85c0615ae667f2f1393cf2fcf91da146_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
85c0615ae667f2f1393cf2fcf91da146_JaffaCakes118
Size 1.9MB
Sample241102-q3n7xavphy
SHA256 75d36fc4f14630cd347bce7e8fcf951b42bf47a7fc1e33af4a5ec7b2ec867a71
MD5 85c0615ae667f2f1393cf2fcf91da146
SHA1 a6bc444bb36a46b4d4947b921679a8c30a31c20f
SHA512 6d4ae8e6672c9b3ccbeebb5938d8de309bef59569f9307348194bbdd005cffba9b395f1e68b90f18d7a4b20af08c25a9d7940ad974943d05085e71419b3d8bf8
SSDEEP 49152:HeEXM8IDIF7s/LebeLdLrKJCmiVYfimgfHUQMUG1c:Hk80I+/GeFKC5Camgft/gc
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/111.exe	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/111.exe
unpack001/Word/HookDrv.dll
unpack001/Word/RManFUSClient.exe
unpack001/Word/RManServer.exe
unpack001/blat.dll
unpack001/blat.exe

File Explorer

85c0615ae667f2f1393cf2fcf91da146_JaffaCakes118

.rar 1.9MB
111.exe

.exe 21KB
111.reg

12KB
Word/HookDrv.dll

.dll 174KB
Word/RManFUSClient.exe

.exe 2.5MB
Word/RManServer.exe

.exe 3.0MB
blat.dll

.dll 120KB
blat.exe

.exe 112KB
blat.lib

2KB

85c0615ae667f2f1393cf2fcf91da146_JaffaCakes118

SHA256 75d36fc4f14630cd347bce7e8fcf951b42bf47a7fc1e33af4a5ec7b2ec867a71
MD5 85c0615ae667f2f1393cf2fcf91da146
SHA1 a6bc444bb36a46b4d4947b921679a8c30a31c20f
SHA512 6d4ae8e6672c9b3ccbeebb5938d8de309bef59569f9307348194bbdd005cffba9b395f1e68b90f18d7a4b20af08c25a9d7940ad974943d05085e71419b3d8bf8
SSDEEP 49152:HeEXM8IDIF7s/LebeLdLrKJCmiVYfimgfHUQMUG1c:Hk80I+/GeFKC5Camgft/gc
MD5 SHA1 SHA512 SSDEEP

111.exe

SHA256 8433cab0e54e801a2be34fb149acf6bf8b87a60828eefe47af05edff762fe586
MD5 82427df03213df677115af3d9bc8d134
SHA1 f2870bd0ebba0d5bf4b8b06099047cdbfb5254b3
SHA512 3141435c43fe6dc7f76786455d8daa8af2e99a56936cab76cbfbd867ef77fdb2999a32f7d73213a513bb1ee5a5a2192d52f5163750647c5386d2ddabdaad1fa3
SSDEEP 384:UIiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZKqaNJawcudoq:URGuY2P0Vo6r7SiAwyrMRjbMnbcuyD7h
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Word/HookDrv.dll

IMPHASH e0d8b6734d9be203763508cbbda3e0dd
SHA256 d3b6c19376b95cb9501181b42b7cbebd44b994d9652ef5fc103eec0d747b8e7d
MD5 895d68b21984db50bfbffc88d289f5da
SHA1 2cc6625e1fcdeac9dceb6a0f381f52ba574365a8
SHA512 7d4d78b985c13fcd3ea835db7eab5373881257830e2f3f8cac3efc22b1e6d38ac99d1245539cf286beb6f67f077bb2582980c9f7c4250fd8546ff65edabcd68b
SSDEEP 3072:Y8+9FgejNovgJXghWCM80R8Kmn6vXnV4u888888888888W888888888887:Y8+zBovmR8KZz888888888888W88888P
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl InitializeSecurityDescriptor

user32

LoadStringW MessageBoxA CharNextW UnhookWindowsHookEx SetWindowsHookExW PostMessageW MessageBoxW LoadStringW GetSystemMetrics CharUpperBuffW CallNextHookEx

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle TlsSetValue TlsGetValue TlsFree TlsAlloc LocalFree LocalAlloc WriteProcessMemory WriteFile WideCharToMultiByte WaitForSingleObject VirtualQuery VirtualProtectEx UnmapViewOfFile SignalObjectAndWait SetEvent ResetEvent MultiByteToWideChar MapViewOfFile LocalFree LocalAlloc LeaveCriticalSection InitializeCriticalSection GetVersionExW GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetDiskFreeSpaceW GetDateFormatW GetCurrentProcess GetCPInfo InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW EnumCalendarInfoW EnterCriticalSection DeleteCriticalSection CreateFileMappingW CreateEventW CompareStringW CloseHandle

ddraw

DirectDrawCreateEx DirectDrawCreate

Name

.text

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

189B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Word/RManFUSClient.exe

IMPHASH e36d561d78f27a98e0f37b85a39f62e6
SHA256 8f167e5ba3536b6bb20de8168709a469c9d440e6ce9ad80915479a20e8bd53fb
MD5 eab8cb5fef7a716886ae19877c80d52e
SHA1 6cef2260d2fb047c69ab2afa1a9f5d8c75715f4b
SHA512 e4b2734c8b811ac1035e24d8a336e58726b3ffe984aa13fbcfe703716f8ccf1ca798a08850951934e7d98c14ec201a4abf12a7248789f744423ca7860ddb2d3e
SSDEEP 49152:mOjOHAqSdSQfZZck2c6pgcqYOHNTBLupHc+w:upOT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2062884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen CreateErrorInfo GetErrorInfo SetErrorInfo GetActiveObject SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegLoadKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegConnectRegistryW RegCloseKey OpenProcessToken LookupPrivilegeValueW InitializeSecurityDescriptor GetUserNameW AdjustTokenPrivileges

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW mouse_event keybd_event WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnionRect UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetThreadDesktop SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetKeyboardState SetForegroundWindow SetFocus SetCursorPos SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW SendInput ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassExW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenInputDesktop OpenDesktopW OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadMenuW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild InvalidateRgn InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetUserObjectInformationW GetUpdateRect GetTopWindow GetThreadDesktop GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMessageExtraInfo GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDoubleClickTime GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursorInfo GetCursor GetClipboardData GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCapture GetAncestor GetActiveWindow FrameRect FlashWindowEx FindWindowExW FindWindowW FillRect ExitWindowsEx EqualRect EnumWindows EnumThreadWindows EnumClipboardFormats EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DrawAnimatedRects DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DestroyCaret DestroyAcceleratorTable DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateCaret CreateAcceleratorTableW CountClipboardFormats CopyIcon CloseDesktop CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharToOemW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BroadcastSystemMessageW BringWindowToTop BeginPaint AttachThreadInput CharLowerBuffA CharUpperBuffA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte RemoveDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW lstrcmpW WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObjectEx WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualFreeEx VirtualFree VirtualAllocEx VirtualAlloc UnmapViewOfFile TryEnterCriticalSection TerminateProcess SystemTimeToTzSpecificLocalTime SystemTimeToFileTime SwitchToThread SuspendThread Sleep SizeofResource SignalObjectAndWait SetThreadPriority SetThreadLocale SetPriorityClass SetLastError SetHandleInformation SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReleaseSemaphore ReleaseMutex ReadProcessMemory ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter PeekNamedPipe IsDebuggerPresent OutputDebugStringW OpenProcess OpenMutexW OpenFileMappingW OpenEventW MultiByteToWideChar MulDiv MapViewOfFile LockResource LocalFree LocalAlloc LoadResource LoadLibraryW LeaveCriticalSection IsValidLocale InitializeCriticalSection GlobalUnlock GlobalSize GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVersionExW GetVersion GetTimeZoneInformation GetTickCount GetThreadPriority GetThreadLocale GetTempPathW GetSystemInfo GetSystemDirectoryW GetSystemDefaultLangID GetStringTypeExA GetStringTypeExW GetStdHandle GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileSize GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushFileBuffers FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoW EnterCriticalSection DisconnectNamedPipe DeleteFileW DeleteCriticalSection CreateThread CreateSemaphoreW CreateProcessW CreatePipe CreateNamedPipeW CreateMutexW CreateFileMappingW CreateFileW CreateEventW CreateDirectoryW ConnectNamedPipe CompareStringA CompareStringW CloseHandle Sleep GetProcAddress LoadLibraryA GetModuleHandleA GetVersionExW CreateMutexW

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWindowExtEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetMetaFileBitsEx SetMapMode SetEnhMetaFileBits SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC Rectangle RectVisible RealizePalette Polyline Polygon PolyBezierTo PolyBezier PlayEnhMetaFile Pie PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetNearestPaletteIndex GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontsW EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteMetaFile DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateMetaFileW CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW CombineRgn CloseMetaFile Chord BitBlt Arc AbortDoc

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

CreateILockBytesOnHGlobal OleGetIconOfClass ReleaseStgMedium OleSetMenuDescriptor DoDragDrop RevokeDragDrop RegisterDragDrop OleSetContainedObject OleCreateFromFile OleCreateLinkToFile OleCreateStaticFromData OleCreateLinkFromData OleCreateFromData OleCreate OleUninitialize OleInitialize CreateBindCtx StgCreateDocfileOnILockBytes CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID ProgIDFromCLSID StringFromCLSID CoCreateInstance CoUninitialize CoInitializeEx CoInitialize IsEqualGUID CLSIDFromString CoTaskMemFree StringFromCLSID CoCreateGuid

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_GetImageInfo ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Copy ImageList_LoadImageW ImageList_GetIcon ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_SetOverlayImage ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

shell32

SHFileOperationW ShellExecuteExW ShellExecuteW Shell_NotifyIconW DragQueryPoint DragQueryFileW SHGetSpecialFolderPathW

comdlg32

ReplaceTextW FindTextW GetOpenFileNameW

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

winmm

waveInUnprepareHeader waveInStart waveInReset waveInPrepareHeader waveInOpen waveInClose waveInAddBuffer timeGetTime mixerSetControlDetails mixerOpen mixerGetNumDevs mixerGetLineInfoW mixerGetLineControlsW mixerGetDevCapsW mixerGetControlDetailsW mixerClose

msacm32

acmMetrics

oledlg

OleUIObjectPropertiesW OleUIPasteSpecialW OleUIInsertObjectW

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

540KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

974B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

72B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

343KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Word/RManServer.exe

IMPHASH 54721ec3ca7f96971e9618afb103b792
SHA256 c9abbef03faec7cf2b8ea364a20c38f56054c1ee6d42f648f71111ae4165cb02
MD5 236fa5ee0c58372b51336a917fac7c4a
SHA1 67d371b2d0eee3f1b5af362cde5732bc42cef3cc
SHA512 199e8f9ff9d6108090a0505001fab88cdc25399b3b2f95a06ef5003a7f120a578351f135e67949ae035d9d9b1336affa99608c0c14dbb3f94bcd1ca3dcd62188
SSDEEP 49152:09uBzsNcZSpHESjdRjuPRcSurl5hn/ZmDThTuW8Q1:euScxFurl5hn/0Y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2526276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl ReportEventW RegisterEventSourceW RegUnLoadKeyW RegSetValueExW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegLoadKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegConnectRegistryW RegCloseKey OpenThreadToken OpenProcessToken LookupPrivilegeValueW LookupAccountSidW InitializeSecurityDescriptor GetTokenInformation FreeSid EqualSid DeregisterEventSource AllocateAndInitializeSid AdjustTokenPrivileges StartServiceW StartServiceCtrlDispatcherW SetServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW EnumServicesStatusW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW CryptDecrypt CryptEncrypt CryptImportKey CryptExportKey CryptDestroyKey CryptGenKey CryptReleaseContext CryptAcquireContextA SetNamedSecurityInfoW SetEntriesInAclW

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW mouse_event keybd_event WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnionRect UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetThreadDesktop SetScrollRange SetScrollPos SetScrollInfo SetRectEmpty SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursorPos SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW SendInput ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassExW RegisterClassW RedrawWindow PtInRect PostThreadMessageW PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenInputDesktop OpenDesktopW OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MoveWindow MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadMenuW LoadKeyboardLayoutW LoadImageW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild InvalidateRgn InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRgn GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetUserObjectInformationW GetUpdateRect GetTopWindow GetThreadDesktop GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMessageExtraInfo GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetGuiResources GetForegroundWindow GetFocus GetDlgCtrlID GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursorInfo GetCursor GetClipboardData GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCapture GetAncestor GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect ExitWindowsEx EqualRect EnumWindows EnumThreadWindows EnumClipboardFormats EnumChildWindows EndPaint EndDeferWindowPos EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextA DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DestroyCaret DeleteMenu DeferWindowPos DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateDialogParamW CreateCaret CreateAcceleratorTableW CountClipboardFormats CopyIcon CloseDesktop CloseClipboard ClientToScreen CheckMenuItem CharUpperBuffW CharToOemW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BroadcastSystemMessageW BeginPaint BeginDeferWindowPos CharLowerBuffA CharUpperBuffA AdjustWindowRectEx ActivateKeyboardLayout

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrlenA lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose CreateDirectoryW ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateFileW CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrlenA lstrlenW lstrcpyW WritePrivateProfileStringW WriteFile WinExec WideCharToMultiByte WaitForSingleObjectEx WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc VerLanguageNameW UnmapViewOfFile TryEnterCriticalSection TerminateProcess SystemTimeToTzSpecificLocalTime SystemTimeToFileTime SwitchToThread SuspendThread Sleep SizeofResource SignalObjectAndWait SetThreadPriority SetThreadLocale SetPriorityClass SetLastError SetHandleInformation SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SearchPathW ResumeThread ResetEvent RemoveDirectoryW ReleaseSemaphore ReleaseMutex ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter PeekNamedPipe IsDebuggerPresent OutputDebugStringW OpenProcess OpenMutexW OpenFileMappingW OpenEventW MultiByteToWideChar MulDiv MoveFileW MapViewOfFile LockResource LocalFree LocalAlloc LoadResource LoadLibraryExW LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr InitializeCriticalSection HeapFree GlobalUnlock GlobalSize GlobalHandle GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVersionExW GetVersion GetTimeZoneInformation GetTickCount GetThreadPriority GetThreadLocale GetTempPathW GetSystemInfo GetSystemDirectoryW GetSystemDefaultLangID GetStringTypeExA GetStringTypeExW GetStdHandle GetProcessHeap GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetModuleFileNameW GetLogicalDriveStringsW GetLocaleInfoW GetLocalTime GetLastError GetHandleInformation GetFullPathNameW GetFileSize GetFileAttributesExW GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryW GetComputerNameW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushInstructionCache FlushFileBuffers FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime ExpandEnvironmentStringsW ExitThread EnumCalendarInfoW EnterCriticalSection DisconnectNamedPipe DeleteFileW DeleteCriticalSection CreateThread CreateSemaphoreW CreateProcessW CreatePipe CreateNamedPipeW CreateMutexW CreateFileMappingW CreateFileW CreateEventW CreateDirectoryW CopyFileExW CopyFileW ConnectNamedPipe CompareStringA CompareStringW CloseHandle Sleep GetProcAddress LoadLibraryA GetModuleHandleA GetVersionExW CreateMutexW

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette Polyline Polygon PolyBezierTo PolyBezier PlayEnhMetaFile Pie PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetNearestPaletteIndex GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush FrameRgn FillRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontsW EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePolygonRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW CombineRgn Chord BitBlt Arc AbortDoc

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID ProgIDFromCLSID StringFromCLSID CoCreateInstance CoFreeUnusedLibraries CoLockObjectExternal CoUninitialize CoInitializeEx CoInitialize IsEqualGUID IsEqualGUID CoTaskMemFree StringFromCLSID CoCreateGuid

comctl32

shell32

ShellExecuteExW ShellExecuteW

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

winmm

timeGetTime sndPlaySoundW

wsock32

WSAStartup gethostbyname inet_ntoa inet_addr

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

541KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

846B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

80B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

281KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

blat.dll

IMPHASH 018503ab46c8f1647559830ae95f06fe
SHA256 b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779
MD5 724cae63522f6e5f7565a3bf4b2a719b
SHA1 18620dbd4357d85918070f669ff4b61755290757
SHA512 af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d
SSDEEP 3072:tN3YqC7ZpufmsbSB0RaZCdLkMzdTv/3qq1iica:tN3Yq4ZpAPeB0fkMzgGHh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_CxxThrowException sscanf isdigit strtol ??1type_info@@UAE@XZ strncat _onexit _initterm _adjust_fdiv realloc memmove toupper tolower strtok memcmp strcpy strrchr _strnicmp strstr rand printf atol atoi _strlwr strchr strcat _stricmp strcmp memset malloc fopen free fclose fgets strncpy clock srand abs time localtime sprintf fprintf vsprintf strlen _EH_prolog __CxxFrameHandler memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z __dllonexit

wsock32

recv WSACleanup WSAStartup select closesocket htons getservbyname send gethostname ioctlsocket gethostbyname socket connect WSAGetLastError inet_ntoa getsockopt ntohl htonl setsockopt

kernel32

GetLastError OpenFile _lclose GetStdHandle WriteFile ReadFile GetFileSize GetFileType CreateFileA CloseHandle GetVersionExA lstrcpyA GetCurrentProcessId GetSystemTimeAsFileTime GetTimeZoneInformation GetLocalTime GetProcAddress FreeLibrary LoadLibraryA GetModuleHandleA lstrcmpA GetEnvironmentVariableA lstrcmpiA SetFilePointer FindClose FindNextFileA FindFirstFileA Sleep lstrlenA lstrcatA

user32

wsprintfA CharNextA

advapi32

RegEnumValueA RegDeleteValueA RegOpenKeyExA RegEnumKeyExA RegDeleteKeyA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA

blat.exe

IMPHASH 9d5610a2dffc09cf2be6246e1673aeca
SHA256 aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e
MD5 31f84e433e8d1865e322998a41e6d90e
SHA1 cbea6cda10db869636f57b1cffad39b22e6f7f17
SHA512 7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9
SSDEEP 3072:ag5DTZCatGyIMzdze3BO+ggUFLVRM8uTv/3hH4:zDTZCatGyI+dze3BNgpVRM8+H
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74380

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_CxxThrowException sscanf isdigit strtol ??1type_info@@UAE@XZ __dllonexit _onexit _exit _XcptFilter exit strncat __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp realloc strcpy memmove toupper tolower strtok memcmp strrchr _strnicmp strstr rand atol atoi _strlwr strchr strcat _stricmp strcmp memset malloc fopen free fclose fgets strncpy clock srand abs _EH_prolog __CxxFrameHandler time localtime sprintf fprintf vsprintf strlen printf memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z __p___initenv

wsock32

recv WSACleanup WSAStartup select closesocket htons getservbyname send gethostname ioctlsocket gethostbyname socket setsockopt connect WSAGetLastError inet_ntoa getsockopt htonl ntohl

kernel32

user32

wsprintfA CharNextA

advapi32

RegEnumValueA RegDeleteValueA RegOpenKeyExA RegEnumKeyExA RegDeleteKeyA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA

Sharing

General

Malware Config

Signatures

File Explorer

85c0615ae667f2f1393cf2fcf91da146_JaffaCakes118

111.exe

generic

111.reg

Word/HookDrv.dll

oleaut32

advapi32

user32

kernel32

ddraw

generic

Word/RManFUSClient.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

shell32

comdlg32

winspool.drv

winmm

msacm32

oledlg

generic

Word/RManServer.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

shell32

winspool.drv

winmm

wsock32

generic

blat.dll

msvcrt

wsock32

kernel32

user32

advapi32

generic

blat.exe

msvcrt

wsock32

kernel32

user32

advapi32

generic

blat.lib