0bbd644318b52ad6750a7a3eac905255_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0bbd644318b52ad6750a7a3eac905255_JaffaCakes118
Size

204KB
MD5

0bbd644318b52ad6750a7a3eac905255
SHA1

240e505c1c05ee01bb0e5a91a800c5755d6905e7
SHA256

74c93f0ffc0d756237d9a0820a1ceb1391cbd6f56b3387b0f8184e64b2359968
SHA512

acb924d6037b3debc08a7f461864f36e7d19f13e840a5b560d2820a2e7895a74a3b6b4529caf51b9d521b17f929b95757c90fa9c905f847ead09a4e4ebf0b638
SSDEEP

3072:Cqldes9+3teCb5oR/V9BHCekSlZjqMcCDBRHnCKq5C+lKblGL2L8vkviUdM4ITKx:UECijHCAlZjtHCK0DKBGL2gcHMH+/20

Score

1^/10

Malware Config

Signatures

Files

0bbd644318b52ad6750a7a3eac905255_JaffaCakes118
.dll windows:5 windows x86 arch:x86

fbfed6c9c55e2bf339bc8edc2b556a08

Code Sign

0e:a9:50:eb:e4:01:c1:b8:40:d1:ef:7c:0b:af:64:3b
Certificate

Issuer

CN=rMwsnI7xLNMUIb9

Not Before

04/04/2012, 12:26

Not After

31/12/2039, 23:59

Subject

CN=rMwsnI7xLNMUIb9

Extended Key Usages

ExtKeyUsageCodeSigning

e8:39:7c:d4:fc:55:72:c9:81:9e:a4:e7:33:b1:ad:35:d6:23:fc:ca
Signer

Actual PE Digest

e8:39:7c:d4:fc:55:72:c9:81:9e:a4:e7:33:b1:ad:35:d6:23:fc:ca

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
VirtualAlloc
IsDebuggerPresent

gdi32

GetStockObject

comdlg32

GetSaveFileNameA
ChooseColorA
ChooseColorW
ChooseFontA
ChooseFontW
ReplaceTextW
ReplaceTextA
PrintDlgW
PrintDlgExW
PrintDlgExA
PrintDlgA
PageSetupDlgW
PageSetupDlgA
GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
GetOpenFileNameA
GetFileTitleW
GetFileTitleA
FindTextW
FindTextA

advapi32

RegOpenKeyW

ole32

HWND_UserSize
WriteOleStg
WriteClassStg
WdtpInterfacePointer_UserUnmarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserMarshal
UtGetDvtd16Info
StringFromGUID2
StgOpenStorage
StgCreateDocfileOnILockBytes
StgConvertVariantToProperty
StgConvertPropertyToVariant
SetConvertStg
SNB_UserUnmarshal
SNB_UserSize
SNB_UserMarshal
SNB_UserFree
RevokeDragDrop
ReadStringStream
ReadFmtUserTypeStg
ReadClassStm
PropVariantCopy
PropVariantClear
OleTranslateAccelerator
OleSetClipboard
OleSaveToStream
OleRun
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
OleNoteObjectVisible
OleLoad
OleIsRunning
OleInitializeWOW
OleGetIconOfClass
OleGetAutoConvert
OleDoAutoConvert
OleCreateStaticFromData
OleCreateLinkToFile
OleCreateFromFileEx
OleCreateFromFile
OleCreateFromDataEx
OleCreateEx
OleCreateEmbeddingHelper
OleCreateDefaultHandler
OleConvertOLESTREAMToIStorage
OleConvertIStorageToOLESTREAMEx
OleConvertIStorageToOLESTREAM
HWND_UserMarshal
HMETAFILE_UserUnmarshal
HMETAFILE_UserMarshal
HMETAFILE_UserFree
HMETAFILEPICT_UserUnmarshal
HMETAFILEPICT_UserSize
HMETAFILEPICT_UserFree
HMENU_UserFree
HICON_UserSize
HICON_UserMarshal
HENHMETAFILE_UserMarshal
HENHMETAFILE_UserFree
HDC_UserUnmarshal
HDC_UserMarshal
HBRUSH_UserMarshal
HBITMAP_UserUnmarshal
HBITMAP_UserSize
HACCEL_UserUnmarshal
GetHGlobalFromStream
GetHGlobalFromILockBytes
GetDocumentBitStg
GetConvertStg
GetClassFile
EnableHookObject
DllDebugObjectRPCHook
DcomChannelSetHResult
CreateStdProgressIndicator
CreateFileMoniker
CreateBindCtx
CreateAntiMoniker
CoWaitForMultipleHandles
CoUnmarshalHresult
CoUnloadingWOW
CoUninitialize
CoTestCancel
CoTaskMemAlloc
CoSuspendClassObjects
CoSetProxyBlanket
CoSetCancelObject
CoRevokeMallocSpy
CoRevokeClassObject
CoRevertToSelf
CoReleaseServerProcess
CoRegisterPSClsid
CoRegisterMessageFilter
CoRegisterClassObject
CoRegisterChannelHook
CoReactivateObject
CoQueryReleaseObject
CoQueryProxyBlanket
CoQueryClientBlanket
CoQueryAuthenticationServices
CoMarshalHresult
CoLockObjectExternal
CoLoadLibrary
CoIsOle1Class
CoIsHandlerConnected
CoGetObjectContext
CoGetMarshalSizeMax
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoGetCurrentProcess
CoGetCurrentLogicalThreadId
CoGetCancelObject
CoGetApartmentID
CoFreeAllLibraries
CoFileTimeToDosDateTime
CoEnableCallCancellation
CoDosDateTimeToFileTime
CoDisconnectObject
CoCreateInstanceEx
CoCreateInstance
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoCancelCall
CoBuildVersion
CLSIDFromProgIDEx
CLIPFORMAT_UserUnmarshal
CLIPFORMAT_UserSize
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserFree
BindMoniker
MonikerCommonPrefixWith

oleaut32

VarEqv
VectorFromBstr
VariantInit
VariantCopyInd
VariantClear
VariantChangeTypeEx
VarXor
VarUI4FromUI2
VarUI4FromStr
VarUI4FromR8
VarUI4FromI4
VarUI4FromI2
VarUI4FromI1
VarUI4FromDisp
VarUI4FromDec
VarUI2FromUI4
VarUI2FromUI1
VarUI2FromR4
VarUI2FromI2
VarUI2FromI1
VarUI1FromR8
VarUI1FromR4
VarUI1FromI4
VarUI1FromI1
VarUI1FromDisp
VarUI1FromDate
VarUI1FromBool
VarTokenizeFormatString
VarSu
VarRound
VarR8Round
VarR8Pow
VarR8FromUI2
VarR8FromI1
VarR8FromDisp
VarR8FromDec
VarR8FromDate
VarR8FromCy
VarR4FromUI4
VarR4FromUI1
VarR4FromStr
VarR4FromR8
VarR4FromI4
VarR4FromI1
VarR4FromDisp
VarR4FromDate
VarR4FromBool
VarPow
BSTR_UserFree
BSTR_UserSize
BSTR_UserUnmarshal
BstrFromVector
CreateDispTypeInfo
CreateStdDispatch
DispCallFunc
DosDateTimeToVariantTime
GetActiveObject
GetAltMonthNames
GetErrorInfo
GetRecordInfoFromGuids
LHashValOfNameSys
LPSAFEARRAY_Size
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserSize
LPSAFEARRAY_UserUnmarshal
LoadRegTypeLi
LoadTypeLibEx
OACreateTypeLib2
OleCreatePictureIndirect
OleCreatePropertyFrame
OleCreatePropertyFrameIndirect
OleIconToCursor
OleLoadPicture
OleLoadPictureEx
OleLoadPictureFile
OleLoadPicturePath
OleTranslateColor
RegisterActiveObject
RegisterTypeLi
SafeArrayAllocDescriptor
SafeArrayAllocDescriptorEx
SafeArrayCopy
SafeArrayCopyData
SafeArrayCreate
SafeArrayCreateEx
SafeArrayCreateVector
SafeArrayDestroy
SafeArrayDestroyDescriptor
SafeArrayGetDim
SafeArrayGetElement
SafeArrayGetIID
SafeArrayPtrOfIndex
SafeArrayRedim
SafeArraySetIID
SafeArrayUnaccessData
SafeArrayUnlock
SetErrorInfo
SysAllocString
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringByteLen
SysStringLen
SystemTimeToVariantTime
VARIANT_UserMarshal
VARIANT_UserSize
VARIANT_UserUnmarshal
VarAnd
VarBoolFromCy
VarBoolFromDec
VarBoolFromDisp
VarBoolFromI2
VarParseNumFromStr
VarBoolFromR8
VarBoolFromStr
VarBoolFromUI4
VarBstrCmp
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarBstrFromDisp
VarBstrFromI1
VarBstrFromI2
VarBstrFromI4
VarBstrFromR4
VarBstrFromUI1
VarBstrFromUI2
VarCat
VarCmp
VarCyAdd
VarCyCmp
VarCyCmpR8
VarCyFromDate
VarCyFromDisp
VarCyFromI1
VarCyFromI2
VarCyFromI4
VarCyFromR4
VarCyFromR8
VarCyFromStr
VarCyFromUI2
VarCyMul
VarCyNeg
VarCyRound
VarCySu
VarDateFromCy
VarDateFromDec
VarDateFromI2
VarDateFromI4
VarDateFromR4
VarDateFromR8
VarDateFromStr
VarDateFromUI1
VarDateFromUI2
VarDecAdd
VarDecCmpR8
VarDecFix
VarDecFromDate
VarDecFromDisp
VarDecFromI2
VarDecFromI4
VarDecFromR4
VarDecFromStr
VarDecInt
VarDecMul
VarDiv
VarBoolFromR4
VarFormatCurrency
VarFormatDateTime
VarFormatNumber
VarFormatPercent
VarI1FromDate
VarI1FromDec
VarI1FromDisp
VarI1FromI4
VarI1FromR4
VarI1FromR8
VarI1FromStr
VarI1FromUI4
VarI2FromBool
VarI2FromDec
VarI2FromDisp
VarI2FromI1
VarI2FromI4
VarI2FromR8
VarI2FromUI1
VarI2FromUI2
VarI2FromUI4
VarI4FromCy
VarI4FromDate
VarI4FromDisp
VarI4FromI2
VarI4FromR4
VarI4FromR8
VarI4FromStr
VarI4FromUI1
VarI4FromUI2
VarImp
VarInt
VarMod
VarMul
VarNeg
VarNot

comctl32

CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
ord6
CreateStatusWindowW
ord7
CreateToolbarEx
ord16
DestroyPropertySheetPage
ord15
DrawStatusText
CreatePropertySheetPage
DrawStatusTextW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollProp
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
ord4
GetMUILanguage
ImageList_Add
ord5
ImageList_Replace
ImageList_AddIcon
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Copy
ImageList_Create
_TrackMouseEvent
UninitializeFlatSB
ord3
PropertySheetW
PropertySheetA
PropertySheet
ord2
ord13
ord14
InitializeFlatSB
InitMUILanguage
InitCommonControlsEx
ord17
ImageList_Write
ImageList_SetOverlayImage
ImageList_SetImageCount
ImageList_SetIconSize
ImageList_SetFilter
ImageList_SetDragCursorImage
ImageList_SetBkColor
ImageList_ReplaceIcon
ord8
ImageList_Remove
ImageList_Read
ImageList_Merge
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_LoadImage
ImageList_GetImageRect
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_GetIconSize
ImageList_GetIcon
ImageList_GetDragImage
ImageList_GetBkColor
ImageList_EndDrag
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_DrawEx
ImageList_Draw
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_Destroy

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fbfed6c9c55e2bf339bc8edc2b556a08

Code Sign

0e:a9:50:eb:e4:01:c1:b8:40:d1:ef:7c:0b:af:64:3bCertificate

Extended Key Usages

e8:39:7c:d4:fc:55:72:c9:81:9e:a4:e7:33:b1:ad:35:d6:23:fc:caSigner

Headers

File Characteristics

Imports

kernel32

gdi32

comdlg32

advapi32

ole32

oleaut32

comctl32

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 183KB - Virtual size: 183KB

.data2 Size: 1024B - Virtual size: 1000B

.CRT Size: 512B - Virtual size: 4B

.reloc Size: 4KB - Virtual size: 3KB

0e:a9:50:eb:e4:01:c1:b8:40:d1:ef:7c:0b:af:64:3b
Certificate

e8:39:7c:d4:fc:55:72:c9:81:9e:a4:e7:33:b1:ad:35:d6:23:fc:ca
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 183KB - Virtual size: 183KB

.data2
Size: 1024B - Virtual size: 1000B

.CRT
Size: 512B - Virtual size: 4B

.reloc
Size: 4KB - Virtual size: 3KB