00e84fc844b1d0072178965adb162ce0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

00e84fc844b1d0072178965adb162ce0_JaffaCakes118
Size

144KB
MD5

00e84fc844b1d0072178965adb162ce0
SHA1

db05d0b403f807172474bf34a6a76073a0b5d289
SHA256

782dd20c3ee9ebaf9ebc08061f74793edac1e7b15a3ac64c24bf37161ab22dad
SHA512

e1fff35c8edadddc0b443acbae27d54dcb93f16a85f9d4bb48ece35e4cc325909446ae8ac5b62ff9d9b2806e7adf5fcb770ebd88e4614868bcbef3cb1d246c08
SSDEEP

3072:umDbkyWrUwCMUkJc9uUswmHmNiYiKD8oH56QRwTRD5SMXPSYm11OzM5h:lDbkyWrUwCMUNswmoi1KDHZ6QlMXPP8H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00e84fc844b1d0072178965adb162ce0_JaffaCakes118

Files

00e84fc844b1d0072178965adb162ce0_JaffaCakes118
.dll windows:5 windows x86 arch:x86

4f2c3a329cb060a2bc8b80f8e3fbbbe5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

ieakeng.pdb

Imports

msvcrt

?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_CxxThrowException
_except_handler3
??2@YAPAXI@Z
isdigit
memmove
??3@YAXPAX@Z

kernel32

GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetDriveTypeW
GetDriveTypeA
WritePrivateProfileSectionW
WritePrivateProfileSectionA
lstrcpyA
GetPrivateProfileSectionA
GetPrivateProfileStringA
GetCurrentThreadId
WideCharToMultiByte
IsDBCSLeadByte
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFileSize
GlobalLock
WriteFile
GlobalUnlock
LocalFree
LocalAlloc
InterlockedDecrement
GetTickCount
QueryPerformanceCounter
lstrcatA
GetCurrentProcess
GetLocalTime
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GlobalFree
SetFilePointer
MultiByteToWideChar
ReadFile
GetProcAddress
FindClose
lstrlenA
lstrlenW
CloseHandle
GetVersionExA
DisableThreadLibraryCalls
FreeLibrary
GetExitCodeProcess
CreateProcessA
GetPrivateProfileSectionW

user32

ReleaseDC
GetClientRect
GetDC
IsDlgButtonChecked
EnableWindow
TranslateMessage
MsgWaitForMultipleObjects
GetFocus
EnumChildWindows
GetDlgItem
GetParent
CheckDlgButton
EndDialog
DestroyIcon
SetFocus
IsWindowEnabled
DestroyWindow
SetWindowTextA
ShowWindow
GetKeyState
ExitWindowsEx
GetSystemMetrics
MoveWindow
GetWindowRect
SetWindowPos

gdi32

GetStockObject
GetDeviceCaps
DeleteObject
CreateCompatibleDC
SelectObject
SelectPalette
RealizePalette
BitBlt
DeleteDC
GetDIBColorTable
CreatePalette
LPtoDP

advapi32

LookupPrivilegeValueW
RegLoadKeyA
RegLoadKeyW
RegUnLoadKeyA
RegUnLoadKeyW
OpenProcessToken
AdjustTokenPrivileges
RegFlushKey
RegCloseKey
LookupPrivilegeValueA

shlwapi

StrCmpIW
PathAppendW
SHGetValueW
PathRemoveFileSpecW
ord81
PathIsURLW
ord335
ord138
StrRChrW
ord74
ord84
ord104
ord57
StrCmpW
ord50
ord136
ord141
ord94
ord90
ord59
StrCpyNW
ord52
PathRenameExtensionW
ord89
ord337
ord334
PathIsPrefixW
PathFindNextComponentW
StrTrimW
ord96
StrChrW
PathRemoveExtensionW
ord117
ord37
PathFindFileNameW
ord338
ord95
ord53
ord93
ord97
ord43
ord80
ord83
ord55
ord85
PathRemoveBackslashW
ord91
ord403
PathIsUNCServerW
ord333
SHQueryValueExW
ord366
ord40
PathAddBackslashW
StrCatW
ord65
ord341
ord298
ord125
PathIsFileSpecW
PathCombineW
wnsprintfW
ord123
ord120
ord130
ord128
ord158
ord437
ord309
ord107
ord340
ord61
ord112
StrCpyW
PathFileExistsW
ord312
ord116
ord60
ord369
StrPBrkW
StrCSpnW
StrStrIW
StrCmpNIW
StrSpnW
SHRegGetValueW
ord347
PathGetDriveNumberW
PathGetCharTypeW
PathIsUNCW
ord41
PathSkipRootW
PathIsRootW
ord294
ord295
PathIsDirectoryW
StrToIntExW
ord215
PathFindExtensionW
ord217
ord434
ord143

urlmon

URLDownloadToFileW

oleaut32

SysAllocString
OleCreatePictureIndirect
SysFreeString

ole32

CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
CoTaskMemRealloc
CoGetMalloc
StringFromGUID2
GetHGlobalFromStream
CoTaskMemFree

wininet

PrivacyGetZonePreferenceW
InternetQueryOptionW
InternetQueryOptionA
InternetGetConnectedStateExW

shfolder

SHGetFolderPathW

shell32

SHGetSpecialFolderLocation

admparse

AdmSaveData
GetAdmCategoriesW
AdmResetW
AdmFinishedW
GetFontInfoW
CreateAdmUiW
CheckDuplicateKeysW
AdmInitW
AdmClose
IsAdmDirty

advpack

DelNode

Exports

Exports

AddADMItemA
AddADMItemW
BToolbar_Edit
BToolbar_InitA
BToolbar_InitW
BToolbar_Remove
BToolbar_SaveA
BToolbar_SaveW
BrowseForFileA
BrowseForFileW
BrowseForFolderA
BrowseForFolderW
BuildPalette
CanDeleteADM
CheckField
CheckForDupKeys
CheckVerA
CheckVerW
CopyAnimBmpA
CopyAnimBmpW
CopyHttFileA
CopyHttFileW
CopyLogoBmpA
CopyLogoBmpW
CopyWallPaperA
CopyWallPaperW
CreateADMWindow
DeleteADMItemA
DeleteADMItemW
DeleteADMItemsA
DeleteADMItemsW
DeleteFavoriteA
DeleteFavoriteW
DestroyADMWindow
DisplayADMItem
DoReboot
EncodeSignatureA
EncodeSignatureW
ErrorMessageBox
ExportFavoritesA
ExportFavoritesW
ExportQuickLinksA
ExportQuickLinksW
ExportRegKey2InfA
ExportRegKey2InfW
ExportRegTree2InfA
ExportRegTree2InfW
ExportRegValue2InfA
ExportRegValue2InfW
GenerateNewVersionStrA
GenerateNewVersionStrW
GetAdmFileListA
GetAdmFileListW
GetAdmWindowHandle
GetBaseFileNameA
GetBaseFileNameW
GetFavoriteUrlA
GetFavoriteUrlW
GetFavoritesInfoTipA
GetFavoritesInfoTipW
GetFavoritesMaxNumber
GetFavoritesNumber
GetProxyDlgA
GetProxyDlgW
ImportADMFileA
ImportADMFileW
ImportADTInfoA
ImportADTInfoW
ImportAuthCodeA
ImportAuthCodeW
ImportConnectSetA
ImportConnectSetW
ImportFavoritesA
ImportFavoritesCmdA
ImportFavoritesCmdW
ImportFavoritesW
ImportLDAPBitmapA
ImportLDAPBitmapW
ImportOEInfoA
ImportOEInfoW
ImportProgramsA
ImportProgramsW
ImportQuickLinksA
ImportQuickLinksW
ImportRatingsA
ImportRatingsW
ImportSiteCertA
ImportSiteCertW
ImportToolbarInfoA
ImportToolbarInfoW
ImportZonesA
ImportZonesW
InitializeStartSearchA
InitializeStartSearchW
IsADMFileVisibleA
IsADMFileVisibleW
IsAnimBitmapFileValidA
IsAnimBitmapFileValidW
IsBitmapFileValidA
IsBitmapFileValidW
IsFavoriteItem
LoadADMFilesA
LoadADMFilesW
MigrateFavoritesA
MigrateFavoritesW
MigrateToOldFavoritesA
MigrateToOldFavoritesW
ModifyAuthCode
ModifyFavoriteA
ModifyFavoriteW
ModifyRatings
ModifySiteCert
ModifyZones
MoveADMWindow
MoveDownFavorite
MoveUpFavorite
NewFolder
NewUrlA
NewUrlW
ProcessFavSelChange
ResetAdmFilesA
ResetAdmFilesW
SaveADMItem
SaveAdmFilesA
SaveAdmFilesW
SaveStartSearchA
SaveStartSearchW
SelectADMItem
SetADMWindowTextA
SetADMWindowTextW
SetLBWidth
SetOrClearVersionInfoA
SetOrClearVersionInfoW
SetProxyDlgA
SetProxyDlgW
ShowADMWindow
ShowBitmapA
ShowBitmapW
ShowDeskCpl
ShowInetcpl
SignFileA
SignFileW
TestURLA
TestURLW

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f2c3a329cb060a2bc8b80f8e3fbbbe5

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

gdi32

advapi32

shlwapi

urlmon

oleaut32

ole32

wininet

shfolder

shell32

admparse

advpack

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 113KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 116KB - Virtual size: 113KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 6KB