ea8ff0f031a10a369f1b152b9151ed89_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ea8ff0f031a10a369f1b152b9151ed89_JaffaCakes118
Size

484KB
MD5

ea8ff0f031a10a369f1b152b9151ed89
SHA1

7ef59442e1a7a2d0b12b1a40f492f1080b71dfec
SHA256

e43ec5bffdeaf1e664cee5c8bd7aa1ebc2ce59a0855670e1f591da6610a7bd4c
SHA512

864c5d2c15b908dc78c786385dca1131d13c7493bde273fb2472b4d71059370806a54ce1b426bdb073bcadadee642521185b9ff2da1f899e0e9d0e914d665032
SSDEEP

12288:U7Ws/EGeubveqeo3omyTRTIrRrvcHJQjLD:PscGtbBvnrbHD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Nfoview.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nfoview.exe
unpack002/out.upx
unpack001/PATCH.exe

Files

ea8ff0f031a10a369f1b152b9151ed89_JaffaCakes118
.rar
Nfoview.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PATCH.exe
.exe windows:4 windows x86 arch:x86

5e26f09a8b4940be7347d1e10556b037

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TrackPopupMenu
ShowWindow
SetWindowTextA
SetWindowRgn
UpdateWindow
SetWindowLongA
SetFocus
SetDlgItemTextA
SetClassLongA
SetCapture
SetWindowPos
SendMessageA
ReleaseCapture
RegisterClassExA
RedrawWindow
PtInRect
OffsetRect
MessageBoxA
LoadStringA
LoadIconA
LoadCursorA
LoadBitmapA
IsDlgButtonChecked
InvalidateRect
IntersectRect
GetWindowRect
GetWindowLongA
GetSystemMetrics
GetParent
GetKeyState
GetDlgItemTextA
CloseClipboard
EmptyClipboard
OpenClipboard
SetClipboardData
GetClientRect
MoveWindow
GetDlgItem
GetDlgCtrlID
GetDC
GetCursorPos
GetCapture
GetActiveWindow
EndDialog
EnableWindow
DrawTextA
DialogBoxParamA
DefWindowProcA
CreateWindowExA
CreatePopupMenu
CheckDlgButton
CallWindowProcA
AppendMenuA

kernel32

WriteFile
CompareStringA
SetCurrentDirectoryA
CreateDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
FlushFileBuffers
lstrlenW
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WideCharToMultiByte
WaitForSingleObject
VirtualFree
VirtualAlloc
UnmapViewOfFile
CloseHandle
CopyFileA
CreateFileA
CreateFileMappingA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
FreeLibrary
GetCommandLineA
GetCurrentDirectoryA
GetFileAttributesA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
MapViewOfFile
MoveFileA
MultiByteToWideChar
RtlMoveMemory
RtlZeroMemory
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFilePointer
SizeofResource
Sleep

shell32

ShellExecuteA

gdi32

CreateDIBSection
CreateFontIndirectA
CreateSolidBrush
ExtCreateRegion
GetStockObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
TextOutA
SetTextColor
SetBkMode
SetBkColor
SelectObject
RoundRect
RemoveFontResourceA
GetTextExtentPointA
AddFontResourceA

comctl32

InitCommonControls

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyA
RegQueryValueExA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UnREaL RCE.nfo

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 40KB

UPX1 Size: 8KB - Virtual size: 8KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 11KB - Virtual size: 11KB

DATA Size: 512B - Virtual size: 168B

BSS Size: - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 1024B - Virtual size: 888B

.rsrc Size: 1024B - Virtual size: 1024B

5e26f09a8b4940be7347d1e10556b037

Headers

File Characteristics

Imports

user32

kernel32

shell32

gdi32

comctl32

advapi32

comdlg32

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 1KB - Virtual size: 65KB

.rsrc Size: 1.3MB - Virtual size: 1.3MB

UPX0
Size: - Virtual size: 40KB

UPX1
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 1KB - Virtual size: 4KB

CODE
Size: 11KB - Virtual size: 11KB

DATA
Size: 512B - Virtual size: 168B

BSS
Size: - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 1024B - Virtual size: 888B

.rsrc
Size: 1024B - Virtual size: 1024B

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 1KB - Virtual size: 65KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB