96f4d56b164be23eba0b9d99f2de2c45_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

96f4d56b164be23eba0b9d99f2de2c45_JaffaCakes118
Size

317KB
MD5

96f4d56b164be23eba0b9d99f2de2c45
SHA1

afd57724ad25537ebbab5765fad01650952cf3c2
SHA256

07fdacf249a4ab6f40f84d1f64255fea26137d56e314a5b897d34392e5d8ef97
SHA512

69b561cf16526e399bb02eaf5a099da810f9972e7065fc5b46206cf8985bf21192caa91afe4d6622fc186570a7f7f47031a34cd8a2a142664322b431b9c30f79
SSDEEP

6144:dkbHTtIubE30ZhZxbpvqwowowowowowowowowowowowowowowowowowowowowowr:dkftIuhZj5pYV/Y2Akz3m4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96f4d56b164be23eba0b9d99f2de2c45_JaffaCakes118

Files

96f4d56b164be23eba0b9d99f2de2c45_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4a6aa184f74d3c1d08c3452152cc0d08

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\pulse\recipes\283718449\base\branches\ci_release_branch\googleclient\ci\build\ship\obj\service\GoogleUpdaterService_not_signed_exe.pdb

Imports

kernel32

GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
SystemTimeToTzSpecificLocalTime
lstrcmpW
DuplicateHandle
GetProcAddress
GetCurrentThread
MultiByteToWideChar
GetTempPathW
WaitForSingleObject
SetLastError
OpenProcess
InitializeCriticalSection
lstrcpynW
CloseHandle
lstrlenW
CreateThread
lstrcmpiW
FindResourceExW
CreateEventW
LoadResource
FindResourceW
LoadLibraryExW
LockResource
InterlockedIncrement
SizeofResource
SetEvent
GetLastError
InterlockedDecrement
GetCurrentThreadId
GetModuleHandleW
DeleteCriticalSection
VirtualFree
HeapCreate
RtlUnwind
GetModuleHandleA
VirtualAlloc
LoadLibraryA
GetStartupInfoW
SetUnhandledExceptionFilter
RaiseException
GetModuleFileNameW
FreeLibrary
GetCommandLineW
GetCurrentProcessId
Sleep
GetTempFileNameW
UnhandledExceptionFilter
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
QueryPerformanceFrequency
QueryPerformanceCounter
ResetEvent
CreateFileW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
CopyFileW
MoveFileExW
GetTickCount
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetFileSize
GetSystemTimeAsFileTime
FindClose
FileTimeToSystemTime
CreateProcessW
GetCurrentProcess
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
InterlockedCompareExchange
CreateMutexW
RemoveDirectoryW
GetExitCodeProcess
FileTimeToLocalFileTime
GetVersionExW
WideCharToMultiByte
GetThreadLocale
GetDateFormatW
GetTimeFormatW
IsDebuggerPresent
ExitProcess
TerminateProcess

user32

UnregisterClassA
CharLowerW
CharNextW
LoadStringW
DispatchMessageW
TranslateMessage
GetMessageW
PostThreadMessageW
KillTimer
wvsprintfW
SetTimer

ole32

CoRevertToSelf
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoUninitialize
CoRegisterClassObject
CoInitializeSecurity
CoInitialize
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoImpersonateClient

oleaut32

SysFreeString
RegisterTypeLi
SysStringLen
VarUI4FromStr
SysAllocString
LoadTypeLi
UnRegisterTypeLi

advapi32

GetSecurityDescriptorControl
GetSecurityDescriptorLength
GetSidSubAuthority
RegCloseKey
RegDeleteKeyW
MakeSelfRelativeSD
InitializeSid
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
OpenThreadToken
ControlService
SetSecurityDescriptorDacl
StartServiceW
GetSecurityDescriptorDacl
QueryServiceStatus
SetSecurityDescriptorGroup
RegSetValueExW
GetSecurityDescriptorGroup
ChangeServiceConfigW
RegCreateKeyExW
SetSecurityDescriptorOwner
OpenServiceW
GetSecurityDescriptorOwner
DeleteService
OpenSCManagerW
ChangeServiceConfig2W
CreateServiceW
IsValidSid
RegQueryInfoKeyW
SetServiceStatus
GetLengthSid
DeregisterEventSource
ReportEventW
RegisterEventSourceW
RegisterServiceCtrlHandlerW
RegEnumKeyExW
GetAclInformation
AddAce
StartServiceCtrlDispatcherW
InitializeAcl
InitializeSecurityDescriptor
MakeAbsoluteSD
SetSecurityDescriptorControl
RegOpenKeyExW
CopySid
CloseServiceHandle
GetSidLengthRequired
GetSecurityDescriptorSacl
RegQueryValueExW
RegDeleteValueW

shlwapi

StrRetToStrW
SHQueryValueExW
PathStripPathW

crypt32

CryptQueryObject
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertNameToStrW

shell32

SHGetDesktopFolder
SHCreateDirectoryExW
SHGetFolderLocation
SHFileOperationW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4a6aa184f74d3c1d08c3452152cc0d08

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

crypt32

shell32

version

wintrust

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 17KB - Virtual size: 17KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 17KB - Virtual size: 17KB

UPX0
Size: 144KB - Virtual size: 380KB