addf65a9c174d3ebfc6b4262ccdcb756_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

addf65a9c174d3ebfc6b4262ccdcb756_JaffaCakes118
Size

413KB
MD5

addf65a9c174d3ebfc6b4262ccdcb756
SHA1

cf5e46b2c21a1021b98c9210cb2603981a71958b
SHA256

8ec0a6843ca8e65a46d5157e3e77e7dc969fd65022eb27579306df5d2b3cc2ab
SHA512

3acbe29aa4a30689e2323e746dbfcea1141364766288ccae1f16be424b88fad4ea06906ec39b0c444c9ed864bebd021cee4949f6d9230c5134f1e1a602a0ae92
SSDEEP

12288:bL7eW9QxIskx8Myo6Pc/FKUpD2EjcN/9qW1:buW9Rs3cMtgcZcK

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/显示器软开关.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/kinguard.dll
unpack001/显示器软开关.exe
unpack002/out.upx

Files

addf65a9c174d3ebfc6b4262ccdcb756_JaffaCakes118
.rar
kinguard.dll
.dll windows:4 windows x86 arch:x86

c9ad6a8d50872372c4ffb051321352ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord5302
ord2725
ord4079
ord5300
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord5199
ord3346
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord535
ord858
ord823
ord860
ord4129
ord1200
ord941
ord537
ord825
ord665
ord353
ord540
ord939
ord2818
ord2396
ord5731
ord1089
ord3922
ord4486
ord2512
ord2554
ord800
ord6375
ord4274
ord3825
ord3079
ord1187
ord1116
ord1176
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord6467
ord1578
ord826
ord269
ord600

msvcrt

strcat
memcpy
__CxxFrameHandler
_except_handler3
strlen
_mbsicmp
_CxxThrowException
memset
_EH_prolog
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_adjust_fdiv
malloc
_initterm

kernel32

SetFilePointer
IsDebuggerPresent
ReadFile
CloseHandle
CreateFileA
ExitProcess
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
LocalFree
LocalAlloc
GetLastError

user32

SetTimer

Exports

Exports

a1
a2
a3
a4
a5
a6
a7
a8
a9
z1
z2
z3
z4
z5
z6
z7
z8
z9

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
新云软件.url
.url
显示器软开关.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 584KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 559KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 560KB - Virtual size: 558KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9ad6a8d50872372c4ffb051321352ae

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 12KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 4KB - Virtual size: 1KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 584KB

UPX1 Size: 7KB - Virtual size: 8KB

.rsrc Size: 559KB - Virtual size: 560KB

Headers

File Characteristics

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 560KB - Virtual size: 558KB

.text
Size: 16KB - Virtual size: 12KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 4KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 584KB

UPX1
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 559KB - Virtual size: 560KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 560KB - Virtual size: 558KB