645a61f0c65e65ac472f2cf475790582_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

645a61f0c65e65ac472f2cf475790582_JaffaCakes118
Size

588KB
MD5

645a61f0c65e65ac472f2cf475790582
SHA1

445aee27a7e1b3e849f5a445234fdcc694f083fe
SHA256

d7a84f0e3954ebc180e53355d888dc502160b0fca68e6d5aad76745f29bd2bb6
SHA512

c3fb99626e049fe2a11bad8b3ee506e1c64b05e5a9f43c6dea7f6fd5b30a20fcae0904332af1cef592cb7869b30753a8a9a2c1f8243783eeff3f002d7037b521
SSDEEP

12288:qfBxzhY/mCzsAEcwxPQTHn2Smc2+eUYJnP:qJthPAE14TH2Xc2+G

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
645a61f0c65e65ac472f2cf475790582_JaffaCakes118

Files

645a61f0c65e65ac472f2cf475790582_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4690e00e11a15c0c752b29669d3b5042

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\work\Patcher\Taiwan\T3Patcher\Release\T3Patcher.pdb

Imports

kernel32

GetDiskFreeSpaceA
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapReAlloc
TerminateProcess
HeapSize
SetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
SetErrorMode
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GetFileTime
GetFileAttributesA
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
MoveFileA
lstrcmpA
RaiseException
FindFirstFileA
FindNextFileA
FindClose
LeaveCriticalSection
EnterCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedIncrement
InterlockedDecrement
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
SetVolumeLabelA
lstrcmpW
lstrcpynA
GetModuleHandleA
GetProcAddress
GetPrivateProfileStringA
lstrcpyA
InterlockedExchangeAdd
GetTickCount
Sleep
DeleteFileA
GetCurrentDirectoryA
CreateDirectoryA
SetCurrentDirectoryA
GetDiskFreeSpaceExA
OpenMutexA
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
ReadFile
CreateFileA
GetFileSize
LocalFree
CreateEventA
CreateThread
CloseHandle
SetEvent
WaitForSingleObject
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
SetUnhandledExceptionFilter
InterlockedExchange

user32

RegisterClipboardFormatA
MessageBeep
GetNextDlgGroupItem
ReleaseCapture
SetCapture
InvalidateRgn
CopyAcceleratorTableA
SetRect
IsRectEmpty
LoadCursorA
GetSysColorBrush
DestroyMenu
SetWindowContextHelpId
MapDialogRect
GetMessageA
TranslateMessage
ValidateRect
SetCursor
PostQuitMessage
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetDesktopWindow
CharNextA
GetCursorPos
WindowFromPoint
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
TabbedTextOutA
GetMenuState
LoadBitmapA
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
SetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
OemToCharBuffA
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
MessageBoxA
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
GetClassInfoA
RegisterClassA
UnregisterClassA
DrawTextA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
CopyRect
PtInRect
GetWindow
wsprintfA
IsWindow
GetSystemMetrics
LoadIconA
SetTimer
IsIconic
DrawIcon
PostThreadMessageA
PostMessageA
LoadImageA
SendMessageA
EnableWindow
InvalidateRect
GetClientRect
CharUpperA
CharToOemBuffA

gdi32

Escape
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetMapMode
GetRgnBox
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
CreateBitmap
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetObjectA
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
BitBlt
CreateCompatibleDC
SelectObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCloseKey

shell32

ShellExecuteA

comctl32

_TrackMouseEvent
ord17

shlwapi

PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathFindFileNameA

oledlg

ord8

ole32

CoTaskMemAlloc
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoTaskMemFree
CLSIDFromProgID
CoRegisterMessageFilter

oleaut32

SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
OleCreateFontIndirect
SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear

wininet

FtpFindFirstFileA
FtpOpenFileA
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
InternetFindNextFileA
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
InternetQueryDataAvailable
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
HttpQueryInfoA
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetConnectA
InternetAttemptConnect

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4690e00e11a15c0c752b29669d3b5042

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

Sections

.text Size: 256KB - Virtual size: 252KB

.rdata Size: 72KB - Virtual size: 70KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 184KB - Virtual size: 183KB

.UPX Size: 60KB - Virtual size: 60KB

.text
Size: 256KB - Virtual size: 252KB

.rdata
Size: 72KB - Virtual size: 70KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 184KB - Virtual size: 183KB

.UPX
Size: 60KB - Virtual size: 60KB