b2c634c2c450725736052f8732dabc82_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b2c634c2c450725736052f8732dabc82_JaffaCakes118
Size

561KB
MD5

b2c634c2c450725736052f8732dabc82
SHA1

39ab8224e69c6f43ba524607ac7da14f480b6da5
SHA256

16186cb13a994d36971ccd2a6cd88febeb3ac0fa158b0ae2ee269f2c6abef74a
SHA512

788d1da68b80d90354e5df44a7276a58a69cee7a49a935a7b36e212593aaaa0f9efddf09a9a127598f2f526aa36cafe9f308d0aef7ebd2b03e216fbd90295597
SSDEEP

12288:ld+AczqzYCn/LH5xL5fG/l9OwzROlu4UaWtGhQAtUT/e0iP9jnfLJ:ruC/75xlfG99ptOlu02B/Vi91

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/bwmeter.v3.2.2-patch.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack003/BMSetup.exe
unpack002/bwmeter.v3.2.2-patch.exe
unpack004/out.upx

Files

b2c634c2c450725736052f8732dabc82_JaffaCakes118
.zip
chic.nfo
cncvivp.rar
.rar
BMSetup.zip
.zip
BMSetup.exe
.exe windows:4 windows x86 arch:x86

ae24815c51ae1a08374243fd38133ba9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\DeskSoft\Internal\Components\Setup\Release\Setup.pdb

Imports

shlwapi

PathIsRelativeA
PathIsNetworkPathA
SHDeleteKeyA

kernel32

EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
CreateDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetCurrentProcess
GetDiskFreeSpaceA
GetProcAddress
GetModuleHandleA
OpenProcess
ResumeThread
SetPriorityClass
GetCurrentThread
SetThreadPriority
lstrlenA
GetTempPathA
MultiByteToWideChar
GetVersionExA
GetModuleFileNameA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RaiseException
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
SetFilePointer
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSection
LoadLibraryA
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
HeapSize
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CopyFileA
ReadFile
CreateFileA
GetFileSize
CreateFileMappingA
MapViewOfFile
WriteFile
UnmapViewOfFile
CreateProcessA
GetExitCodeProcess
TerminateProcess
CloseHandle
RemoveDirectoryA
FindFirstFileA
DeleteFileA
Sleep
FindNextFileA
FindClose
GetFileAttributesA
FindResourceA
LoadResource
LockResource
SizeofResource
FlushFileBuffers
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetProcessHeap
GetSystemTimeAsFileTime
RtlUnwind
GetLastError
HeapFree
HeapAlloc
ExitThread
CreateThread
ExitProcess
GetCommandLineA

user32

DialogBoxParamA
SystemParametersInfoA
EnumWindows
GetWindowThreadProcessId
GetClassNameA
ExitWindowsEx
PostMessageA
LoadIconA
SetClassLongA
CreateDialogParamA
EnableWindow
SetDlgItemTextA
ShowWindow
EndDialog
SendDlgItemMessageA
LoadStringA
SetForegroundWindow
MessageBoxA
EnumChildWindows
SetWindowTextA
PeekMessageA
DispatchMessageA
TranslateMessage
SendMessageA
GetDlgItemTextA
GetDC
ReleaseDC
MoveWindow
CreateIconFromResource
GetFocus
DrawFocusRect
InvalidateRect
SetFocus
GetDlgItem
GetClientRect
MapWindowPoints
CreateWindowExA
SetWindowLongA
GetWindowTextA
RegisterClassA
GetWindowLongA
BeginPaint
FillRect
DrawTextA
DrawIconEx
EndPaint
DefWindowProcA
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DestroyWindow

gdi32

DeleteObject
CreateFontA
CreateFontIndirectA
SetBkMode
SetTextColor
GetStockObject
SelectObject

advapi32

GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegEnumValueA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

SHGetMalloc
SHChangeNotify
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHGetSpecialFolderLocation

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Readme.txt
bwmeter.v3.2.2-patch.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 156KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
file_id.diz

Sharing

General

Malware Config

Signatures

Files

ae24815c51ae1a08374243fd38133ba9

Headers

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 92KB - Virtual size: 90KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 64KB - Virtual size: 60KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 156KB

UPX1 Size: 51KB - Virtual size: 52KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 177KB - Virtual size: 177KB

.text
Size: 92KB - Virtual size: 90KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 64KB - Virtual size: 60KB

UPX0
Size: - Virtual size: 156KB

UPX1
Size: 51KB - Virtual size: 52KB

.rsrc
Size: 4KB - Virtual size: 8KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 177KB - Virtual size: 177KB