83bb1758d31808d73726ebf53df47775_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

83bb1758d31808d73726ebf53df47775_JaffaCakes118
Size

2.6MB
MD5

83bb1758d31808d73726ebf53df47775
SHA1

d66f93a24f821f0132cd48cb17b1088fa1c4c9b4
SHA256

ee609c842cd6e8c26bb96e8528b620c77b8668c15b93671a940f0c80b037b588
SHA512

59b96ceac3acff6107ff699d327a0a1a5a00d82118fddb42d329e2d8d12ad4bd3f1267507f38bcff1310db7dcfaaca2c4fd270f8919b7056da08c56bd8ed3850
SSDEEP

49152:m/x3r0/guNwRu7bbLScRtirike6yTLKu75y:Uxb0/guNwRuHirike6a

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83bb1758d31808d73726ebf53df47775_JaffaCakes118

Files

83bb1758d31808d73726ebf53df47775_JaffaCakes118
.exe windows:4 windows x86 arch:x86

70965b114cc3b279ea118a2043f12fda

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
VirtualAllocEx
OpenProcess
GetCurrentProcessId
CreateRemoteThread
LoadLibraryA
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
HeapFree
HeapAlloc
GetProcessHeap
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetPrivateProfileStringA
CreateDirectoryA
GetModuleHandleA
WriteFile
GetComputerNameA
CreateFileA
Sleep
WaitNamedPipeA
GlobalFree
GlobalAlloc
ReadFile
FormatMessageA
GetWindowsDirectoryA
WinExec
lstrcatA
WaitForMultipleObjects
GetSystemTime
GlobalUnlock
GlobalLock
GlobalMemoryStatus
CopyFileA
GetCurrentThreadId
QueryPerformanceCounter
FlushConsoleInputBuffer
GetStdHandle
FindClose
FindNextFileA
FindFirstFileA
lstrcmpA
LoadResource
FindResourceA
LockResource
lstrcmpiA
GlobalDeleteAtom
SetThreadPriority
SuspendThread
InterlockedIncrement
InterlockedDecrement
GlobalAddAtomA
GetPrivateProfileIntA
WritePrivateProfileStringA
GlobalFindAtomA
GlobalGetAtomNameA
DuplicateHandle
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
MoveFileA
GetVolumeInformationA
lstrcpynA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
GetFileAttributesA
GetTempFileNameA
SetFileTime
GetFileTime
GetDiskFreeSpaceA
MulDiv
lstrlenW
FileTimeToLocalFileTime
LocalUnlock
LocalLock
GlobalReAlloc
GlobalSize
TlsAlloc
GlobalHandle
TlsFree
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
SizeofResource
GetCurrentDirectoryA
GetProcessVersion
GetCPInfo
GetOEMCP
GetFileSize
LocalFileTimeToFileTime
SystemTimeToFileTime
SetErrorMode
FindResourceExA
HeapReAlloc
RtlUnwind
GetTimeZoneInformation
GetLocalTime
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
TerminateProcess
SetConsoleCtrlHandler
RaiseException
CreateThread
ExitThread
SetStdHandle
GetFileType
GetACP
HeapSize
LCMapStringA
LCMapStringW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetDriveTypeA
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetExitCodeThread
VirtualFreeEx
FreeLibrary
GetVersionExA
GetTickCount
lstrcpyA
SetLastError
lstrlenA
SetEvent
ResumeThread
GetCurrentThread
GetCurrentProcess
LocalAlloc
LocalFree
CreateEventA
WaitForSingleObject
CloseHandle
GetVersion
CreateMutexA
GetLastError
GetModuleFileNameA
InterlockedExchange
GetProfileStringA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetProcAddress

advapi32

AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
CreateServiceA
LookupAccountSidA
RegSetValueA
RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
EnumServicesStatusA
QueryServiceConfigA
DeleteService
EnumDependentServicesA
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
DuplicateToken
OpenProcessToken
OpenThreadToken
LookupAccountNameA
GetSidSubAuthority
FreeSid
QueryServiceStatus
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueA
RegEnumValueA
RegEnumKeyA
IsTextUnicode
GetUserNameA
SetThreadToken
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount

comctl32

ImageList_LoadImageA
ImageList_Create
ImageList_Destroy
PropertySheetA
CreatePropertySheetPageA
DestroyPropertySheetPage
ImageList_Draw
ImageList_AddMasked
ImageList_SetBkColor
ImageList_GetIcon

comdlg32

CommDlgExtendedError
FindTextA
ReplaceTextA
PrintDlgA
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA

gdi32

CreateRectRgn
GetViewportExtEx
GetWindowExtEx
CreatePatternBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetTextMetricsA
GetCharWidthA
LPtoDP
StretchDIBits
CreateFontA
SetRectRgn
CombineRgn
GetNearestColor
GetTextColor
GetStretchBltMode
GetPolyFillMode
GetTextAlign
GetBkMode
GetROP2
GetTextFaceA
GetWindowOrgEx
EnumFontFamiliesExA
PatBlt
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GetTextExtentPoint32A
GetStockObject
GetObjectA
GetTextExtentPointA
CreateDIBitmap
GetCurrentPositionEx
SetTextAlign
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateRectRgnIndirect
SetAbortProc
GetBkColor
CreateSolidBrush
CreateCompatibleBitmap
CreatePen
GetDeviceCaps
DeleteDC
CreateDCA
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
Rectangle
DPtoLP
GetViewportOrgEx
AbortDoc
EndDoc
EndPage
StartPage
StartDocA
CreateFontIndirectA

iphlpapi

GetUdpTable
GetTcpTable
SetIpNetEntry
DeleteIpForwardEntry
CreateIpForwardEntry
GetBestRoute
SendARP
GetIpForwardTable
GetIpAddrTable

mpr

WNetConnectionDialog1A
WNetGetUserA
WNetCloseEnum
WNetEnumResourceA
WNetOpenEnumA
WNetAddConnection2A
WNetCancelConnection2A

netapi32

NetLocalGroupEnum
NetGroupEnum
NetShareEnum
NetUserEnum
NetUserGetInfo
NetServerEnum
NetApiBufferFree
NetUseEnum

odbc32

ole32

CoTaskMemFree

oleaut32

packet

PacketSetReadTimeout
PacketGetNetType
PacketGetStats
PacketGetVersion
PacketGetAdapterNames
PacketSendPacket
PacketAllocatePacket
PacketInitPacket
PacketReceivePacket
PacketFreePacket
PacketCloseAdapter
PacketOpenAdapter
PacketSetHwFilter
PacketSetBuff
PacketSetBpf
PacketRequest

rasapi32

RasEnumEntriesA
RasGetEntryPropertiesA

rpcrt4

RpcStringFreeA
UuidToStringA

shell32

SHGetFileInfoA
DragFinish
DragQueryFileA
ExtractIconA
ShellExecuteA
Shell_NotifyIconA

user32

GetMenuItemCount
RegisterClassA
GetClassInfoA
WinHelpA
IsChild
GetTopWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetScrollInfo
GetScrollInfo
ScrollWindow
DeferWindowPos
AdjustWindowRectEx
MapWindowPoints
wvsprintfA
CharUpperA
LoadAcceleratorsA
TranslateAcceleratorA
DestroyMenu
SetMenu
ReuseDDElParam
UnpackDDElParam
BringWindowToTop
MapDialogRect
ClientToScreen
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetTabbedTextExtentA
IsClipboardFormatAvailable
FindWindowA
IsZoomed
AppendMenuA
DeleteMenu
LoadStringA
SetCursorPos
DrawMenuBar
DefMDIChildProcA
ShowWindow
GetSysColorBrush
InvertRect
GetDCEx
LockWindowUpdate
ReleaseDC
InflateRect
GetSysColor
SetCursor
PtInRect
ReleaseCapture
InvalidateRect
SetCapture
GetClientRect
EnableMenuItem
IsWindow
SetWindowLongA
GetCursorPos
LoadMenuA
GetSubMenu
KillTimer
SetTimer
OemToCharA
EnumWindows
GetWindowLongA
EnumChildWindows
GetWindowThreadProcessId
SendMessageA
EnableWindow
wsprintfA
MessageBoxA
DestroyCursor
UpdateWindow
RegisterHotKey
CharToOemA
DefWindowProcA
CreateWindowExA
GetClassLongA
SetWindowPos
MoveWindow
GetDlgCtrlID
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
IsDialogMessageA
SetPropA
UnhookWindowsHookEx
GetPropA
SetDlgItemTextA
SendDlgItemMessageA
GetMenuCheckMarkDimensions
GetMenuState
SetMenuItemBitmaps
CheckMenuItem
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyState
CallNextHookEx
ValidateRect
SetWindowsHookExA
GetLastActivePopup
ShowOwnedPopups
PostMessageA
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
DrawEdge
FrameRect
CopyRect
SetMenuDefaultItem
TrackPopupMenu
GetMenuItemID
IsRectEmpty
BeginDeferWindowPos
EndDeferWindowPos
SetRectEmpty
GetCapture
EqualRect
SetParent
WindowFromPoint
CreateCursor
GetAsyncKeyState
DrawIconEx
DestroyIcon
GetWindow
GetUpdateRect
ScreenToClient
IntersectRect
FillRect
LoadBitmapA
GetFocus
PeekMessageA
PostQuitMessage
SetForegroundWindow
RedrawWindow
IsWindowVisible
GetSystemMetrics
SystemParametersInfoA
GetSystemMenu
GetMessagePos
GetWindowDC
OffsetRect
LoadImageA
SetRect
LoadIconA
GetMenu
ModifyMenuA
GetDesktopWindow
MessageBeep
IsWindowUnicode
CharNextA
DefDlgProcA
DrawFocusRect
ExcludeUpdateRgn
ShowCaret
HideCaret
UnregisterClassA
CallWindowProcA
RemovePropA
GetMessageTime
GetForegroundWindow
RegisterWindowMessageA
IsIconic
GetWindowPlacement
SetFocus
LoadCursorA
CopyIcon
GetWindowRect
GetParent
GetClassNameA
GetDC

winmm

mmioSeek
mmioOpenA
mmioCreateChunk
mmioClose
mmioAscend
mmioWrite

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

wpcap

pcap_open_live
pcap_compile
pcap_close

ws2_32

WSASocketA
WSAIoctl

wsnmp32

Sections

UPX0
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

70965b114cc3b279ea118a2043f12fda

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

comdlg32

gdi32

iphlpapi

mpr

netapi32

odbc32

ole32

oleaut32

packet

rasapi32

rpcrt4

shell32

user32

winmm

winspool.drv

wpcap

ws2_32

wsnmp32

Sections

UPX0 Size: 2.6MB - Virtual size: 2.6MB

.rsrc Size: 11KB - Virtual size: 12KB

.avc Size: 13KB - Virtual size: 16KB

UPX0
Size: 2.6MB - Virtual size: 2.6MB

.rsrc
Size: 11KB - Virtual size: 12KB

.avc
Size: 13KB - Virtual size: 16KB