3df36f4077ef7999bc4e628aa9279d67_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3df36f4077ef7999bc4e628aa9279d67_JaffaCakes118
Size

1.1MB
MD5

3df36f4077ef7999bc4e628aa9279d67
SHA1

91fd3d6f8e390c0f884ff838464c6a77ce90db74
SHA256

90a08232d118348cad893c7a67be62b52bd68ccda7398e3269190bda6d7b770c
SHA512

5c020b7b99accad2bd2912895a1ec1dd7d8215fd83cbd59925a9a385dcc21c794090037448a0cb2800b5add63a6e713b27b3d0ceed6e5cbd5afe1bb10a3c9655
SSDEEP

24576:Xq+hTZeyGjz9H2aCPdeNi92IX2h+/caqBzCwgIr:6+hb8BWaCThjqBzC

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3df36f4077ef7999bc4e628aa9279d67_JaffaCakes118

Files

3df36f4077ef7999bc4e628aa9279d67_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5321c425ad998b4ed59b305edef99cc8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecA
SHAutoComplete

winmm

waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
sndPlaySoundA
PlaySoundA

kernel32

GetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SystemTimeToFileTime
GetOEMCP
GetCPInfo
GetProcessVersion
GetProfileIntA
GetProfileStringA
SetEnvironmentVariableA
CompareStringW
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetDriveTypeA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsGetValue
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
TerminateProcess
GetACP
ExitThread
GetSystemTime
GetTimeZoneInformation
HeapFree
HeapAlloc
RaiseException
RtlUnwind
CompareStringA
GetPrivateProfileSectionNamesA
GetExitCodeThread
ResetEvent
GetVersionExA
EnumResourceLanguagesA
EnumResourceNamesA
EnumResourceTypesA
CloseHandle
LocalReAlloc
TerminateThread
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
CreateEventA
Sleep
VirtualFree
VirtualAlloc
GetLocalTime
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GlobalFlags
MulDiv
GetDiskFreeSpaceA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
SetFilePointer
ReadFile
CreateFileA
DeleteFileA
GetFileSize
MoveFileA
WritePrivateProfileStringA
CopyFileA
lstrlenA
WriteFile
GetFileAttributesA
lstrcpyA
lstrcatA
GetTempPathA
SizeofResource
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
GetSystemDirectoryA
LoadResource
FindResourceA
GetTickCount
LockResource
GetVolumeInformationA
GetComputerNameA
ExitProcess
GetStartupInfoA
IsBadWritePtr
GetCommandLineA
GetModuleFileNameA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetFileTime
GetTempFileNameA
GetCurrentThread
lstrcmpA
SetThreadPriority
SetLastError
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
FormatMessageA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
LocalSize
GetVersion
GlobalSize
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CancelIo
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
GetQueuedCompletionStatus
CreateIoCompletionPort
GetSystemInfo
PostQueuedCompletionStatus
InitializeCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
SetUnhandledExceptionFilter
LoadLibraryA
GetProcAddress
CreateDirectoryA
GetLastError
RemoveDirectoryA
FindNextFileA
FindClose
lstrcpynA
LocalAlloc
LocalFree
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetClassNameA
KillTimer
SetTimer
FillRect
GetSysColorBrush
InsertMenuA
GetMenuStringA
DestroyIcon
CopyAcceleratorTableA
GetNextDlgGroupItem
InvertRect
GrayStringA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
IsRectEmpty
SetParent
BringWindowToTop
UnpackDDElParam
ReuseDDElParam
SetMenu
TranslateAcceleratorA
TranslateMessage
GetMessageA
LoadIconA
SendMessageA
EnableWindow
RegisterWindowMessageA
SetRect
PostMessageA
FindWindowA
wsprintfA
MessageBoxA
GetWindow
GetClientRect
SetCapture
LoadCursorA
SetCursor
ScreenToClient
UpdateWindow
WindowFromPoint
ClientToScreen
ReleaseCapture
GetParent
IsWindowVisible
SetWindowPos
GetDlgCtrlID
GetFocus
GetCursorPos
EnableMenuItem
GetMenuItemCount
DeleteMenu
GetSubMenu
CharNextA
LoadMenuA
OffsetRect
UnregisterClassA
GetDCEx
LockWindowUpdate
LoadAcceleratorsA
MapDialogRect
SetWindowContextHelpId
ShowOwnedPopups
PostQuitMessage
DispatchMessageA
LoadStringA
PtInRect
InvalidateRect
IsZoomed
SetRectEmpty
ValidateRect
CharUpperA
wvsprintfA
GetMenuCheckMarkDimensions
ModifyMenuA
SetMenuItemBitmaps
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
CheckDlgButton
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
SetFocus
AdjustWindowRectEx
DrawMenuBar
TranslateMDISysAccel
DefFrameProcA
ExcludeUpdateRgn
DefDlgProcA
GetClipboardFormatNameA
GetTabbedTextExtentA
SendMessageTimeoutA
IsWindowUnicode
GetWindowLongW
SetWindowLongW
UnionRect
DrawEdge
GetDoubleClickTime
SetCursorPos
GetWindowRgn
HideCaret
ShowCaret
IsMenu
GetMenuDefaultItem
GetMenuItemInfoA
SetWindowRgn
GetCursor
GetMenuStringW
LookupIconIdFromDirectoryEx
CopyIcon
CreateIconIndirect
CreateIconFromResourceEx
IsClipboardFormatAvailable
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemID
RegisterClipboardFormatA
PostThreadMessageA
DestroyMenu
GetKeyboardLayoutList
GetKeyboardState
ToAsciiEx
GetKeyboardLayout
MapVirtualKeyExA
GetKeyNameTextA
TrackPopupMenu
GetWindowTextLengthA
GetWindowTextA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SetWindowLongA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetKeyState
GetClipboardData
DrawTextA
GetMenuState
ShowScrollBar
DrawIconEx
IntersectRect
GetWindowRect
CheckMenuRadioItem
GetIconInfo
SetClassLongA
DestroyCursor
LoadBitmapA
RedrawWindow
GetDC
ReleaseDC
GetSysColor
GetDesktopWindow
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
LoadImageA
GetSystemMenu
AppendMenuA
CheckMenuItem
MessageBeep
InflateRect
GetSystemMetrics
DrawStateA
DrawFocusRect
SetMenuDefaultItem
EnumChildWindows
DrawAnimatedRects
CreatePopupMenu
MapVirtualKeyA
WaitMessage
DrawFrameControl
IsCharLowerA
MessageBoxA

gdi32

SetTextAlign
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
PtVisible
GetStockObject
RestoreDC
SaveDC
CreateFontA
GetCharWidthA
DeleteDC
CreateRectRgnIndirect
PatBlt
CreateBitmap
GetClipBox
SetBkMode
TextOutA
GetObjectA
SetBkColor
SetTextColor
ExtTextOutA
StretchDIBits
CreateDIBSection
SelectObject
DeleteObject
GetTextExtentPoint32A
CreateCompatibleDC
CreateCompatibleBitmap
GetPixel
SetPixelV
BitBlt
CreateSolidBrush
GetTextColor
GetBkColor
RectVisible
Escape
GetCurrentPositionEx
PolyBezierTo
GetClipRgn
CreateRectRgn
ExtSelectClipRgn
GetDeviceCaps
GetViewportExtEx
GetWindowExtEx
CreatePen
CreatePatternBrush
GetTextMetricsA
GetMapMode
SetRectRgn
CombineRgn
CreateFontIndirectA
DPtoLP
LPtoDP
CopyMetaFileA
Polygon
GetWindowOrgEx
SetPixel
GetCurrentObject
StretchBlt
GetTextAlign
GetDIBits
EnumFontFamiliesExA
CreateDIBitmap
GetTextExtentPointA
ExtFloodFill
ExtTextOutW
GetTextExtentPoint32W
BeginPath
CloseFigure
EndPath
StrokeAndFillPath
FillPath
StrokePath
Ellipse
GetViewportOrgEx
Polyline
PtInRegion
RoundRect
CreatePolygonRgn
GetRgnBox
ExtCreateRegion
GetBitmapBits

comdlg32

GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyA
RegDeleteValueA
RegQueryValueExA
RegCreateKeyExA
RegSetValueA
RegOpenKeyExA

shell32

ord71
DragFinish
SHGetMalloc
SHGetFileInfoA
SHGetPathFromIDListA
SHAppBarMessage
Shell_NotifyIconA
DragQueryFileA
SHGetSpecialFolderLocation
ShellExecuteA
ExtractIconA

comctl32

ImageList_LoadImageA
ImageList_Create
ImageList_Destroy
ord17
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_Remove
ImageList_Draw
ImageList_GetImageInfo
ImageList_Add
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetIcon
_TrackMouseEvent

oledlg

ord1
ord8

ole32

CoTaskMemFree
CoTaskMemAlloc
OleDuplicateData
CoDisconnectObject
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoUninitialize
CoInitialize
ReleaseStgMedium
CoGetClassObject
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
StgOpenStorageOnILockBytes
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard

olepro32

ord253

oleaut32

VariantChangeType
SysStringByteLen
VarDateFromStr
VarBstrFromDate
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
VariantTimeToSystemTime
SysStringLen
LoadTypeLi
SysAllocString
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
OleLoadPicturePath
VariantChangeTypeEx
SafeArrayGetElemsize

ws2_32

recv
socket
ioctlsocket
htons
connect
select
WSAStartup
gethostname
gethostbyname
WSACleanup
closesocket
send
inet_ntoa
WSACloseEvent
WSASend
WSARecv
accept
WSAGetLastError
setsockopt
WSAIoctl
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
inet_addr
listen
getpeername
WSASocketA
WSACreateEvent
bind
WSAEventSelect

pdh

PdhCollectQueryData
PdhAddCounterA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhOpenQueryA

avifil32

AVIFileExit
AVIStreamSetFormat
AVIFileCreateStreamA
AVIFileOpenA
AVIStreamWrite
AVIFileRelease
AVIFileInit
AVIStreamRelease

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICDecompress
DrawDibOpen
DrawDibClose
DrawDibDraw

skinh

SkinH_AttachRes
SkinH_SetAero

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

Sections

.text
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 976KB - Virtual size: 975KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5321c425ad998b4ed59b305edef99cc8

Headers

File Characteristics

Imports

shlwapi

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

ws2_32

pdh

avifil32

msvfw32

skinh

wininet

Sections

.text Size: - Virtual size: 1.4MB

.rdata Size: - Virtual size: 248KB

.data Size: - Virtual size: 114KB

.rsrc Size: 168KB - Virtual size: 361KB

.vmp0 Size: - Virtual size: 16KB

.vmp1 Size: 976KB - Virtual size: 975KB

.reloc Size: 4KB - Virtual size: 72B

.text
Size: - Virtual size: 1.4MB

.rdata
Size: - Virtual size: 248KB

.data
Size: - Virtual size: 114KB

.rsrc
Size: 168KB - Virtual size: 361KB

.vmp0
Size: - Virtual size: 16KB

.vmp1
Size: 976KB - Virtual size: 975KB

.reloc
Size: 4KB - Virtual size: 72B