76ff04b4422d81d59171cc39823243cd_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

76ff04b4422d81d59171cc39823243cd_JaffaCakes118
Size

572KB
MD5

76ff04b4422d81d59171cc39823243cd
SHA1

950d3bc2568653832a872a66aa9ac9e156a7203b
SHA256

699552c316597c22747c48f2ff4ba6709ae2134528516f0980dfd1744e6712bc
SHA512

8a32922d99a836deafcc1d0d89b311296e3c7154923feb3f2364c56ffbc1c97e540183efc0d3884685d672b6534f9cfb9ffe9b3a7b0d6410aa8a5e89b54cc784
SSDEEP

3072:jXukYGM+OX5eE6IUCyMbVuHls7AkU3RvEpE6C6nx5YeHsYZWPFHtF73a/9fv9Emd:jXg+OX5JeHGuu0EpHC6nUW6H+zm

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
76ff04b4422d81d59171cc39823243cd_JaffaCakes118

Files

76ff04b4422d81d59171cc39823243cd_JaffaCakes118
.exe windows:1 windows x86 arch:x86

3fc47e63a3ff36b8f5a79f33736e28b1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
WriteFile
WaitForSingleObject
SwitchToThread
SleepEx
QueueUserAPC
LoadLibraryW
GetSystemTime
GetProcAddress
GetModuleFileNameW
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
FreeLibrary
CreateThread
CreateFileW
CloseHandle
LoadLibraryA
VirtualAlloc

user32

ShowWindow
SendMessageW
PostMessageW
OffsetRect
MessageBoxW
LockWindowUpdate
IsIconic
InflateRect
GetSysColorBrush
FindWindowW
FillRect
DefWindowProcW
CharLowerA
LoadCursorFromFileW
LoadIconA
GetMenuContextHelpId
GetMessagePos
CharNextW
GetKeyState
GetShellWindow
GetDoubleClickTime
GetWindowContextHelpId
GetQueueStatus
CreatePopupMenu
DestroyWindow
CloseDesktop
EndMenu
GetForegroundWindow
IsWindowVisible
GetListBoxInfo
GetClipboardOwner
IsCharAlphaW
GetFocus
GetWindowDC
CharUpperA
GetDC
OpenIcon
GetAsyncKeyState
GetClipboardViewer
GetThreadDesktop
GetClipboardData
GetSystemMetrics
IsGUIThread

gdi32

DeleteObject
CreateSolidBrush
GetRelAbs
GdiEndDocEMF
PaintRgn
CLIPOBJ_ppoGetPath
EngUnlockSurface
SetLayout
EngDeletePath
ScaleWindowExtEx
CloseFigure
CreateRectRgnIndirect
UnrealizeObject
TextOutA
GetMapMode
SetBitmapDimensionEx
RemoveFontResourceA
GetObjectA
GetBrushOrgEx
FillRgn
MaskBlt
SetViewportExtEx
GdiGetSpoolMessage
GetStockObject
AddFontResourceW
GetDCPenColor
EndPath
CreateCompatibleDC
CloseEnhMetaFile
WidenPath
GetBkColor
GetLayout
DeleteColorSpace
GetFontLanguageInfo
AbortPath
CloseMetaFile
GetBkMode

advapi32

RegQueryValueExW
RegOpenKeyW
RegCloseKey
RegQueryValueExA

shell32

ExtractIconExW
DragAcceptFiles
SHGetMalloc
CheckEscapesW
SHGetFolderPathW
SHAppBarMessage
SHInvokePrinterCommandA
Shell_NotifyIcon
SHGetIconOverlayIndexA
ExtractAssociatedIconExA
SHGetPathFromIDList
SHFreeNameMappings
DragQueryFileA
SHGetFileInfoW
ShellHookProc
SHEmptyRecycleBinW
Shell_NotifyIconA
SHLoadInProc
SHGetDataFromIDListA
DragQueryFileAorW
ExtractIconExA
SHFileOperationA
ShellExecuteA
SHIsFileAvailableOffline
ExtractAssociatedIconW
CommandLineToArgvW
ShellExecuteW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

shlwapi

StrStrW
StrChrIW
StrRStrIW
StrRStrIA
StrRChrA
StrCmpNIW
StrRChrIW

comctl32

ImageList_Create
InitCommonControlsEx

Sections

.text
Size: 479KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3fc47e63a3ff36b8f5a79f33736e28b1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

Sections

.text Size: 479KB - Virtual size: 478KB

.rdata Size: 512B - Virtual size: 428B

.data Size: 44KB - Virtual size: 44KB

.rsrc Size: 47KB - Virtual size: 47KB

.text
Size: 479KB - Virtual size: 478KB

.rdata
Size: 512B - Virtual size: 428B

.data
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 47KB - Virtual size: 47KB