HookFunction
Static task
static1
Behavioral task
behavioral1
Sample
StickyApp32.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
StickyApp32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
StickyApp32.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
StickyApp32.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
StickyApp32.vbs
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
StickyApp32.vbs
Resource
win10v2004-20240802-en
General
-
Target
fd239d44637ee5a4edc73b466cb873a8_JaffaCakes118
-
Size
23KB
-
MD5
fd239d44637ee5a4edc73b466cb873a8
-
SHA1
adf9ce7ea10e632c058288bfecf3b43282d4ffe1
-
SHA256
0c70106adacd8cd4fb80bda9827cd6f6b617b6360d296f0a211f7350008bb0ed
-
SHA512
0b6849e3c665e7f62d84c05ee7859229e2a5758ea20eae62f4e9a702c8b99895411c1e1318d5f5a1ca1da100d6370d1f365b7b5e970d39dcdb97a11f91b68b8c
-
SSDEEP
384:C/xOFzWl/K3wdaTHCc02bbRoixKBgIpjaTRjXT/YQFWTG1UtSzaWiatXdxpmHZrl:ExOFaggdebbRoixISDYFLzHaJdxp+ZB
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/StickyApp32.dll unpack001/StickyApp32.exe
Files
-
fd239d44637ee5a4edc73b466cb873a8_JaffaCakes118.rar
-
MSSCCPRJ.SCC
-
StickyApp32.bas
-
StickyApp32.dll.dll windows:4 windows x86 arch:x86
5660f213e3fbbb71448df21bc04f8bbc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetEnvironmentStringsW
IsBadReadPtr
GetProcAddress
GetModuleHandleA
IsBadCodePtr
DisableThreadLibraryCalls
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
VirtualProtect
WideCharToMultiByte
HeapDestroy
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualAlloc
LoadLibraryA
FlushFileBuffers
CloseHandle
SetStdHandle
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetLocaleInfoW
user32
GetWindowThreadProcessId
FindWindowA
Exports
Exports
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
StickyApp32.exe.exe windows:4 windows x86 arch:x86
490a2fbee79d0f871f0b60e110dc2f5f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm50
_CIcos
_adj_fptan
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord595
_adj_fdiv_m16i
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaStrToAnsi
__vbaVarDup
_CIatan
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 964B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 470B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
StickyApp32.frm.vbs
-
StickyApp32.vbp
-
StickyApp32.vbw
-
下载说明.htm.html .js polyglot