947cff3f4156e63d23ce3460c60d5fb0_JaffaCakes118

General

Target

947cff3f4156e63d23ce3460c60d5fb0_JaffaCakes118
Size

121KB
MD5

947cff3f4156e63d23ce3460c60d5fb0
SHA1

d5021ef36379d7398de3945b395c4311516fe22e
SHA256

79ada65084059f50bb182560a289665585531638f0345038df845bfb68fe3b0b
SHA512

98fbb63b8672cf7314c920dd8319057534448acea91329630fd88c914be456598e69919ee489694a00424a5f4c1cf59893c4187f70d9e413fc928eed9b9377d8
SSDEEP

3072:BBX9kjwFlihpL3LPje6Per9qMCD6zJK2Uc1jXsZwe6z9skyTHeIu:BQjwu1LPjerx9JzVUcheNHY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
947cff3f4156e63d23ce3460c60d5fb0_JaffaCakes118

Files

947cff3f4156e63d23ce3460c60d5fb0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

19b86d63bc11e8abf7aea443397f391d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

chmdir.wcx

OpenArchive
PackFiles
SetProcessDataProc
its_getfile
CloseArchive
lng_fname
ini_fname
DeleteFiles

user32

GetDlgCtrlID
EnumChildWindows
CharToOemA
SetDlgItemTextA
MessageBoxA
DialogBoxParamA
GetDlgItemInt
SendDlgItemMessageA
GetDlgItem
SetWindowTextA
PostMessageA
EndDialog
EnableWindow
LoadIconA
SendMessageA
GetWindowTextA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

msvcrt

fread
__getmainargs
_initterm
sprintf
malloc
realloc
free
strrchr
time
__argv
__argc
fclose
__set_app_type
fopen
fseek
ftell
fwrite
remove
_beginthread
calloc
_exit
_XcptFilter
exit
_acmdln
__p__fmode
__setusermatherr
_adjust_fdiv
__p__commode
_except_handler3
_controlfp

kernel32

GetStartupInfoA
GetProcAddress
GetCurrentDirectoryA
GetTempPathA
LoadLibraryA
FormatMessageA
GetSystemTimeAsFileTime
GetPrivateProfileStringA
ExpandEnvironmentStringsA
GetFileAttributesA
GetLastError
GetModuleHandleA
GetFullPathNameA

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 104KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

19b86d63bc11e8abf7aea443397f391d

Headers

File Characteristics

Imports

chmdir.wcx

user32

advapi32

msvcrt

kernel32

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 2KB

.UPX0 Size: 104KB - Virtual size: 252KB

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 2KB

.UPX0
Size: 104KB - Virtual size: 252KB