089a52710fa14cf0d008e058529e95d3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

089a52710fa14cf0d008e058529e95d3_JaffaCakes118
Size

1.1MB
MD5

089a52710fa14cf0d008e058529e95d3
SHA1

9632fa44232bfccc17cfd0bcbbdf749cbf458694
SHA256

65bf7db1c27d21310a079d0a1758acec6686ce057224217eedd8f90773502d32
SHA512

7d247003bd5596194a7eee52fc6f9ebbeeae4f793a71cb2a884b96a73ba860eb067b10abaf612c17b333cc9bfa7c792c1dec5f0e40b592e7f8c85781c543fb08
SSDEEP

24576:ooPW7kuvWIZg/wH2SD9xtWQdpwx1BiDoGnPEXIn2tEEEEEEEEEEdlhJEJEEEEEEY:okW7gC+SDPLdEKoGnPEXdtEEEEEEEEEu

Score

1^/10

Malware Config

Signatures

Files

089a52710fa14cf0d008e058529e95d3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

29d3b771448090795e82c39d861c0fc7

Code Sign

54:14:67:9c:13:35:95:42:b2:15:d2:33:d0:d6:fc:f2:15:a6:5b:15
Signer

Actual PE Digest

54:14:67:9c:13:35:95:42:b2:15:d2:33:d0:d6:fc:f2:15:a6:5b:15

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\hudson\jobs\EVEREST_BUILD\workspace\IECore\Release\TBNotifier.pdb

Imports

msi

ord70
ord195

kernel32

SetEvent
CreateEventW
CreateMutexW
ReleaseMutex
WideCharToMultiByte
OpenProcess
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
CopyFileW
WriteFile
DeleteFileW
GetPrivateProfileStringW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
ResetEvent
CreateThread
WaitForMultipleObjects
FreeLibrary
LoadLibraryW
InitializeCriticalSectionAndSpinCount
lstrcmpiW
LoadLibraryExW
FileTimeToSystemTime
GetFileTime
OutputDebugStringW
UnlockFile
LockFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
FormatMessageW
GetSystemDefaultLangID
CompareFileTime
GetFileAttributesW
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
GetVersionExA
LoadLibraryA
LockFileEx
GetFileAttributesA
FormatMessageA
GetFileSize
GetFullPathNameA
GetFullPathNameW
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
LockResource
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
CreateFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
GetStdHandle
HeapCreate
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetDateFormatW
GetTimeFormatW
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
ExitThread
DecodePointer
EncodePointer
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GlobalFree
GetCurrentThreadId
InitializeCriticalSection
SizeofResource
RaiseException
InterlockedExchange
InterlockedIncrement
WaitForSingleObject
FindResourceExW
FindResourceW
ReadFile
InterlockedDecrement
LocalFree
GetModuleHandleW
GetProcAddress
GetVersionExW
Sleep
GlobalHandle
SetLastError
GetModuleFileNameW
MulDiv
lstrcmpW
lstrlenW
lstrlenA
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
GetLastError
GlobalAlloc
GlobalUnlock
GlobalLock
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
LoadResource

user32

MoveWindow
GetClientRect
BeginPaint
SendMessageW
GetDC
ReleaseDC
UpdateWindow
PostMessageW
EndPaint
GetWindowLongW
GetWindow
EnumWindows
DestroyWindow
DrawTextW
SetWindowLongW
GetSysColor
CreateWindowExW
SetWindowPos
SendDlgItemMessageW
SetWindowContextHelpId
IsWindow
UnhookWinEvent
MapDialogRect
EndDialog
CharNextW
ClientToScreen
ScreenToClient
InvalidateRect
InvalidateRgn
RedrawWindow
ShowWindow
IsWindowVisible
SetTimer
UnregisterClassA
GetWindowInfo
EnableWindow
DefWindowProcW
GetWindowThreadProcessId
LoadStringW
SetCapture
IsChild
GetParent
GetDlgItem
LoadAcceleratorsW
TranslateAcceleratorW
GetSysColorBrush
PostQuitMessage
SetForegroundWindow
WindowFromPoint
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
GetDesktopWindow
DestroyAcceleratorTable
GetFocus
SetFocus
GetClassInfoExW
KillTimer
SendMessageTimeoutW
MessageBoxW
FindWindowW
SystemParametersInfoW
SetRectEmpty
PostThreadMessageW
MsgWaitForMultipleObjects
PeekMessageW
LoadCursorW
EnumChildWindows
PtInRect
SetDlgItemTextW
LoadImageW
DrawIconEx
GetActiveWindow
DialogBoxIndirectParamW
SetLayeredWindowAttributes
SetWinEventHook
TranslateMessage
DispatchMessageW
GetMessageW
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW

gdi32

Rectangle
GetTextExtentPoint32W
StretchBlt
GetDIBColorTable
CreateFontIndirectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
GetStockObject
SetBkMode
SetTextColor
CreateDIBSection
DeleteObject
GetObjectW
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC
CreatePen

advapi32

RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
RegFlushKey
RegNotifyChangeKeyValue
RegDeleteKeyW

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateGuid
CoTaskMemRealloc
CoAddRefServerProcess
CoReleaseServerProcess

oleaut32

VarUdateFromDate
VarDateFromStr
VarUI4FromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetVartype
VariantCopy
VarBstrCmp
VariantChangeType
SysFreeString
SysStringLen
VariantClear
SysAllocStringLen
SysAllocString
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen

shlwapi

StrStrIW
PathFileExistsW

gdiplus

GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

msimg32

AlphaBlend
TransparentBlt

psapi

GetModuleFileNameExW

crypt32

CryptMsgGetParam
CryptQueryObject
CertGetNameStringW
CertFindCertificateInStore

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

oleacc

AccessibleObjectFromEvent
AccessibleObjectFromWindow
GetRoleTextW
AccessibleChildren
WindowFromAccessibleObject

wininet

HttpOpenRequestW
HttpSendRequestW
InternetSetOptionW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW
InternetConnectW
InternetOpenW
HttpQueryInfoW

comctl32

ord17

Sections

.text
Size: 716KB - Virtual size: 715KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29d3b771448090795e82c39d861c0fc7

Code Sign

54:14:67:9c:13:35:95:42:b2:15:d2:33:d0:d6:fc:f2:15:a6:5b:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

msimg32

psapi

crypt32

version

oleacc

wininet

comctl32

Sections

.text Size: 716KB - Virtual size: 715KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 20KB - Virtual size: 31KB

.rsrc Size: 210KB - Virtual size: 210KB

.reloc Size: 47KB - Virtual size: 46KB

54:14:67:9c:13:35:95:42:b2:15:d2:33:d0:d6:fc:f2:15:a6:5b:15
Signer

.text
Size: 716KB - Virtual size: 715KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 20KB - Virtual size: 31KB

.rsrc
Size: 210KB - Virtual size: 210KB

.reloc
Size: 47KB - Virtual size: 46KB