0fdee0eb4a7082cc5eeeabe0f0753264_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0fdee0eb4a7082cc5eeeabe0f0753264_JaffaCakes118
Size

520KB
MD5

0fdee0eb4a7082cc5eeeabe0f0753264
SHA1

569a25a48213baab4fc5098fcc32b98c6ca53cfc
SHA256

aeda23e2967832b866d3043dd57d07a73d88697d0a4cdae3141d61c6799568f2
SHA512

ce1d0bbc5d4803452e2a31638d85a8a5cd376d7914ecbc59d7e5a9c3cff5aaaff3c6c9506b0f25898176a7cbcefb022aef6c68f8333a098e2624591f48c782b1
SSDEEP

12288:3ILAAOgU0XGOlgGzDdqzx58ioppdjM1I/:3ILz++lgGzZqVIP8a

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fdee0eb4a7082cc5eeeabe0f0753264_JaffaCakes118

Files

0fdee0eb4a7082cc5eeeabe0f0753264_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f4c08536a829f7f2b2013a2171efa6cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psregapi

?QueryValue@CRegApi@@QAEJPBDPADAAK@Z
?OpenKey@CRegApi@@QAEJPAUHKEY__@@PBDK@Z
?CloseKey@CRegApi@@QAEJXZ
??1CRegistryEx@@UAE@XZ
??0CRegistryEx@@QAE@XZ
??0CRegApi@@QAE@XZ
?SetValue@CRegApi@@QAEJPBDK0@Z
?CreateKey@CRegApi@@QAEJPAUHKEY__@@PBDKKAAK@Z
?SetValue@CRegApi@@QAEJPBDJ@Z
?QueryValue@CRegApi@@QAEJPBDAAJ@Z
?DeleteKey@CRegApi@@QAEJPBD@Z
??BCRegApi@@QBEPAUHKEY__@@XZ
?DeleteValue@CRegApi@@QAEJPBD@Z
??1CRegApi@@UAE@XZ

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

RtlUnwind
TerminateProcess
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetDriveTypeA
CreateThread
ExitThread
HeapReAlloc
HeapSize
HeapFree
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileTime
GetFileSize
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetFileAttributesA
LCMapStringA
LCMapStringW
LockFile
SetEndOfFile
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTickCount
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
MoveFileA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnlockFile
FindResourceA
LoadResource
LocalFree
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
GetModuleFileNameA
GetVersionExA
GetSystemTime
SystemTimeToFileTime
CompareFileTime
lstrcpynA
WaitForSingleObject
LoadLibraryA
GetProcAddress
FreeLibrary
OpenMutexA
CreateMutexA
GetLocaleInfoA
CloseHandle
Sleep
TerminateThread
GetWindowsDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetSystemDirectoryA
OutputDebugStringA
GetProfileStringA
WriteFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
ReadFile
CreateFileA
FindResourceExA
DuplicateHandle
SetErrorMode
WritePrivateProfileStringA
GetThreadLocale
GetCurrentDirectoryA
GetOEMCP
TlsGetValue
GetCPInfo
GetProcessVersion
GlobalReAlloc
LocalReAlloc
TlsSetValue
TlsAlloc
TlsFree
GlobalHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GlobalFlags
InitializeCriticalSection
SizeofResource
lstrcmpA
GlobalAlloc
SuspendThread
GetCurrentThread
CreateEventA
SetEvent
SetThreadPriority
ResumeThread
FormatMessageA
MulDiv
SetLastError
InterlockedDecrement
MultiByteToWideChar
WideCharToMultiByte
lstrcatA
InterlockedIncrement
GetVersion
lstrcmpiA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalDeleteAtom
GlobalAddAtomA
GlobalFindAtomA
lstrlenA
lstrcpyA
GetModuleHandleA
GlobalFree
GlobalLock
GlobalUnlock
IsBadReadPtr
LockResource
IsBadCodePtr
GetACP
GetTimeZoneInformation
IsBadWritePtr

user32

SendDlgItemMessageA
UnpackDDElParam
BringWindowToTop
IsZoomed
GetAsyncKeyState
CharNextA
CopyAcceleratorTableA
GetNextDlgGroupItem
MessageBeep
WindowFromPoint
CharUpperA
RegisterClipboardFormatA
GetDCEx
LockWindowUpdate
PostThreadMessageA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
DestroyMenu
ReuseDDElParam
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
SetFocus
ScreenToClient
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
GetScrollPos
SetScrollPos
ShowOwnedPopups
MessageBoxA
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetDlgCtrlID
GetKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetMenuItemBitmaps
LoadAcceleratorsA
TranslateAcceleratorA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetWindowLongA
SetWindowPos
IntersectRect
GetWindowPlacement
GetNextDlgTabItem
GetActiveWindow
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
PostQuitMessage
GetMessageA
IsWindowEnabled
DrawIcon
GetTabbedTextExtentA
GetParent
GetDesktopWindow
InvalidateRect
GrayStringA
DrawTextA
TabbedTextOutA
DrawStateA
FillRect
EnumChildWindows
SetMenuDefaultItem
SetForegroundWindow
FlashWindowEx
GetLastActivePopup
GetWindowLongA
CallWindowProcA
IsIconic
GetCursorPos
GetDoubleClickTime
SetMenu
LoadMenuA
IsChild
SetParent
AdjustWindowRectEx
CreatePopupMenu
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetMenuItemID
ShowScrollBar
DeleteMenu
DrawMenuBar
GetMenuStringA
GetMenu
RemoveMenu
GetMenuItemCount
GetSubMenu
InsertMenuA
LoadIconA
RegisterWindowMessageA
GetWindowTextA
UpdateWindow
GetClassNameA
GetWindow
InflateRect
PtInRect
SetCapture
GetCapture
ReleaseCapture
LoadCursorA
GetSysColorBrush
MapDialogRect
SetWindowContextHelpId
SetCursor
UnhookWindowsHookEx
GetPropA
SetPropA
EndPaint
RegisterClassExA
SetWindowRgn
RedrawWindow
SetRectEmpty
DrawFrameControl
GetClientRect
OffsetRect
MonitorFromPoint
GetMonitorInfoA
CopyRect
ClientToScreen
PostMessageA
SetRect
GetSystemMetrics
LoadImageA
FindWindowA
FindWindowExA
EqualRect
IsRectEmpty
IsWindowVisible
SetTimer
KillTimer
GetIconInfo
GetDC
ReleaseDC
DrawIconEx
GetSysColor
SystemParametersInfoA
EnableWindow
SendMessageA
GetWindowRect
TranslateMessage
ValidateRect
LoadStringA
BeginPaint
GetWindowDC
SetWindowTextA
ShowWindow
MoveWindow
DestroyWindow
IsDialogMessageA
GetDlgItem
EndDialog
GetTopWindow
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
IsWindowUnicode

gdi32

CreateFontIndirectA
FrameRgn
CreateCompatibleDC
GetObjectA
GetStockObject
EqualRgn
StretchBlt
CreateSolidBrush
CreateRoundRectRgn
CombineRgn
CreateRectRgn
GetTextExtentPointA
CreatePen
CreatePolygonRgn
CreateCompatibleBitmap
CreateDIBitmap
GetPixel
SelectObject
SetBkMode
SetMapMode
SetViewportOrgEx
SetStretchBltMode
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SelectClipRgn
ExcludeClipRect
ScaleWindowExtEx
SaveDC
IntersectClipRect
LineTo
MoveToEx
GetDeviceCaps
GetWindowExtEx
GetViewportExtEx
CreatePatternBrush
StretchDIBits
SetRectRgn
GetTextMetricsA
GetTextColor
EnumFontFamiliesExA
DeleteDC
SetBkColor
SetTextColor
CreateBitmap
CreateRectRgnIndirect
GetClipBox
PatBlt
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
LPtoDP
GetMapMode
DPtoLP
GetBkColor
RoundRect
GetTextExtentPoint32A
RestoreDC
BitBlt
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA

shell32

DragQueryFileA
DragFinish
Shell_NotifyIconA

comctl32

ImageList_AddMasked
PropertySheetA
ord17
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_SetBkColor
ImageList_Draw
_TrackMouseEvent

oledlg

ord8

ole32

OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoRevokeClassObject
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CoTaskMemAlloc
CreateILockBytesOnHGlobal

olepro32

ord253

oleaut32

SysStringLen
SysAllocStringByteLen
VariantCopy
SysAllocString
VariantChangeType
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysFreeString

Sections

.text
Size: 264KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4c08536a829f7f2b2013a2171efa6cd

Headers

File Characteristics

Imports

psregapi

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 264KB - Virtual size: 260KB

.rdata Size: 60KB - Virtual size: 56KB

.data Size: 20KB - Virtual size: 35KB

.rsrc Size: 28KB - Virtual size: 24KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 264KB - Virtual size: 260KB

.rdata
Size: 60KB - Virtual size: 56KB

.data
Size: 20KB - Virtual size: 35KB

.rsrc
Size: 28KB - Virtual size: 24KB

UPX0
Size: 144KB - Virtual size: 380KB