b96c10b1626cbbdfe1702b33e77a80a9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b96c10b1626cbbdfe1702b33e77a80a9_JaffaCakes118
Size

505KB
MD5

b96c10b1626cbbdfe1702b33e77a80a9
SHA1

f0fb07a2f84d050a20336435f9859e587d1b1e26
SHA256

04388c52d678fc04f04697537afe937f1f3f0ec8ea2b51578f7facce197d4e4d
SHA512

2e5bea5bc4f6b3084d775d00fb6a4b897857daff8bad973b294ca7d6957071aca9392d616c88e9770c162cda04669caee6f5aa60804c83bd32f987383e550b81
SSDEEP

6144:gZOvu7fvRjk2YuXT6gp/wZBO68Yxvoqsw4D+uhj5FXznxJ59i4Tc:rW7fqMDb6Helj/Xzn75LTc

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b96c10b1626cbbdfe1702b33e77a80a9_JaffaCakes118

Files

b96c10b1626cbbdfe1702b33e77a80a9_JaffaCakes118
.exe windows:6 windows x86 arch:x86

a5f5bdadeaad0c64d8ccd8aca7876c51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dpapimig.pdb

Imports

advapi32

ConvertStringSidToSidW
RegCloseKey
RegDeleteTreeW
RegOpenKeyExW
ConvertSidToStringSidW
IsValidSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetSidSubAuthority
GetSidIdentifierAuthority
GetSidSubAuthorityCount
RegEnumValueW
RegEnumKeyExW
TraceEvent
RegQueryValueExW

kernel32

GetProcessHeap
HeapCreate
FreeLibraryAndExitThread
CreateThread
GetModuleHandleExW
IsProcessorFeaturePresent
CompareStringW
GetThreadLocale
OutputDebugStringA
GetSystemDirectoryW
GlobalFree
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
FindResourceW
GetModuleFileNameA
VirtualQueryEx
InitializeCriticalSectionAndSpinCount
SetProcessWorkingSetSize
GetLocaleInfoW
GetUserDefaultUILanguage
GetThreadUILanguage
DebugBreak
TlsAlloc
TlsFree
HeapDestroy
InterlockedDecrement
TlsSetValue
InterlockedIncrement
GetVersion
LoadLibraryExW
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryW
FreeLibrary
FindAtomW
MultiByteToWideChar
GetAtomNameW
GetModuleHandleW
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
lstrlenW
MulDiv
HeapReAlloc
DeleteAtom
AddAtomW
FindResourceExW
LoadResource
LockResource
SizeofResource
TlsGetValue
HeapFree
HeapAlloc
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
GetCurrentThread
InterlockedExchange
GetCurrentProcess
CloseHandle
GetCommandLineW
LocalFree
GetLastError
LocalAlloc
CompareStringOrdinal

user32

IsRectEmpty
IntersectRect
NotifyWinEvent
ScreenToClient
DrawFrameControl
InflateRect
FillRect
DrawTextW
GetKeyNameTextW
MapVirtualKeyW
DrawFocusRect
DrawIconEx
CopyRect
SetRectEmpty
ShowWindow
SetFocus
IsChild
GetFocus
GetKeyState
GetClientRect
GetWindowLongW
DefWindowProcW
RegisterClassExW
LoadCursorW
GetClassInfoExW
DestroyWindow
SetParent
CreateWindowExW
RedrawWindow
SetWindowTextW
UpdateWindow
SetWindowRgn
GetWindowRgnBox
MapWindowPoints
GetWindowRect
GetParent
CharUpperA
CharUpperW
SetTimer
ClientToScreen
AdjustWindowRectEx
EnumChildWindows
KillTimer
SetCursor
GetMessagePos
InvalidateRect
IsCharAlphaNumericW
SetScrollInfo
ReleaseDC
DestroyIcon
PostMessageW
LoadStringW
MessageBoxW
RegisterWindowMessageW
GetSystemMetrics
GetWindowTextLengthW
GetWindowTextW
EnableWindow
SetPropW
CallWindowProcW
GetPropW
SetWindowLongW
RemovePropW
IsWindow
SendMessageW
GetDC
GetSysColor
GetSysColorBrush
EqualRect
LoadImageW
GetIconInfo
SetRect
SetWindowPos
CreateIconIndirect
SystemParametersInfoW

msvcrt

_purecall
memcpy
_ftol2
_vsnprintf
_wcsnicmp
realloc
iswalpha
_isnan
_ftol2_sse
iswalnum
_vsnwprintf
_wcsdup
wcschr
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memset
??2@YAPAXI@Z
wcsncmp
??3@YAXPAX@Z
free
qsort
memmove
_wcsicmp
wcstol

crypt32

CryptUpdateProtectedState

ole32

CoDisconnectObject
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CLSIDFromString
CoUninitialize
CoInitialize

comctl32

ord345
PropertySheetW

shell32

CommandLineToArgvW

netapi32

NetApiBufferFree
NetUserModalsGet

gdi32

RectVisible
GdiGetCharDimensions
LPtoDP
StretchDIBits
CreateDIBPatternBrushPt
GetBkColor
SetLayout
CreateFontIndirectW
CreateRectRgn
OffsetRgn
GetRgnBox
GetRegionData
ExtCreateRegion
CombineRgn
GetBkMode
OffsetWindowOrgEx
SetWindowOrgEx
CreateSolidBrush
CreatePatternBrush
GetTextExtentPoint32W
PlayEnhMetaFile
BitBlt
ExtTextOutW
GetTextColor
GetLayout
GetTextAlign
SetTextAlign
GetStockObject
SetTextColor
SetBkColor
SetBkMode
GdiTransparentBlt
GdiGradientFill
GdiAlphaBlend
PatBlt
GetTextMetricsW
GetDIBits
CreateHalftonePalette
SelectPalette
RealizePalette
GetBrushOrgEx
SetStretchBltMode
SetBrushOrgEx
GetDeviceCaps
DeleteEnhMetaFile
CreateDIBSection
CreateCompatibleBitmap
StretchBlt
GetObjectW
CreateCompatibleDC
SelectObject
GetPixel
DeleteDC
DeleteObject

oleacc

AccessibleObjectFromWindow
ObjectFromLresult
CreateStdAccessibleObject
GetRoleTextW
LresultFromObject

oleaut32

SafeArrayUnaccessData
SysAllocString
VariantInit
SysFreeString
SysStringLen
SysAllocStringLen
VariantClear
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetVartype
SafeArrayGetDim
SafeArrayCreateVector

shlwapi

PathAppendW
PathCreateFromUrlW

uxtheme

GetThemeAppProperties
GetThemeMargins
GetThemeFont
GetThemeColor
GetThemeMetric
GetThemePartSize
ord47
DrawThemeTextEx
BeginBufferedPaint
GetBufferedPaintBits
BufferedPaintClear
EndBufferedPaint
BufferedPaintUnInit
CloseThemeData
OpenThemeData
BufferedPaintInit
IsAppThemed

duser

FindStdColor
UtilDrawBlendRect
MapGadgetPoints
FindGadgetFromPoint
GetGadgetTicket
SetGadgetBufferInfo
DetachWndProc
DUserFlushDeferredMessages
InitGadgets
GetStdColorI
GetStdColorBrushI
CreateGadget
SetGadgetFocusEx
BuildInterpolation
BuildAnimation
ForwardGadgetMessage
DeleteHandle
GetGadgetAnimation
GetGadgetFocus
SetGadgetFocus
GetGadgetRect
DUserPostEvent
DUserSendEvent
SetGadgetStyle
SetGadgetMessageFilter
SetGadgetParent
SetGadgetRect
InvalidateGadget
AttachWndProcW
CreateAction
LookupGadgetTicket
GetGadgetSize
GetGadgetRgn
SetGadgetRootInfo
DUserFlushMessages

Sections

.text
Size: 315KB - Virtual size: 314KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 48KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a5f5bdadeaad0c64d8ccd8aca7876c51

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

crypt32

ole32

comctl32

shell32

netapi32

gdi32

oleacc

oleaut32

shlwapi

uxtheme

duser

Sections

.text Size: 315KB - Virtual size: 314KB

.data Size: 48KB - Virtual size: 50KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 26KB - Virtual size: 26KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 315KB - Virtual size: 314KB

.data
Size: 48KB - Virtual size: 50KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 26KB - Virtual size: 26KB

.UPX0
Size: 108KB - Virtual size: 260KB