2b2d99db26bace618ee71fa0ad354a57_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b2d99db26bace618ee71fa0ad354a57_JaffaCakes118
Size

1.1MB
MD5

2b2d99db26bace618ee71fa0ad354a57
SHA1

232e44ff512840e96764c800b92fd1957f606e7e
SHA256

fa423fbfdb26190ec309ecc4169f2fd6188727d519c6b04428a57ccdf8839785
SHA512

8852fc7d462fd403543b52523576d09845578e7435cfa47bfb6857391fdac699d66f49918fa93fe2fa918d7086164677d8888ffb42e81633fcc2d751e45b2005
SSDEEP

24576:wd0LwaS8mAtPXk0AcIsZIuYaQ2fZHE1aJ9O5kYrA3Vjn7sMYK5aXsro:M0saqmPXkPuYf2m1G9O5kYEFfss8X

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b2d99db26bace618ee71fa0ad354a57_JaffaCakes118

Files

2b2d99db26bace618ee71fa0ad354a57_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd3f569a431c2c7fdcf8ba45b0cb905a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_BeginDrag
InitCommonControlsEx
ImageList_DragMove
ImageList_EndDrag
ImageList_GetImageCount
ImageList_DragLeave
ImageList_Remove
ImageList_LoadImageW
FlatSB_SetScrollProp
ImageList_AddMasked
ImageList_DragEnter
ImageList_Draw
ImageList_DragShowNolock
_TrackMouseEvent
CreatePropertySheetPageW
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_GetIconSize
ImageList_Destroy
PropertySheetW
DestroyPropertySheetPage
ImageList_Create
ord8

winmm

waveOutClose
waveOutWrite
waveOutPrepareHeader
waveOutPause
waveOutGetVolume
waveOutGetPosition
waveOutRestart
waveOutReset
waveOutSetVolume
waveOutOpen
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutUnprepareHeader

wininet

InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
InternetSetOptionW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetOpenW
InternetGetCookieW

msvcrt

__CxxFrameHandler
_itoa
_stricmp
_strnicmp
_wcsupr
strstr
_CxxThrowException
_mbsupr
strncpy
isalpha
isalnum
isspace
strncmp
log10
free
memmove
wcscat
wcschr
memcpy
strcpy
__p__fmode
__set_app_type
_itow
malloc
strlen
wcslen
wcsrchr
memset
??3@YAXPAX@Z
realloc
wcscmp
wcscpy
_wcsicmp
_beginthreadex
_purecall
wcsncmp
vswprintf
??2@YAPAXI@Z
wcsstr
strrchr
_wcsnicmp
_mbsstr
_mbslwr
vsprintf
sscanf
_wcslwr
abs
_mbsicmp
memcmp
_wtoi
wcsncpy
strcmp
iswspace
strchr
atoi
floor
_mbsinc
swscanf
labs
calloc
iswalnum
isleadbyte
pow
log
_wcsdup
_mbscmp
sprintf
swprintf
wcspbrk
fabs
_mbschr
sqrt
cos
_controlfp
_clearfp
rand
sin
towupper
tan
atof
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode

kernel32

lstrcatA
QueryPerformanceCounter
lstrlenA
GetVersionExA
DeviceIoControl
GetCurrentThread
SearchPathW
GetVolumeInformationW
GetVersion
CreateFileA
CreateFileMappingA
SetEndOfFile
GetFileTime
GetFileAttributesA
lstrcpyA
GetStartupInfoW
LCMapStringW
GetLocaleInfoA
FindResourceW
LoadResource
InterlockedIncrement
InterlockedDecrement
CreateDirectoryW
InitializeCriticalSection
WideCharToMultiByte
SizeofResource
GetVersionExW
GetFileAttributesW
GetModuleFileNameW
GetACP
lstrlenW
RaiseException
InterlockedExchange
GetLastError
GetThreadLocale
LockResource
DeleteCriticalSection
HeapAlloc
GetCurrentProcess
HeapFree
WaitForSingleObject
SetEvent
GetTickCount
VirtualFree
GetProcessHeap
TlsSetValue
TerminateThread
LeaveCriticalSection
MulDiv
FlushInstructionCache
VirtualAlloc
EnterCriticalSection
ResetEvent
CreateEventW
GetSystemInfo
GetCurrentThreadId
CloseHandle
DeleteFileW
SuspendThread
ResumeThread
ExitProcess
TlsGetValue
FreeLibrary
SetUnhandledExceptionFilter
GetModuleHandleW
VirtualQueryEx
LoadLibraryW
MultiByteToWideChar
GetProcAddress
GetModuleFileNameA
lstrcmpiW
ReadDirectoryChangesW
CreateFileW
GetOverlappedResult
WaitForMultipleObjects
GetFullPathNameW
GetEnvironmentVariableW
FindFirstFileW
SetEnvironmentVariableW
IsBadWritePtr
SetLastError
FindClose
lstrcatW
FindNextFileW
lstrcpyW
lstrcpynW
HeapReAlloc
GetFileSize
SetFilePointer
FreeResource
MapViewOfFile
UnmapViewOfFile
WriteFile
GetCPInfoExW
EnumSystemCodePagesW
CreateFileMappingW
EnumResourceLanguagesW
SetFileAttributesW
ReadFile
CreateThread
lstrcmpW
GlobalLock
IsBadReadPtr
GlobalAlloc
Sleep
GlobalUnlock
MoveFileW
LoadLibraryExW
GetLocalTime
GetCurrentProcessId
SetCurrentDirectoryW
GetTempFileNameW
GetDriveTypeW
GetTempPathW
GlobalFree
DosDateTimeToFileTime
SetThreadPriority
InterlockedExchangeAdd
CompareFileTime
InterlockedCompareExchange
GetCommandLineA
TlsAlloc
GetWindowsDirectoryW
TlsFree
SystemTimeToFileTime
GetSystemTimeAsFileTime
FormatMessageW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree

user32

GetMenuItemRect
LockWindowUpdate
GetIconInfo
CharLowerW
EnumWindows
GetClassLongW
DrawEdge
ExitWindowsEx
WindowFromPoint
CallNextHookEx
SetForegroundWindow
DrawIconEx
GetMenuItemID
IsIconic
GetWindowDC
PostQuitMessage
OpenIcon
IsMenu
GetSystemMenu
InvertRect
RegisterClipboardFormatW
InsertMenuItemW
GetMenuStringW
CheckRadioButton
GetKeyNameTextW
MapVirtualKeyW
OemToCharBuffW
MessageBoxA
CharNextA
EndPaint
ClientToScreen
SetCursor
GetWindowTextLengthW
ScreenToClient
CharNextW
TrackPopupMenu
FillRect
SetCapture
DialogBoxIndirectParamW
GetFocus
DialogBoxParamW
CreateCursor
MessageBeep
IsWindowEnabled
SetFocus
BeginPaint
PtInRect
GetCapture
DrawFocusRect
LoadIconW
TrackPopupMenuEx
CheckMenuRadioItem
GetWindowTextW
DrawStateW
EndDialog
SendDlgItemMessageW
GetDesktopWindow
GetSysColor
LoadStringW
CheckDlgButton
InvalidateRgn
IsDlgButtonChecked
SetMenuDefaultItem
AdjustWindowRectEx
ReleaseCapture
IsRectEmpty
SetWindowTextW
GetWindow
SetWindowRgn
GetSubMenu
DeleteMenu
GetParent
LoadCursorW
GetClassInfoExW
GetDC
RegisterClassExW
OffsetRect
UnionRect
LoadMenuW
ReleaseDC
GetActiveWindow
GetMenuItemCount
InsertMenuW
EnableWindow
DestroyMenu
RegisterHotKey
SetParent
CreateAcceleratorTableW
GetMenuItemInfoW
SetDlgItemInt
GetDlgCtrlID
FindWindowW
CallWindowProcW
DefWindowProcW
DestroyWindow
GetMessageA
GetWindowRect
GetMessageW
PostMessageW
DrawTextW
MsgWaitForMultipleObjects
GetClientRect
wsprintfW
TranslateMessage
IntersectRect
BringWindowToTop
SetClassLongW
FrameRect
WindowFromDC
ShowScrollBar
SetWindowsHookExW
UnhookWindowsHookEx
SetMenuItemInfoW
GetMessagePos
CloseClipboard
TranslateAcceleratorW
GetDlgItemInt
DestroyAcceleratorTable
SetActiveWindow
AppendMenuW
IsChild
CheckMenuItem
DestroyIcon
UnregisterHotKey
GetSystemMetrics
SystemParametersInfoW
SetRect
SetRectEmpty
UnregisterClassW
LoadImageW
RegisterWindowMessageW
DispatchMessageW
MapWindowPoints
SendMessageW
SetDlgItemTextW
IsWindowVisible
MessageBoxW
DispatchMessageA
CreateWindowExW
IsDialogMessageW
GetClassNameW
EnableMenuItem
EmptyClipboard
GetWindowRgn
OpenClipboard
DeferWindowPos
BeginDeferWindowPos
SetClipboardData
EndDeferWindowPos
DrawFrameControl
CopyRect
GetWindowThreadProcessId
MoveWindow
GetKeyState
DrawTextA
ModifyMenuW
DestroyCursor
GetCursorPos
CreatePopupMenu
GetDlgItemTextW
IsWindow
CreateDialogParamW
LoadBitmapW
ShowWindow
SetWindowPos
RedrawWindow
SetWindowLongW
GetDlgItem
IsWindowUnicode
PeekMessageW
GetWindowLongW
SetTimer
KillTimer
UpdateWindow
GetSysColorBrush
InvalidateRect
InflateRect

gdi32

MoveToEx
CreateRectRgn
ExtTextOutW
CreateCompatibleBitmap
CreateCompatibleDC
SelectClipRgn
SelectObject
DeleteObject
SetBkMode
SetBkColor
GetCurrentObject
SetTextColor
BitBlt
GetObjectW
SelectPalette
StretchDIBits
RealizePalette
ExtCreateRegion
GetDIBits
GetTextMetricsW
GetWindowOrgEx
PatBlt
FrameRgn
SetBrushOrgEx
ExcludeClipRect
GetRegionData
CreateRectRgnIndirect
CombineRgn
OffsetRgn
CreateRoundRectRgn
CreatePatternBrush
StretchBlt
CreateBitmap
PtInRegion
SetStretchBltMode
CreateSolidBrush
DeleteDC
LineTo
CreateDIBSection
GetPixel
Polygon
CreatePen
SetWindowOrgEx
LPtoDP
CreateFontIndirectW
GetDeviceCaps
SetPixel
DPtoLP
SaveDC
OffsetWindowOrgEx
GetClipBox
IntersectClipRect
GetStockObject
RestoreDC
SetDIBitsToDevice

comdlg32

GetOpenFileNameW
ChooseFontW
ChooseColorW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegOpenKeyExW

shell32

ord155
SHChangeNotify
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderLocation
SHAddToRecentDocs
SHBrowseForFolderW
SHGetDesktopFolder
Shell_NotifyIconW
DragQueryFileW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
ExtractIconExW
ShellExecuteA

ole32

StringFromGUID2
OleInitialize
OleUninitialize
CoGetClassObject
RegisterDragDrop
ReleaseStgMedium
DoDragDrop
OleDuplicateData
CreateStreamOnHGlobal
OleGetClipboard
CoTaskMemRealloc
CoInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
ProgIDFromCLSID
CoFreeUnusedLibraries
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
OleSetClipboard
CoCreateInstance
RevokeDragDrop
OleLockRunning

oleaut32

VarUI4FromStr
SysAllocStringByteLen
LoadRegTypeLi
SysStringByteLen
OleCreateFontIndirect
SysAllocStringLen
VariantInit
LoadTypeLi
VariantClear
SysStringLen
DispCallFunc
SysAllocString
VarDecFromStr
VarDecCmp
VarR8FromStr
VarI4FromStr
VarDateFromStr
OleLoadPicture
SysFreeString

ttpcomm

ord302
ord91
ord92
ord206
ord202
ord205
ord204
ord101
ord80
ord81
ord82
ord105
ord90
ord4
ord93
ord102
ord100
ord106
ord59
ord73
ord61
ord58
ord50
ord71
ord64
ord76
ord55
ord67
ord56
ord72
ord69
ord74
ord57
ord66
ord65
ord79
ord70
ord68
ord54
ord53
ord62
ord60
ord75
ord78
ord51
ord13
ord52
ord11
ord14
ord12
ord10
ord201
ord400
ord3
ord200
ord1
ord104
ord103

msimg32

TransparentBlt

msvfw32

DrawDibClose
DrawDibOpen
DrawDibDraw

msacm32

acmStreamPrepareHeader
acmStreamUnprepareHeader
acmStreamSize
acmStreamClose
acmStreamConvert
acmStreamOpen
acmStreamReset

Exports

Exports

CreateSoundBuffer
CreateStdContent
CreateStreamOnFile
CreateStreamOnInet
GetSoundCodecName
_set_security_error_handler

Sections

.text
Size: 726KB - Virtual size: 725KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX
Size: 239KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bd3f569a431c2c7fdcf8ba45b0cb905a

Headers

File Characteristics

Imports

comctl32

winmm

wininet

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ttpcomm

msimg32

msvfw32

msacm32

Exports

Exports

Sections

.text Size: 726KB - Virtual size: 725KB

.rdata Size: 104KB - Virtual size: 103KB

.data Size: 14KB - Virtual size: 19KB

.rsrc Size: 44KB - Virtual size: 44KB

.UPX Size: 239KB - Virtual size: 240KB

.text
Size: 726KB - Virtual size: 725KB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 14KB - Virtual size: 19KB

.rsrc
Size: 44KB - Virtual size: 44KB

.UPX
Size: 239KB - Virtual size: 240KB