68d6b5ca8543c7e6ef00306b924ec22d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

68d6b5ca8543c7e6ef00306b924ec22d_JaffaCakes118
Size

692KB
MD5

68d6b5ca8543c7e6ef00306b924ec22d
SHA1

0d9d813dcd6a47db38bb76473918f950e120311d
SHA256

8d86c6e0cff278a16e380702534e92306c6e905d20f5d5e2509acb565cbc2b10
SHA512

9926995bca45a7c0d89cd2696b38f36bf0bb2d948062953947f4a035fcd77e96a80b62374071f543a21ca5b0fcd0471502ab3254e8db85ed11fccad7c7237d25
SSDEEP

12288:lOlB3Le78olADO0PAD4LVCaR8eHSsJxBN5CvoH:lOJnDBq4gO8eHSsJxBSv

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68d6b5ca8543c7e6ef00306b924ec22d_JaffaCakes118

Files

68d6b5ca8543c7e6ef00306b924ec22d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c74ec1242c5a191987c2a2004b210f4f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

certutil.pdb

Imports

msvcrt

__wgetmainargs
memmove
wcscat
wcscpy
gmtime
_errno
vfwprintf
fwrite
ftell
fgetc
_wfopen
fgetws
free
malloc
wcschr
_fgetwchar
fflush
_iob
wcsspn
wcscmp
wcsstr
_snwprintf
wcscspn
_except_handler3
_wsetlocale
_setmode
iswdigit
_strnicmp
swscanf
_stricmp
_wtoi
??3@YAXPAX@Z
_wcsicmp
sprintf
isdigit
atol
strncmp
fclose
strcspn
fseek
fputs
strstr
strchr
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
wcslen
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_ultow
_purecall
??2@YAPAXI@Z
wcsncpy
_wcsnicmp
wcsrchr
swprintf
fprintf
_strlwr
qsort
_swab
fopen
fgets

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyExW
RegConnectRegistryW
LsaRetrievePrivateData
LsaStorePrivateData
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
CryptSignHashW
CryptSetProvParam
CryptDuplicateHash
CryptExportKey
LsaOpenPolicy
LsaFreeMemory
LsaClose
OpenThreadToken
LookupAccountNameW
RegOpenKeyW
RegEnumKeyExW
CryptVerifySignatureW
CryptGetDefaultProviderW
CryptGetKeyParam
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW
IsValidSecurityDescriptor
GetSecurityDescriptorLength
RegOpenKeyExW
RegCreateKeyW
GetSecurityDescriptorDacl
AddAce
InitializeAcl
GetAclInformation
GetAce
SetNamedSecurityInfoW
AddAccessAllowedAce
AddAccessDeniedAce
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RevertToSelf
ImpersonateSelf
CryptDestroyKey
CryptGetUserKey
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptEncrypt
CryptDuplicateKey
CryptDecrypt
CryptImportKey
CryptGenKey
CryptSetKeyParam
CopySid
GetLengthSid
GetTokenInformation
LookupAccountSidW
CryptEnumProvidersA
CryptGetProvParam
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegEnumValueW

kernel32

LeaveCriticalSection
GetVersionExW
GetComputerNameExW
SetConsoleCtrlHandler
CreateFileW
GetFileSize
SetFilePointer
ReadFile
QueryPerformanceCounter
EnterCriticalSection
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetComputerNameW
GetFileAttributesExW
GetEnvironmentVariableW
GetTempFileNameW
GetTickCount
OpenEventW
PulseEvent
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
LocalReAlloc
GetLastError
InitializeCriticalSection
DeleteCriticalSection
GetSystemDefaultLangID
FormatMessageW
DeleteFileW
lstrcmpiW
GetModuleHandleW
GetProcAddress
SetLastError
GetStdHandle
GetFileType
GetConsoleMode
SetConsoleMode
CreateThread
WaitForSingleObject
GetExitCodeThread
CloseHandle
GetSystemTime
SystemTimeToFileTime
lstrcmpW
CompareFileTime
LocalAlloc
GetSystemTimeAsFileTime
LocalFree
GetFileAttributesW
WriteFile
FreeLibrary
LoadLibraryW
FileTimeToSystemTime
LocalFileTimeToFileTime
GetTimeFormatW
GetDateFormatW
GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
CreateDirectoryW
FoldStringW
GetCurrentThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetSystemInfo
CompareStringW
FileTimeToLocalFileTime
GetEnvironmentVariableA
WideCharToMultiByte
GetACP
WriteConsoleW
MultiByteToWideChar
VirtualAlloc
VirtualFree
GetWindowsDirectoryA
lstrlenW
CreateEventW
ResetEvent
InterlockedIncrement
SetEvent
InterlockedDecrement
GetProfileStringA
LoadLibraryExW
GetCurrentProcess

certadm

ord22
ord20
ord12
ord8
ord7
ord9
ord11
ord5
ord10
ord17
ord6
ord13
ord18
ord14
ord21
ord15
ord16
ord19

certcli

ord211
ord242
CAAddCACertificateType
CARemoveCACertificateType
CAGetCAExpiration
CACountCertTypes
ord218
ord256
CAAccessCheck
CAFindByCertType
CAFindByName
CAGetCAProperty
ord208
CAEnumNextCA
CACloseCA
CAEnumCertTypesForCA
CAEnumCertTypes
CACertTypeAccessCheck
CAEnumNextCertType
CAGetCertTypeFlagsEx
CAGetCertTypePropertyEx
CAGetCertTypeKeySpec
CAGetCertTypeExpiration
CAGetCertTypeExtensions
CAFreeCertTypeExtensions
ord258
CAFindCertTypeByName
ord252
ord255
ord253
ord205
ord215
ord260
ord203
ord210
CAGetCACertificate
CACreateNewCA
CASetCAProperty
CASetCAFlags
CASetCACertificate
CASetCASecurity
CAUpdateCA
ord217
CAEnumFirstCA
CAFreeCAProperty
CACountCAs
CAGetCertTypeProperty
CAFreeCertTypeProperty
CACloseCertType
ord213
ord206
ord207
ord246
ord223
ord225
ord247
ord254

comctl32

InitCommonControlsEx

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

crypt32

CryptExportPublicKeyInfo
CertSetStoreProperty
CertComparePublicKeyInfo
CertEnumCTLsInStore
CertDeleteCertificateFromStore
CertGetNameStringW
CertFindExtension
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore
CryptMsgClose
CertGetCTLContextProperty
CertEnumCTLContextProperties
CertEnumCRLContextProperties
CertEnumCertificateContextProperties
CertControlStore
CertAddCTLContextToStore
CertDeleteCRLFromStore
CertDuplicateCRLContext
CryptImportPublicKeyInfo
CertAddCRLContextToStore
CertVerifyRevocation
CertVerifyTimeValidity
CertVerifyCRLTimeValidity
CertVerifySubjectCertificateContext
CryptVerifyCertificateSignatureEx
CryptSignAndEncodeCertificate
CryptEncryptMessage
CryptFindOIDInfo
CryptDecryptMessage
CertStrToNameW
CertNameToStrW
CertGetEnhancedKeyUsage
CertVerifyCertificateChainPolicy
CertGetIntendedKeyUsage
CertAddCertificateLinkToStore
PFXExportCertStore
PFXExportCertStoreEx
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignCertificate
CryptEncodeObjectEx
CryptDecodeObjectEx
CertSaveStore
CertCreateCertificateContext
CertOpenStore
CertSetCertificateContextProperty
CertFindCertificateInStore
CertFreeCRLContext
CertEnumCRLsInStore
CertCreateCRLContext
CryptDecodeObject
CertCompareCertificateName
CryptFormatObject
CertGetPublicKeyLength
CertEnumCertificatesInStore
CertAddEncodedCertificateToStore
CryptFindCertificateKeyProvInfo
CryptAcquireCertificatePrivateKey
CryptHashPublicKeyInfo
CertGetCRLContextProperty
CryptMsgGetParam
CryptMsgControl
CryptMsgGetAndVerifySigner
PFXIsPFXBlob
CertAddCertificateContextToStore
CryptVerifyCertificateSignature
CertDuplicateCertificateContext
CertFreeCTLContext
CertCreateCTLContext
CertFreeCertificateChain
CertGetCertificateChain
PFXImportCertStore

cryptnet

CryptRetrieveObjectByUrlW
CryptGetObjectUrl

cryptui

CryptUIDlgViewCertificateW
CryptUIDlgFreeCAContext
CryptUIDlgSelectCertificateW
CryptUIDlgViewCRLW

gdi32

GetStockObject

netapi32

NetApiBufferFree
NetUserGetGroups
DsGetDcNameW

ntdll

iswspace
_snprintf
isxdigit
__isascii
iswalpha
_wtol
iswxdigit
atoi
_alldiv
wcstoul
wcsncmp
sscanf
strspn
strpbrk
RtlTimeToSecondsSince1970
NtQuerySystemTime
_itoa

ntdsapi

DsBindW
DsFreeNameResultW
DsUnBindW
DsFreeDomainControllerInfoW
DsGetDomainControllerInfoW
DsCrackNamesW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
StringFromCLSID
CLSIDFromProgID
CoCreateInstanceEx
CoSetProxyBlanket
CoTaskMemAlloc

oleaut32

VariantClear
SysAllocStringLen
VariantInit
SysAllocString
VariantTimeToSystemTime
SystemTimeToVariantTime
SetErrorInfo
SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysStringLen
CreateErrorInfo

rpcrt4

UuidCreate

secur32

GetComputerObjectNameW
GetUserNameExW
TranslateNameW

setupapi

SetupGetStringFieldW
SetupGetIntField
SetupCloseInfFile
SetupOpenInfFileW
SetupFindFirstLineW
SetupGetLineCountW
SetupFindNextLine
SetupGetFieldCount

user32

PostQuitMessage
DispatchMessageW
wsprintfW
TranslateMessage
GetMessageW
PostMessageW
UpdateWindow
CreateWindowExW
RegisterClassW
LoadCursorW
LoadIconW
SendMessageW
MessageBoxW
GetWindowTextW
EnableWindow
GetDlgItem
SetDlgItemTextW
SetCursor
SetDlgItemInt
CheckDlgButton
SendDlgItemMessageA
EndDialog
GetDlgItemInt
GetDlgItemTextW
IsDlgButtonChecked
DialogBoxParamW
SetWindowTextW
CallWindowProcW
GetWindowLongW
ShowWindow
SetWindowLongW
SetFocus
LoadStringW
DefWindowProcW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

FindNextUrlCacheGroup
DeleteUrlCacheGroup
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
InternetQueryDataAvailable
InternetReadFile
FindFirstUrlCacheGroup
HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetCanonicalizeUrlW
InternetCreateUrlW
InternetCrackUrlW
GetUrlCacheEntryInfoW

wldap32

ord127
ord41
ord167
ord142
ord79
ord140
ord224
ord113
ord27
ord26
ord36
ord210
ord155
ord65
ord208
ord73
ord14
ord145
ord13
ord203
ord12
ord18
ord16
ord147

winscard

SCardGetCardTypeProviderNameW
SCardListCardsW
SCardEstablishContext
SCardReleaseContext
SCardFreeMemory
SCardGetStatusChangeW
SCardListReadersW

Sections

.text
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c74ec1242c5a191987c2a2004b210f4f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

certadm

certcli

comctl32

comdlg32

crypt32

cryptnet

cryptui

gdi32

netapi32

ntdll

ntdsapi

ole32

oleaut32

rpcrt4

secur32

setupapi

user32

version

wininet

wldap32

winscard

Sections

.text Size: 464KB - Virtual size: 464KB

.data Size: 20KB - Virtual size: 27KB

.rsrc Size: 97KB - Virtual size: 97KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 464KB - Virtual size: 464KB

.data
Size: 20KB - Virtual size: 27KB

.rsrc
Size: 97KB - Virtual size: 97KB

.UPX0
Size: 108KB - Virtual size: 260KB