a7e51b068d90b742f9a107e3df956585_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a7e51b068d90b742f9a107e3df956585_JaffaCakes118
Size

81KB
MD5

a7e51b068d90b742f9a107e3df956585
SHA1

4144df7461c847a7ab9dae967c55838515d4660c
SHA256

55a2efe28053b65fcbf86df30ea1a4a865bf5f6b1c53dc0ca89f9ecace060ece
SHA512

0e90e612d593be22663e904df98bd0ced58322183936ee37ed3d84e610ac7599f4efe34dd4be0ba8b526f5d1f0d477804fb3fd8ac4a21adb7a4ec2b5bd355256
SSDEEP

1536:6zX7ZAgVzUQRDGAjodAXGBUJD6q0LuUdaerXP+zg2qk8EKLO/z/EZ:6DdAgV3BJodFqh0LuUEif+Dqk85y/zw

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/autofile100/hspext.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/autofile100/Autorun File Maker.exe	upx
static1/unpack001/autofile100/hspext.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/autofile100/Autorun File Maker.exe
unpack002/out.upx
unpack001/autofile100/hspext.dll
unpack003/out.upx

Files

a7e51b068d90b742f9a107e3df956585_JaffaCakes118
.lzh
autofile100/Autorun File Maker.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

_ll_callfunc@16

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
autofile100/README.TXT
autofile100/hspext.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

_aplact@16
_apledit@16
_aplfocus@16
_aplget@16
_aplkey@16
_aplkeyd@16
_aplkeyu@16
_aplobj@16
_aplsel@16
_aplstr@16
_clipget@16
_clipset@16
_clipsetg@16
_comclose@16
_comget@16
_comgetc@16
_comopen@16
_comput@16
_computc@16
_ematan@16
_emath@16
_emcnv@16
_emcos@16
_emint@16
_emsin@16
_emsqr@16
_emstr@16
_fxaget@16
_fxaset@16
_fxcopy@16
_fxdir@16
_fxinfo@16
_fxlink@16
_fxlong@16
_fxren@16
_fxshort@16
_fxtget@16
_fxtset@16
_getreg@16
_gfcopy@16
_gfdec@16
_gfinc@16
_gfini@16
_hsvcolor@16
_lzcopy@16
_lzdist@16
_pipeexec@16
_pipeget@16
_pipeput@16
_regdone@16
_regkey@16
_regkill@16
_reglist@16
_selfolder@16
_setreg@16
_sysexit@16
_sysinfo@16

Sections

UPX0
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 88KB

UPX1 Size: 46KB - Virtual size: 48KB

.rsrc Size: 1KB - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 78KB - Virtual size: 77KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 11KB - Virtual size: 34KB

.rsrc Size: 1024B - Virtual size: 944B

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 56KB

UPX1 Size: 27KB - Virtual size: 28KB

UPX2 Size: 2KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 37KB - Virtual size: 36KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 12KB - Virtual size: 19KB

.reloc Size: 4KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 88KB

UPX1
Size: 46KB - Virtual size: 48KB

.rsrc
Size: 1KB - Virtual size: 4KB

.text
Size: 78KB - Virtual size: 77KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 11KB - Virtual size: 34KB

.rsrc
Size: 1024B - Virtual size: 944B

UPX0
Size: - Virtual size: 56KB

UPX1
Size: 27KB - Virtual size: 28KB

UPX2
Size: 2KB - Virtual size: 4KB

.text
Size: 37KB - Virtual size: 36KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 12KB - Virtual size: 19KB

.reloc
Size: 4KB - Virtual size: 4KB