bdf9968e664e1e70b2014217a7a387a4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bdf9968e664e1e70b2014217a7a387a4_JaffaCakes118
Size

136KB
MD5

bdf9968e664e1e70b2014217a7a387a4
SHA1

873a08f847c6ac738f161ef89c1c3a4c5b64ae5a
SHA256

f7367a36a994ae87179edd17e0cd71430081802f1db801326a2f40d88b733fa5
SHA512

3a19deb99d4372ea1a6d1643c7dd3ec0ad04e1a9d1950fd55b50e457ff692e9045843cab4a9db13331f7cd594631a78bdbe8dbb453673108321078192ca1ae1c
SSDEEP

3072:vliR5o6pYYPbNc2RCFSZzUb7BcRuDecLm:diR5pzDUbCB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdf9968e664e1e70b2014217a7a387a4_JaffaCakes118

Files

bdf9968e664e1e70b2014217a7a387a4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d14c589a0c6b324b734c5af3e2ef0f92

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
SetErrorMode
RaiseException
InterlockedIncrement
WritePrivateProfileStringA
GlobalFlags
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCPInfo
GetOEMCP
HeapAlloc
HeapFree
InterlockedDecrement
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
HeapCreate
IsBadWritePtr
QueryPerformanceCounter
SetUnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalAddAtomA
GetCurrentThread
FreeLibrary
GlobalDeleteAtom
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
lstrcpyA
SetLastError
GlobalFree
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
GetModuleFileNameA
IsBadReadPtr
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
CreateProcessA
ResumeThread
CopyFileA
CreateFileA
GetSystemTime
SystemTimeToFileTime
SetFileTime
GetCurrentThreadId
VirtualAlloc
GetSystemInfo
VirtualFree
Sleep
OutputDebugStringA
GetProcAddress
LoadLibraryA
GetCurrentProcessId
GetTickCount
GetModuleHandleA
FreeLibraryAndExitThread
CloseHandle
CreateThread
VirtualProtect
lstrlenA
lstrcmpiA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
VirtualQuery
InterlockedExchange
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconA
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
AdjustWindowRectEx
GetClassInfoA
RegisterClassA
DefWindowProcA
CallWindowProcA
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
SetWindowPos
ShowWindow
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetWindowTextA
SetWindowTextA
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
GetClassNameA
wsprintfA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
DestroyMenu
RegisterWindowMessageA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
PostMessageA
SetCursor
SendMessageA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
GetMenuCheckMarkDimensions
LoadBitmapA
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
MessageBoxA

gdi32

DeleteDC
GetStockObject
ExtTextOutA
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
GetDeviceCaps
TextOutA
RectVisible
PtVisible
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
DeleteObject
CreateBitmap
Escape

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegEnumKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA

comctl32

ord17

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

ca6234
uca6234

Sections

.text
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.UPX1
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.UPX2
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d14c589a0c6b324b734c5af3e2ef0f92

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: - Virtual size: 100KB

.rdata Size: - Virtual size: 24KB

.data Size: - Virtual size: 27KB

.tdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 14KB

.UPX0 Size: - Virtual size: 17KB

.UPX1 Size: - Virtual size: 11KB

.UPX2 Size: 129KB - Virtual size: 129KB

.reloc Size: 512B - Virtual size: 148B

.text
Size: - Virtual size: 100KB

.rdata
Size: - Virtual size: 24KB

.data
Size: - Virtual size: 27KB

.tdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 14KB

.UPX0
Size: - Virtual size: 17KB

.UPX1
Size: - Virtual size: 11KB

.UPX2
Size: 129KB - Virtual size: 129KB

.reloc
Size: 512B - Virtual size: 148B