f949b8c19ae49da1f4c8827354641be4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f949b8c19ae49da1f4c8827354641be4_JaffaCakes118
Size

1.0MB
MD5

f949b8c19ae49da1f4c8827354641be4
SHA1

1a478b73117ea5b10e63596bc025764abb7b6e6b
SHA256

21e2c3a80a747dbece4827e7c4882543061bf8223fdcef2466026cfb3b5729e9
SHA512

4d4d97813279520e2b3842aa23548606c5047da1a0e22d309bef23b2c0979e4a8e1434f72508fddb0c3cda6f20ac1877593213532bd512b05ce9f781d9d6cec8
SSDEEP

24576:DmbOP9ziqR+3vbLfnvZtoGXBaNnnjgH+3YC2i:KbOPNiqRcj7Zto+AlUeII

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f949b8c19ae49da1f4c8827354641be4_JaffaCakes118

Files

f949b8c19ae49da1f4c8827354641be4_JaffaCakes118
.exe windows:6 windows x86 arch:x86

ebe36182e8d9d955e9eef856fd34fb62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

oWgaTray.pdb

Imports

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegOpenKeyExW
RegEnumKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
CryptImportKey
RegEnumKeyExW
RegEnumKeyExA
GetCurrentHwProfileA
GetCurrentHwProfileW
RegEnumKeyA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
OpenThreadToken
GetLengthSid
CopySid
LookupAccountNameW
OpenProcessToken
GetTokenInformation
RegCreateKeyExA
RegSetValueExA

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
CreateWaitableTimerW
VirtualFree
LoadLibraryW
InitializeCriticalSectionAndSpinCount
GetSystemTime
GetExitCodeThread
GetLogicalDriveStringsA
GetVolumeInformationA
GlobalMemoryStatus
GetProcessAffinityMask
SetThreadAffinityMask
ResumeThread
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeInformationW
GetSystemInfo
lstrlenW
lstrlenA
ReadFile
FindNextFileA
CancelWaitableTimer
DeviceIoControl
GetFileSize
TerminateThread
MapViewOfFile
UnmapViewOfFile
GetComputerNameW
GetPrivateProfileSectionW
GetPrivateProfileStringW
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesW
CreateFileW
TryEnterCriticalSection
GetSystemDefaultLCID
DeleteFileA
MoveFileA
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
GetTempPathA
CreateDirectoryA
GetCurrentDirectoryW
CreateDirectoryW
CreateMutexA
GetDriveTypeA
GetSystemDirectoryW
FindFirstFileW
FindFirstFileA
FindClose
ReadProcessMemory
GetLocalTime
SystemTimeToFileTime
CompareFileTime
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetUserDefaultLCID
SetWaitableTimer
GetSystemDefaultLangID
ResetEvent
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
CreateFileMappingA
GetFileAttributesA
FreeLibrary
LCMapStringW
WideCharToMultiByte
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
HeapSize
Sleep
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
HeapCreate
HeapDestroy
GetCurrentThread
TlsFree
GetModuleFileNameA
GetVersionExA
DeleteCriticalSection
GetSystemDirectoryA
WaitForMultipleObjects
CreateThread
CreateEventW
GetTickCount
WaitForSingleObject
ReleaseMutex
HeapSetInformation
InitializeCriticalSection
CreateMutexW
SetProcessWorkingSetSize
GetCurrentProcessId
OpenEventW
SetEvent
CloseHandle
InterlockedIncrement
InterlockedDecrement
SetLastError
GetCurrentThreadId
GetLastError
EnumResourceLanguagesW
GetCurrentProcess
FlushInstructionCache
RaiseException
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
HeapReAlloc
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
SetEndOfFile
GetVersion
VirtualProtect

gdi32

SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectW
GetObjectW
CreateDIBSection
BitBlt
SetTextColor
DeleteDC
CreateSolidBrush
SetBkMode
GetStockObject
DeleteObject
GetTextExtentExPointW

user32

PostMessageW
GetMenuItemID
DeleteMenu
GetMenuItemCount
CreateWindowExW
SetWindowLongW
LoadImageW
DestroyIcon
LoadStringW
RegisterWindowMessageW
ShowWindow
UpdateWindow
BroadcastSystemMessageA
wsprintfA
SetMenuDefaultItem
SetWindowPos
SetSysColors
SystemParametersInfoW
GetForegroundWindow
CopyRect
OffsetRect
GetDC
UpdateLayeredWindow
ReleaseDC
MapWindowPoints
InflateRect
SetRect
IsWindow
EndPaint
BeginPaint
SendMessageW
DestroyWindow
DrawTextW
GetFocus
DrawFocusRect
DrawIconEx
GetWindowTextLengthW
SetDlgItemTextW
SendDlgItemMessageW
GetClientRect
GetWindowTextW
GetSysColor
SetLayeredWindowAttributes
InvalidateRect
GetWindowRect
GetDlgItem
GetWindowLongW
EndDialog
GetDlgCtrlID
GetMessageW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
DefWindowProcW
PostQuitMessage
FindWindowW
IsWindowVisible
GetActiveWindow
DialogBoxParamW
CreateDialogParamW
GetDoubleClickTime
SetTimer
LoadMenuW
GetSubMenu
GetCursorPos
SetForegroundWindow
TrackPopupMenu
DestroyMenu
KillTimer
UnregisterClassA
SystemParametersInfoA
GetDesktopWindow
GetWindowLongA
GetParent
GetSystemMetrics
GetMonitorInfoA
GetClassNameW
SetWindowTextW
SendMessageA

shell32

Shell_NotifyIconW
ShellExecuteA
ShellExecuteW
SHAppBarMessage

ole32

CLSIDFromProgID
CoCreateGuid
StringFromGUID2
CoSetProxyBlanket
CoFreeUnusedLibraries
CoCreateInstance
CoInitializeEx
CoUninitialize
IIDFromString

oleaut32

SysAllocString
VariantInit
VariantClear
SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen

crypt32

CryptProtectData
CryptUnprotectData
CertEnumCertificatesInStore
CertFindExtension
CryptExportPublicKeyInfo
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertGetIssuerCertificateFromStore
CertDuplicateCertificateContext
CertCreateCertificateContext
CertCloseStore
CertComparePublicKeyInfo
CertOpenStore

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

shlwapi

SHDeleteValueW

comctl32

InitCommonControlsEx

wininet

InternetSetOptionA
InternetOpenA
InternetErrorDlg
InternetAutodial
InternetGetConnectedState
HttpQueryInfoA
HttpSendRequestA
InternetQueryOptionA
HttpOpenRequestA
InternetConnectA
InternetReadFile
InternetCloseHandle

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo

Sections

.text
Size: 712KB - Virtual size: 711KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ebe36182e8d9d955e9eef856fd34fb62

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

shell32

ole32

oleaut32

crypt32

version

shlwapi

comctl32

wininet

setupapi

Sections

.text Size: 712KB - Virtual size: 711KB

.data Size: 50KB - Virtual size: 49KB

.rsrc Size: 111KB - Virtual size: 111KB

.reloc Size: 31KB - Virtual size: 31KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 712KB - Virtual size: 711KB

.data
Size: 50KB - Virtual size: 49KB

.rsrc
Size: 111KB - Virtual size: 111KB

.reloc
Size: 31KB - Virtual size: 31KB

UPX0
Size: 144KB - Virtual size: 380KB