
OleUninitialize
OleTranslateAccelerator
OleSetClipboard
OleSetAutoConvert
OleSaveToStream
OleRun
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
OleQueryLinkFromData
OleNoteObjectVisible
OleLoad
OleIsRunning
OleInitializeWOW
OleGetIconOfFile
OleGetIconOfClass
OleGetClipboard
OleGetAutoConvert
OleFlushClipboard
OleDuplicateData
OleDraw
OleDoAutoConvert
OleDestroyMenuDescriptor
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateLinkFromDataEx
OleCreateLinkFromData
OleCreateLinkEx
OleCreateFromFileEx
OleCreateFromFile
OleCreateFromDataEx
OleCreateEx
OleCreateEmbeddingHelper
OleCreateDefaultHandler
OleCreate
OleConvertOLESTREAMToIStorage
OleConvertIStorageToOLESTREAMEx
OleConvertIStorageToOLESTREAM
OleBuildVersion
MonikerRelativePathTo
MonikerCommonPrefixWith
MkParseDisplayName
IsEqualGUID
IIDFromString
HWND_UserUnmarshal
HWND_UserSize
HWND_UserMarshal
HPALETTE_UserUnmarshal
HMETAFILE_UserUnmarshal
HMETAFILE_UserSize
HMETAFILE_UserMarshal
HMETAFILE_UserFree
HMETAFILEPICT_UserUnmarshal
HMETAFILEPICT_UserSize
HMETAFILEPICT_UserMarshal
HMETAFILEPICT_UserFree
HMENU_UserUnmarshal
HMENU_UserSize
HMENU_UserFree
WriteClassStg
HICON_UserMarshal
HENHMETAFILE_UserSize
HENHMETAFILE_UserMarshal
HENHMETAFILE_UserFree
HDC_UserUnmarshal
HDC_UserMarshal
HBRUSH_UserMarshal
HBRUSH_UserFree
HBITMAP_UserUnmarshal
HBITMAP_UserSize
HBITMAP_UserFree
HACCEL_UserUnmarshal
HACCEL_UserSize
HACCEL_UserMarshal
GetHGlobalFromStream
GetHGlobalFromILockBytes
GetDocumentBitStg
GetConvertStg
GetClassFile
EnableHookObject
DoDragDrop
DllDebugObjectRPCHook
DcomChannelSetHResult
CreateStreamOnHGlobal
CreateStdProgressIndicator
CreateItemMoniker
CreateILockBytesOnHGlobal
CreateGenericComposite
CreateFileMoniker
CreateDataAdviseHolder
CreateBindCtx
CreateAntiMoniker
CoWaitForMultipleHandles
CoUnmarshalHresult
CoUnloadingWOW
CoUninitialize
CoTestCancel
CoTaskMemRealloc
CoTaskMemAlloc
CoSuspendClassObjects
CoSetProxyBlanket
CoSetCancelObject
CoRevokeMallocSpy
CoRevokeClassObject
CoRevertToSelf
CoReleaseServerProcess
CoReleaseMarshalData
CoRegisterSurrogate
CoRegisterPSClsid
CoRegisterMessageFilter
CoRegisterClassObject
CoRegisterChannelHook
CoReactivateObject
CoQueryReleaseObject
CoQueryProxyBlanket
CoQueryClientBlanket
CoQueryAuthenticationServices
CoMarshalInterThreadInterfaceInStream
CoMarshalHresult
CoLockObjectExternal
CoLoadLibrary
CoIsOle1Class
CoIsHandlerConnected
CoInitialize
CoImpersonateClient
CoGetObjectContext
CoGetMarshalSizeMax
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoGetCurrentProcess
CoGetCurrentLogicalThreadId
CoGetCancelObject
CoGetCallContext
CoGetApartmentID
CoFreeLibrary
CoFreeAllLibraries
CoFileTimeToDosDateTime
CoFileTimeNow
CoEnableCallCancellation
CoDosDateTimeToFileTime
CoDisconnectObject
CoCreateInstanceEx
CoCreateInstance
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoCancelCall
CoBuildVersion
CoAllowSetForegroundWindow
CoAddRefServerProcess
CLSIDFromString
CLSIDFromProgIDEx
CLIPFORMAT_UserUnmarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserFree
BindMoniker
WriteOleStg
WriteStringStream
HICON_UserSize
CreateOleAdviseHolder
CreatePointerMoniker

oleaut32

VarBstrFromUI1
VectorFromBstr
VariantInit
VariantCopyInd
VariantClear
VariantChangeTypeEx
VarXor
VarUI4FromUI2
VarUI4FromStr
VarUI4FromR8
VarUI4FromI4
VarUI4FromI2
VarUI4FromI1
VarUI4FromDisp
VarUI4FromDec
VarUI2FromUI4
VarUI2FromUI1
VarUI2FromR4
VarUI2FromI2
VarUI2FromI1
VarUI1FromR8
VarUI1FromR4
VarUI1FromI4
VarUI1FromI1
VarUI1FromDisp
VarUI1FromDate
VarUI1FromBool
VarTokenizeFormatString
VarSu
VarRound
VarR8Round
VarR8Pow
VarR8FromUI2
VarR8FromI1
VarR8FromDisp
VarR8FromDec
VarR8FromDate
VarR8FromCy
VarR4FromUI4
VarR4FromUI1
VarR4FromStr
VarR4FromR8
VarR4FromI4
VarR4FromI1
VarR4FromDisp
VarR4FromDate
VarR4FromBool
VarPow
VarParseNumFromStr
VarNot
VarNeg
VarMul
VarMod
VarInt
VarImp
VarI4FromUI2
VarI4FromUI1
VarI4FromStr
VarI4FromR8
VarI4FromR4
VarI4FromI2
VarI4FromDisp
VarI4FromDate
VarI4FromCy
VarI2FromUI4
VarI2FromUI2
VarI2FromUI1
VarI2FromR8
VarI2FromI4
VarI2FromI1
VarI2FromDisp
VarI2FromDec
VarI2FromBool
VarI1FromUI4
VarI1FromStr
VarI1FromR8
VarI1FromR4
VarI1FromI4
VarI1FromDisp
VarI1FromDec
VarI1FromDate
VarFormatPercent
VarFormatNumber
VarFormatDateTime
VarFormatCurrency
VarEqv
VarDiv
VarDecMul
VarDecInt
VarDecFromStr
VarDecFromR4
VarDecFromI4
VarDecFromI2
VarDecFromDisp
VarDecFromDate
VarDecFix
VarDecCmpR8
VarDecAdd
VarDateFromUI2
VarDateFromUI1
VarDateFromStr
VarDateFromR8
VarDateFromR4
VarDateFromI4
VarDateFromI2
VarDateFromDec
VarDateFromCy
VarCySu
VarCyRound
VarCyNeg
VarCyMul
VarCyFromUI2
VarCyFromStr
VarCyFromR8
VarCyFromR4
VarCyFromI4
VarCyFromI2
VarCyFromI1
VarCyFromDisp
VarCyFromDate
VarCyCmpR8
VarCyCmp
VarCyAdd
VarCmp
VarCat
BSTR_UserFree
BSTR_UserSize
BSTR_UserUnmarshal
BstrFromVector
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
DosDateTimeToVariantTime
GetActiveObject
GetAltMonthNames
GetErrorInfo
GetRecordInfoFromGuids
LHashValOfNameSys
LPSAFEARRAY_Size
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserUnmarshal
LoadRegTypeLi
LoadTypeLibEx
OACreateTypeLib2
OleCreatePictureIndirect
OleCreatePropertyFrame
OleCreatePropertyFrameIndirect
VarBstrFromUI2
OleLoadPicture
OleLoadPictureEx
OleLoadPictureFile
OleLoadPicturePath
OleTranslateColor
RegisterActiveObject
RegisterTypeLi
SafeArrayAllocDescriptor
SafeArrayAllocDescriptorEx
SafeArrayCopy
SafeArrayCopyData
SafeArrayCreate
SafeArrayCreateEx
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayDestroyDescriptor
SafeArrayGetDim
SafeArrayGetElement
SafeArrayGetIID
SafeArrayPtrOfIndex
SafeArrayRedim
SafeArraySetIID
SafeArrayUnaccessData
SafeArrayUnlock
SetErrorInfo
SysAllocString
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringByteLen
SysStringLen
SystemTimeToVariantTime
VARIANT_UserMarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
VarAnd
VarBoolFromCy
VarBoolFromDec
VarBoolFromDisp
VarBoolFromI2
VarBoolFromR4
VarBoolFromR8
VarBoolFromStr
VarBoolFromUI4
VarBstrCmp
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarBstrFromDisp
VarBstrFromI1
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
OleIconToCursor

comctl32

CreatePropertySheetPage
CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
ord6
CreateStatusWindowW
ord7
_TrackMouseEvent
UninitializeFlatSB
ord3
PropertySheetW
PropertySheetA
CreateToolbarEx
ord16
DestroyPropertySheetPage
ord15
DrawStatusText
ord5
DrawStatusTextW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollProp
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
ord4
GetMUILanguage
ImageList_Add
ImageList_AddIcon
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Copy
ImageList_Create
ImageList_Destroy
PropertySheet
ord2
ord13
ord14
InitializeFlatSB
InitMUILanguage
InitCommonControlsEx
ord17
ImageList_Write
ImageList_SetOverlayImage
ImageList_SetImageCount
ImageList_SetIconSize
ImageList_SetFilter
ImageList_SetDragCursorImage
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_Read
ImageList_Merge
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_LoadImage
ImageList_GetImageRect
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_GetIcon
ImageList_GetDragImage
ImageList_GetBkColor
ImageList_EndDrag
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_DrawEx
ImageList_Draw
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ord8

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb56315761c7403edcd69d2606de3da5

Code Sign

6b:33:9f:da:07:cd:02:7e:b3:7f:f1:52:59:f1:5d:8cCertificate

Extended Key Usages

db:68:8e:77:41:34:64:bd:4c:9b:b8:13:f0:af:d7:5c:58:d5:e5:8dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

comctl32

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 183KB - Virtual size: 183KB

.data2 Size: 1024B - Virtual size: 1000B

.reloc Size: 4KB - Virtual size: 3KB

6b:33:9f:da:07:cd:02:7e:b3:7f:f1:52:59:f1:5d:8c
Certificate

db:68:8e:77:41:34:64:bd:4c:9b:b8:13:f0:af:d7:5c:58:d5:e5:8d
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 183KB - Virtual size: 183KB

.data2
Size: 1024B - Virtual size: 1000B

.reloc
Size: 4KB - Virtual size: 3KB