f2494a8c6f8e1b9d431c789fef85088d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f2494a8c6f8e1b9d431c789fef85088d_JaffaCakes118
Size

281KB
MD5

f2494a8c6f8e1b9d431c789fef85088d
SHA1

643245245bf92f8fbc7e4017d3d630a1bde3f3b2
SHA256

73e96dfece1b700a6d38dce7b36a9b035e898d91a7fd9f3a590505c3d7d07d3a
SHA512

8270b25b851970c5649a84b841e051fcddceb2b55ba531ab1d43c0414bada4fea5981507ffa5d214ba5881a4e837cd3e287c79c95a147f1db2ac3328fbdf8c1e
SSDEEP

6144:ej6szVkJuCoSmMFNVojDnLLCqJ0FmGgtiu:eL2qSvNVonnLzLr

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2494a8c6f8e1b9d431c789fef85088d_JaffaCakes118

Files

f2494a8c6f8e1b9d431c789fef85088d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

74b53716cdd27c54535b2a1dfa3238e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

WriteFile
WaitForSingleObject
VirtualQuery
VirtualAlloc
TerminateProcess
Sleep
SetFileTime
SetFilePointer
SetFileAttributesA
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
ReleaseMutex
ReadFile
OpenProcess
MulDiv
MoveFileA
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GlobalFree
GetWindowsDirectoryA
GetVersionExA
GetVersion
GetTickCount
GetThreadLocale
GetStdHandle
GetShortPathNameA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameA
GetFileTime
GetFileAttributesA
GetExitCodeThread
GetDiskFreeSpaceA
GetDateFormatA
GetCurrentThreadId
GetCurrentProcess
GetCPInfo
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
FreeLibrary
FormatMessageA
ExitThread
EnumCalendarInfoA
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
CreateThread
CreateProcessA
CreateMutexA
CreateFileA
CreateEventA
CopyFileA
CompareStringA
CloseHandle
Sleep
GetACP
Sleep
VirtualFree
VirtualAlloc
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
ExitThread
CreateThread
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
GetSystemDefaultUILanguage

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegFlushKey
RegCreateKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
QueryServiceStatus
OpenServiceA
OpenSCManagerA
ControlService
CloseServiceHandle

comctl32

InitCommonControls

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
SetTextColor
SetROP2
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
RealizePalette
MoveToEx
GetTextMetricsA
GetTextExtentPoint32A
GetSystemPaletteEntries
GetStockObject
GetObjectA
GetDeviceCaps
GetDIBits
GetCurrentPositionEx
GetBitmapBits
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateFontIndirectA
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
BitBlt

oleaut32

SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysFreeString
SysReAllocStringLen
SysAllocStringLen

shell32

Shell_NotifyIconA
ExtractIconA
ShellExecuteA

user32

CreateWindowExA
WaitMessage
UnregisterClassA
TranslateMessage
ShowWindow
SetWindowPos
SetWindowLongA
SetParent
SetForegroundWindow
SetFocus
SendMessageA
ReleaseDC
RegisterClassA
PostQuitMessage
PostMessageA
PeekMessageA
OffsetRect
MsgWaitForMultipleObjects
MessageBoxA
LoadStringA
LoadImageA
LoadIconA
LoadCursorA
IsWindowVisible
IsWindowEnabled
IsWindow
IsIconic
InvalidateRect
GetWindowTextLengthA
GetWindowTextA
GetWindowRect
GetWindowLongA
GetUpdateRgn
GetSystemMetrics
GetSysColor
GetMessageA
GetKeyState
GetIconInfo
GetFocus
GetDC
GetClientRect
GetClassInfoA
FillRect
EndPaint
EnableWindow
DrawTextA
DrawIconEx
DispatchMessageA
DestroyWindow
DestroyIcon
DefWindowProcA
CreateIcon
CopyImage
ClientToScreen
CallWindowProcA
BeginPaint
CharNextA
CharUpperBuffA
CharToOemA
GetKeyboardType
DestroyWindow
LoadStringA
MessageBoxA
CharNextA
CreateWindowExA

wininet

InternetSetFilePointer
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry

Sections

UPX0
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

74b53716cdd27c54535b2a1dfa3238e4

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

gdi32

oleaut32

shell32

user32

wininet

Sections

UPX0 Size: 272KB - Virtual size: 272KB

.rsrc Size: 2KB - Virtual size: 4KB

.avc Size: 6KB - Virtual size: 8KB

UPX0
Size: 272KB - Virtual size: 272KB

.rsrc
Size: 2KB - Virtual size: 4KB

.avc
Size: 6KB - Virtual size: 8KB