017bc56a952d2ba5c5dd2381f0524b2c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

017bc56a952d2ba5c5dd2381f0524b2c_JaffaCakes118
Size

1.1MB
MD5

017bc56a952d2ba5c5dd2381f0524b2c
SHA1

30108ee39950f98a15004ae007dc13e09c5cc020
SHA256

4bb8653083c27ee61195d4de3285b0191a34aae6457ee3bead963211d34ea60b
SHA512

4c5965862a5dcbc7480d14309cbec27f989d4df460c32ad7899a65590fc565b45b3b3089ca58da4103ab09232ef85fcffbb20fcc0c86be482f78c1dca79883ef
SSDEEP

24576:AoH5iVlqKKQpYwsc/j5Z9QYAbYZSMPOlt402eDHB94XjJ4790S1qz6GqTG1639tY:v5iVl4Qp+c/j5/Ib/52eDn4iqz6+M9PC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/caidao.exe	upx
static1/unpack004/caidao.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack002/caidao.exe
unpack003/out.upx
unpack004/caidao.exe
unpack005/out.upx
unpack006/caidao-20160622/caidao.exe

Files

017bc56a952d2ba5c5dd2381f0524b2c_JaffaCakes118
.zip
caidao-official-version-master/MD5.txt
caidao-official-version-master/README.md
caidao-official-version-master/caidao-20111116.zip
.zip
CCC/aspRwWithJMail.ccc
.vbs
CCC/aspSpy.ccc
.vbs
CCC/aspx.ccc
.js
CCC/php.ccc
CCC/phpSpy.ccc
.js
Customize/Customize.aspx
.asp .js polyglot
Customize/Customize.cfm
.vbs
Customize/Customize.jsp
.asp .js polyglot
caidao.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 488KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 206KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 452KB - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
readme.txt
.vbs
caidao-official-version-master/caidao-20141213.zip
.zip
CCC/aspRwWithJMail.ccc
.vbs
CCC/aspSpy.ccc
.vbs
CCC/aspx.ccc
.js
CCC/php.ccc
CCC/phpSpy.ccc
.js
Customize/Customize.aspx
.asp .js polyglot
Customize/Customize.cfm
.vbs
Customize/Customize.jsp
.asp .js polyglot
caidao.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 496KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 206KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
readme.txt
.vbs
caidao-official-version-master/caidao-20160622.zip
.zip
caidao-20160622/CCC/aspRwWithJMail.ccc
.vbs
caidao-20160622/CCC/aspSpy.ccc
.vbs
caidao-20160622/CCC/aspx.ccc
.js
caidao-20160622/CCC/php.ccc
caidao-20160622/CCC/phpSpy.ccc
.js
caidao-20160622/Customize/Customize.aspx
.asp .js polyglot
caidao-20160622/Customize/Customize.cfm
.vbs
caidao-20160622/Customize/Customize.jsp
.asp .js polyglot
caidao-20160622/caidao.conf
.vbs
caidao-20160622/caidao.exe
.exe windows:4 windows x86 arch:x86

d3e2f4b245b18b525051c15456ef2be9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord818
ord641
ord567
ord324
ord2294
ord4229
ord4294
ord2859
ord2371
ord4704
ord5276
ord6211
ord5977
ord3798
ord4847
ord4470
ord6445
ord2719
ord6466
ord2722
ord2721
ord2879
ord3232
ord1165
ord2756
ord6868
ord858
ord1791
ord614
ord2615
ord290
ord4616
ord4221
ord2478
ord3998
ord665
ord354
ord2910
ord6655
ord2293
ord2362
ord6330
ord6195
ord3087
ord1834
ord4237
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord2641
ord1658
ord4430
ord4421
ord674
ord366
ord3614
ord3658
ord3621
ord642
ord2406
ord809
ord6063
ord6064
ord3478
ord6205
ord2618
ord2079
ord5996
ord2109
ord1761
ord6193
ord3133
ord3792
ord4451
ord1937
ord2634
ord1560
ord1258
ord1130
ord1941
ord2225
ord268
ord5848
ord5945
ord5480
ord2447
ord4718
ord4768
ord5278
ord6065
ord2606
ord6796
ord6374
ord6376
ord5048
ord4279
ord3172
ord3494
ord355
ord5248
ord3568
ord3688
ord5784
ord1634
ord2745
ord283
ord2854
ord6871
ord4975
ord5024
ord6004
ord1105
ord6874
ord6139
ord2914
ord2385
ord5349
ord5352
ord5803
ord6054
ord5420
ord5198
ord4124
ord6422
ord6055
ord389
ord1225
ord4272
ord801
ord541
ord3084
ord6640
ord3871
ord5679
ord3296
ord922
ord942
ord1971
ord4197
ord6006
ord6381
ord5180
ord3995
ord2507
ord6649
ord5438
ord6872
ord3313
ord1075
ord5857
ord5706
ord3867
ord6279
ord6278
ord4199
ord654
ord5854
ord536
ord341
ord925
ord2813
ord3806
ord1854
ord2576
ord3649
ord4215
ord2430
ord2400
ord1637
ord1143
ord2858
ord5568
ord1172
ord5871
ord5783
ord472
ord2746
ord2857
ord5436
ord6379
ord5446
ord6390
ord556
ord3566
ord755
ord640
ord2558
ord6168
ord5785
ord5781
ord1633
ord323
ord470
ord6597
ord1088
ord2114
ord5949
ord2637
ord3737
ord6437
ord1263
ord1229
ord4270
ord2372
ord2567
ord4390
ord3569
ord609
ord3701
ord2855
ord4128
ord4292
ord5047
ord4282
ord2078
ord2081
ord2397
ord2559
ord4474
ord3605
ord656
ord2755
ord2572
ord4394
ord3625
ord682
ord2442
ord5674
ord5782
ord5732
ord2732
ord2793
ord2574
ord4396
ord3365
ord3635
ord693
ord4238
ord6238
ord6688
ord4155
ord6654
ord6003
ord3281
ord3993
ord6898
ord3288
ord4688
ord5142
ord6451
ord6646
ord6754
ord3991
ord537
ord3747
ord6150
ord2522
ord4359
ord692
ord5467
ord4116
ord2381
ord5079
ord1702
ord1707
ord4398
ord5230
ord6365
ord5275
ord5254
ord2436
ord3717
ord796
ord529
ord4260
ord3479
ord4448
ord2144
ord1230
ord6266
ord3579
ord803
ord543
ord6174
ord2423
ord3802
ord4358
ord1705
ord6049
ord5244
ord3593
ord327
ord4230
ord2631
ord4469
ord5076
ord610
ord2837
ord6797
ord6135
ord927
ord287
ord3393
ord3728
ord810
ord4266
ord2070
ord4042
ord3098
ord6115
ord3915
ord3282
ord3909
ord3706
ord783
ord2104
ord6124
ord384
ord686
ord2088
ord1833
ord4583
ord4582
ord4893
ord4364
ord4886
ord4527
ord5070
ord4334
ord4341
ord4883
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord4957
ord4954
ord4103
ord6050
ord5236
ord3743
ord1718
ord5256
ord2083
ord4426
ord3716
ord795
ord364
ord784
ord4236
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord2072
ord2108
ord4714
ord5031
ord3298
ord3905
ord5277
ord5604
ord616
ord2550
ord4502
ord6589
ord6642
ord6583
ord6798
ord6848
ord6814
ord6846
ord6823
ord6850
ord6858
ord6838
ord6837
ord6836
ord6808
ord6683
ord6510
ord6475
ord6791
ord1594
ord6691
ord6806
ord6807
ord6830
ord6663
ord6849
ord5867
ord6805
ord6799
ord2052
ord6826
ord3000
ord2127
ord4875
ord6804
ord6847
ord6803
ord6896
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord3733
ord815
ord561
ord6479
ord2243
ord4041
ord2137
ord2136
ord6221
ord5227
ord5243
ord2124
ord4595
ord826
ord617
ord5297
ord986
ord520
ord2444
ord4154
ord6113
ord2613
ord6433
ord1131
ord824
ord5208
ord296
ord5431
ord1676
ord1666
ord2620
ord5976
ord2633
ord4117
ord6210
ord6192
ord4293
ord5944
ord3083
ord3866
ord3869
ord3868
ord6194
ord4281
ord4278
ord3132
ord3791
ord5715
ord6088
ord3519
ord4027
ord6091
ord4030
ord2541
ord2425
ord3348
ord3574
ord726
ord426
ord2717
ord2819
ord668

msvcrt

_controlfp
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
__set_app_type
__CxxFrameHandler
_except_handler3
_wtoi
wcscmp
_CxxThrowException
wcscpy
free
realloc
malloc
_wcsicmp
iswdigit
fread
memmove
rand
_ftol
atof
srand
time
exit
wcslen
fclose
fopen
strstr
tolower
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

kernel32

WideCharToMultiByte
GetLocalTime
GetSystemDefaultLangID
GlobalFree
WaitForSingleObject
MultiByteToWideChar
GlobalAlloc
GetModuleHandleW
GetStartupInfoW
CloseHandle
DeleteFileW
MoveFileW
GetModuleFileNameW
EnterCriticalSection
LocalFree
FormatMessageW
GetLastError
Sleep
GetTickCount
CreateThread
lstrcmpW
GetProcAddress
LoadLibraryW
lstrlenW
lstrcpyW
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
FreeLibrary
GlobalLock
TerminateThread
SuspendThread
GetExitCodeThread
InterlockedDecrement
FindClose
FindFirstFileW
GetWindowsDirectoryW
GetVersionExW
GetCurrentThreadId
CreateMutexW
GlobalUnlock
lstrlenA
InterlockedIncrement

user32

ReleaseCapture
GetCursorPos
MessageBeep
DrawTextW
UpdateWindow
SetMenuDefaultItem
IsChild
IsRectEmpty
ClientToScreen
DrawFocusRect
SetParent
GetScrollInfo
CallWindowProcW
TrackPopupMenu
SetMenuItemInfoW
AppendMenuW
ShowWindow
CallNextHookEx
LoadBitmapW
SetWindowsHookExW
BroadcastSystemMessageW
CloseClipboard
SetClipboardData
EmptyClipboard
SetCapture
GetWindow
GetClassNameW
LoadIconW
RedrawWindow
PostMessageW
LoadCursorW
SetCursor
GetWindowDC
OffsetRect
ReleaseDC
FindWindowW
IsZoomed
IsWindow
IsIconic
SetForegroundWindow
SetActiveWindow
GetKeyState
GetAsyncKeyState
IsWindowVisible
InvalidateRect
SetWindowLongW
SetMenu
GetSystemMetrics
GetWindowRect
EnableWindow
SetRect
GetWindowTextW
SetWindowRgn
GetClassInfoW
DefWindowProcW
GetWindowLongW
GetFocus
ShowScrollBar
OpenClipboard
PtInRect
SetTimer
KillTimer
GetActiveWindow
ScreenToClient
GetClientRect
SendMessageW
GetParent
RegisterWindowMessageW
DrawIconEx
DrawStateW
FillRect
CopyRect
GetDC
InsertMenuW
ModifyMenuW
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMenuStringW
GetSubMenu
LoadMenuW
CreatePopupMenu
CreateMenu

gdi32

CreateSolidBrush
CreateFontW
GetObjectW
PtInRegion
StretchBlt
FillRgn
CreatePolygonRgn
CreateRectRgnIndirect
CreateRoundRectRgn
Ellipse
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
RoundRect
BitBlt
GetTextExtentPoint32W
CreatePen
Rectangle

advapi32

RegCloseKey
RegOpenKeyW
RegSetValueExW

shell32

SHGetFileInfoW
SHGetDesktopFolder
DragQueryFileW
DragFinish
ShellExecuteW
Shell_NotifyIconW

comctl32

_TrackMouseEvent
ImageList_GetIcon
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_Draw
ImageList_GetImageInfo
ImageList_ReplaceIcon

ole32

CLSIDFromProgID
CoCreateInstance
CLSIDFromString
OleRun
CoUninitialize
CoInitialize

oleaut32

SysAllocString
VariantClear
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SafeArrayDestroy
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantChangeType
GetErrorInfo
VariantInit

wininet

InternetSetCookieA
InternetCrackUrlW

ws2_32

inet_addr
closesocket
WSACleanup
inet_ntoa
send
recv
setsockopt
accept
WSAStartup
listen
bind
htons
socket
__WSAFDIsSet
select
ntohl
gethostbyname

winmm

PlaySoundW

gdiplus

GdipSetPenMode
GdiplusStartup
GdipCreateFromHDC
GdipCreatePen1
GdipDeleteGraphics
GdipDeletePen
GdipDrawArcI
GdipDrawLineI
GdipSetPenColor

Sections

.text
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
caidao-20160622/ip.dat
caidao-20160622/readme.txt
.vbs

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 488KB

UPX1 Size: 206KB - Virtual size: 208KB

.rsrc Size: 8KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 452KB - Virtual size: 450KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 104KB - Virtual size: 107KB

.rsrc Size: 44KB - Virtual size: 42KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 496KB

UPX1 Size: 206KB - Virtual size: 208KB

.rsrc Size: 8KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 444KB - Virtual size: 443KB

.rdata Size: 80KB - Virtual size: 78KB

.data Size: 120KB - Virtual size: 122KB

.rsrc Size: 44KB - Virtual size: 42KB

d3e2f4b245b18b525051c15456ef2be9

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

wininet

ws2_32

winmm

gdiplus

Sections

.text Size: 400KB - Virtual size: 399KB

.rdata Size: 76KB - Virtual size: 73KB

.data Size: 44KB - Virtual size: 47KB

.rsrc Size: 44KB - Virtual size: 42KB

UPX0
Size: - Virtual size: 488KB

UPX1
Size: 206KB - Virtual size: 208KB

.rsrc
Size: 8KB - Virtual size: 8KB

.text
Size: 452KB - Virtual size: 450KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 104KB - Virtual size: 107KB

.rsrc
Size: 44KB - Virtual size: 42KB

UPX0
Size: - Virtual size: 496KB

UPX1
Size: 206KB - Virtual size: 208KB

.rsrc
Size: 8KB - Virtual size: 8KB

.text
Size: 444KB - Virtual size: 443KB

.rdata
Size: 80KB - Virtual size: 78KB

.data
Size: 120KB - Virtual size: 122KB

.rsrc
Size: 44KB - Virtual size: 42KB

.text
Size: 400KB - Virtual size: 399KB

.rdata
Size: 76KB - Virtual size: 73KB

.data
Size: 44KB - Virtual size: 47KB

.rsrc
Size: 44KB - Virtual size: 42KB