640e09a5f2db8a6a9b116866c76c8607_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

640e09a5f2db8a6a9b116866c76c8607_JaffaCakes118
Size

5.4MB
MD5

640e09a5f2db8a6a9b116866c76c8607
SHA1

6ba07e1b96b6b25ee5e952c20371a7a8b598def3
SHA256

aca37470c4e887879c66e422739820be31a2a037544d3697b6c1a4d7382756ae
SHA512

e6e19b357dc9db64c170aa3480371f27928c50996d72ab94c3c303ce520ab710c4eaf6f992b72715081401ce6142fe56b162ae593088c1588481c7591575e41e
SSDEEP

98304:XKBVxrIU7L0Vr+V34+nOR8+mCjXpIRerwdrCymvqZfrwngdzRMQ9:XAxfGOnOG+/M4qLBR79

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/SoundFX2.exe	upx
static1/unpack002/setup.exe	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack002/SoundFX2.exe
unpack003/out.upx
unpack002/setup.exe
unpack004/out.upx
unpack005/i2b2520.exe
unpack001/mirc612.exe

Files

640e09a5f2db8a6a9b116866c76c8607_JaffaCakes118
.rar
ScriptGuardfix.rar
.rar
SoundFX2.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 42KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mIRC.v6.1--Invision.v2.0.bld.2520.ScriptGuard.Fix.v1.2.by.PopWeasel-Instructions.nfo
setup.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 42KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
i2b2520.rar
.rar
i2b2520.exe
.exe windows:4 windows x86 arch:x86

e41c25ab7824b3df73334188c40518ae

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

lstrcpyA
GetCommandLineA
SetErrorMode
lstrlenA
MulDiv
GetTempFileNameA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
FormatMessageA
lstrcatA
GetLastError
_lwrite
_llseek
GlobalUnlock
_lopen
GlobalAlloc
GlobalFree
_lclose
_lcreat
LoadLibraryA
GetProcAddress
FreeLibrary
OpenFile
GetVersionExA
GetCurrentProcess
WinExec
ExitProcess
_lread
LocalFree
GetTempPathA
GlobalLock

user32

GetDC
BeginPaint
EndPaint
InvalidateRect
PostQuitMessage
SendMessageA
DefWindowProcA
GetClientRect
CreateWindowExA
DrawTextA
ReleaseDC
ShowWindow
SetWindowPos
UpdateWindow
SetTimer
LoadIconA
wsprintfA
MessageBoxA
ExitWindowsEx
RegisterClassA
LoadCursorA

gdi32

DeleteObject
GetStockObject
GetDeviceCaps
PatBlt
CreateSolidBrush
TextOutA
SetTextColor
SetBkMode
SelectObject
StretchDIBits
CreateFontA
RealizePalette
SelectPalette
CreatePalette

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

_MainWndProc@16
_StubFileWrite@12

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mirc612.exe
.exe windows:4 windows x86 arch:x86

c27c2d3f1b61a6eb7e51376898f0ff45

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetEndOfFile
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
HeapSize
RaiseException
LoadLibraryA
LCMapStringW
LCMapStringA
CreateFileA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetCurrentProcessId
GetWindowsDirectoryA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetCPInfo
GetOEMCP
GetACP
ReadFile
SetFilePointer
GetCurrentProcess
TerminateProcess
ExitProcess
CloseHandle
GetProcAddress
HeapFree
HeapAlloc
GetVersionExA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
MoveFileA
DeleteFileA
GetSystemTimeAsFileTime
RtlUnwind
CreateDirectoryA
SetErrorMode
Sleep
WideCharToMultiByte
SetCurrentDirectoryA
GetModuleFileNameA
GetTempPathA
GetFileAttributesA
SetFileAttributesA
MultiByteToWideChar
lstrlenA
FreeEnvironmentStringsW
GetLastError
RemoveDirectoryA

user32

SetFocus
wsprintfA
DdeConnect
LoadCursorA
RegisterClassA
CreateWindowExA
DdeInitializeA
GetMessageA
TranslateMessage
DispatchMessageA
DdeUninitialize
WinHelpA
DefWindowProcA
DialogBoxParamA
DestroyWindow
PostQuitMessage
SetTimer
KillTimer
PostMessageA
IsDlgButtonChecked
EndDialog
CheckDlgButton
BeginPaint
LoadIconA
DrawIcon
DdeCreateStringHandleA
IsWindowVisible
EndPaint
MessageBeep
DestroyIcon
UpdateWindow
InvalidateRect
EnableWindow
ShowWindow
MapWindowPoints
GetClientRect
GetDesktopWindow
SetWindowPos
SendMessageA
GetWindow
GetClassNameA
GetWindowLongA
SetWindowLongA
GetDlgItem
GetWindowRect
ScreenToClient
GetDC
FrameRect
FillRect
ReleaseDC
SendDlgItemMessageA
MessageBoxA
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle

gdi32

GetNearestColor
CreateSolidBrush
DeleteObject
SetTextColor
SetBkColor
ExtTextOutA
GetStockObject

advapi32

RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA
SHFileOperationA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 84KB

UPX1 Size: 42KB - Virtual size: 44KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 71KB - Virtual size: 72KB

.data Size: 2KB - Virtual size: 28KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 15KB - Virtual size: 16KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 84KB

UPX1 Size: 42KB - Virtual size: 44KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 71KB - Virtual size: 72KB

.data Size: 2KB - Virtual size: 28KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 15KB - Virtual size: 16KB

e41c25ab7824b3df73334188c40518ae

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

c27c2d3f1b61a6eb7e51376898f0ff45

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 60KB - Virtual size: 57KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

UPX0
Size: - Virtual size: 84KB

UPX1
Size: 42KB - Virtual size: 44KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 71KB - Virtual size: 72KB

.data
Size: 2KB - Virtual size: 28KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 15KB - Virtual size: 16KB

UPX0
Size: - Virtual size: 84KB

UPX1
Size: 42KB - Virtual size: 44KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 71KB - Virtual size: 72KB

.data
Size: 2KB - Virtual size: 28KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 15KB - Virtual size: 16KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.text
Size: 60KB - Virtual size: 57KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB