b70a0f9e7473255789c0bba55d712f78_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b70a0f9e7473255789c0bba55d712f78_JaffaCakes118
Size

158KB
MD5

b70a0f9e7473255789c0bba55d712f78
SHA1

dd9a88df2dcf6ef7c45636ee274ab33be8e19d55
SHA256

34b42edaccc980b33170662bdc76884ffd2f10e83d9e7cc79ef4720ce5d9809b
SHA512

0b32114fedf218ec3ce360a19c5c606b5041e5f14fbcade33a872ce1db8852087a96d2d5bb88f076d41e93959e65ab2fa087e6661ff52000ddd35073430a79d2
SSDEEP

3072:JaKHjil2XKXd4dV1RtEIZKopn2236UoVRlUqpJBrUkynyJf1/Qvv/:cKg2XKXd4X1ZTdn36UY+qLBrDYyJfx6X

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b70a0f9e7473255789c0bba55d712f78_JaffaCakes118

Files

b70a0f9e7473255789c0bba55d712f78_JaffaCakes118
.exe windows:6 windows x86 arch:x86

9420ebcb3df4a10fe54b20a468e139c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

icsunattend.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

kernel32

CloseHandle
GetLastError
CreateEventW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
_cexit
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_controlfp
memset
__set_app_type
__CxxFrameHandler3
swprintf_s
??0exception@@QAE@XZ
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
__getmainargs
malloc
_callnewh
_CxxThrowException
free
??0exception@@QAE@ABV0@@Z

ole32

CoSetProxyBlanket
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CoInitialize

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 722B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9420ebcb3df4a10fe54b20a468e139c0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ole32

Sections

.text Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 960B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 722B

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 960B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 722B

UPX0
Size: 144KB - Virtual size: 380KB