ardamax | cc24cbd172349340b8276be37a8a6d6c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

cc24cbd172349340b8276be37a8a6d6c_JaffaCakes118
Size

477KB
MD5

cc24cbd172349340b8276be37a8a6d6c
SHA1

5b2fe881be92f7d28d4e9bda18be118e5c86313a
SHA256

c75e8c96e14f8a1794c20a8f5be2fda2ea91e70c1b18d7540a19612088f9b3f4
SHA512

e82556e7e47ecb3c361feb0ec83c70630a83b19963be03b4219ae6cf87fd9d964e53b4365caac10cae0ea77e818c60fb272a09f71a096396a03da437204e88d5
SSDEEP

6144:VXagB3bP/0iCBbGE5eZziA1+LTq21/SV6N721NAb:lZJCBRgziJqab

Score

10^/10

ardamax

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc24cbd172349340b8276be37a8a6d6c_JaffaCakes118

Files

cc24cbd172349340b8276be37a8a6d6c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bae07f8a379204893304292b06dabc8d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlUnescapeW
StrCmpIW
StrDupW
PathRemoveExtensionW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathFileExistsW
PathStripPathW
StrFormatByteSizeW

ws2_32

recv
select
closesocket
shutdown
connect
inet_addr
socket
gethostbyname
WSAStartup
htons
WSACleanup
getservbyname
send

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_Create
ImageList_ReplaceIcon
CreatePropertySheetPageW
PropertySheetW
DestroyPropertySheetPage
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetImageCount
_TrackMouseEvent

shell32

SHChangeNotify
ShellExecuteExW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW
ExtractIconW
DoEnvironmentSubstW
ShellExecuteW

wininet

FtpSetCurrentDirectoryW
FtpDeleteFileW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpPutFileW
InternetCloseHandle
InternetGetLastResponseInfoW
InternetOpenW
InternetConnectW

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

GetStringTypeA
IsProcessorFeaturePresent
InterlockedCompareExchange
GetThreadLocale
SetEnvironmentVariableA
CompareStringA
lstrcpyW
lstrlenW
CreateFileW
lstrcmpW
DeleteFileW
SetLastError
GetModuleHandleW
GetProcAddress
lstrlenA
lstrcpyA
lstrcmpA
LoadLibraryW
GetVersion
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
CloseHandle
WriteFile
lstrcmpiW
GetDateFormatW
FindResourceExW
Sleep
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
OpenProcess
SetProcessWorkingSetSize
GetCurrentProcess
GlobalLock
GlobalUnlock
lstrcpynW
lstrcatW
RemoveDirectoryW
CreateDirectoryW
SetFileAttributesW
CreateThread
SetThreadPriority
ResumeThread
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetModuleFileNameW
GetShortPathNameW
GetEnvironmentVariableW
SetPriorityClass
GetCurrentThread
SetProcessPriorityBoost
MoveFileExW
ExitProcess
GetCurrentProcessId
CreateMutexW
GetLastError
InitializeCriticalSection
RaiseException
FlushInstructionCache
LockResource
InterlockedIncrement
InterlockedDecrement
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
DeleteCriticalSection
CompareStringW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
EnumResourceNamesW
LocalAlloc
LocalReAlloc
ReadFile
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetFilePointer
LocalFree
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FormatMessageW
GetTimeZoneInformation
GetTimeFormatW
GetTickCount
OutputDebugStringW
GetComputerNameW
lstrcmpiA
CopyFileW
GetTempFileNameW
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesW
MoveFileW
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetProcessHeap
GetStartupInfoW
HeapDestroy
HeapCreate
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
LoadLibraryA
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
VirtualQuery
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

user32

DestroyIcon
EndDialog
RegisterWindowMessageW
GetAncestor
SendMessageTimeoutW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
GetWindowThreadProcessId
GetWindowModuleFileNameW
GetDlgCtrlID
IsWindowVisible
GetClassNameW
GetWindow
EnumWindows
SetClipboardViewer
ChangeClipboardChain
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
IsWindow
PostQuitMessage
GetCursorPos
SetForegroundWindow
FindWindowW
RegisterHotKey
UnregisterHotKey
GetDesktopWindow
GetForegroundWindow
GetWindowDC
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
DrawFocusRect
SetRectEmpty
DeleteMenu
CheckMenuItem
GetSubMenu
LoadMenuW
LoadIconW
CallWindowProcW
DialogBoxParamW
InvalidateRect
SetWindowPos
GetMenu
AdjustWindowRectEx
RegisterClassExW
GetClassInfoExW
DestroyWindow
IsMenu
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
UpdateWindow
GetParent
MessageBeep
LoadStringW
CharNextW
DrawTextW
GetClassLongW
SetWindowLongW
ReleaseDC
GetDlgItem
LoadCursorW
GetSysColorBrush
SystemParametersInfoW
GetWindowLongW
InflateRect
DrawFrameControl
CreateWindowExW
SetDlgItemInt
ReleaseCapture
GetCapture
SetCapture
ScreenToClient
WindowFromPoint
GetMessagePos
GetKeyState
FrameRect
OffsetRect
DrawEdge
IsWindowEnabled
CharLowerW
PeekMessageW
PtInRect
GetFocus
ModifyMenuW
TrackPopupMenuEx
GetMonitorInfoW
MonitorFromPoint
MapWindowPoints
FillRect
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
wsprintfW
MapVirtualKeyW
GetKeyNameTextW
UnregisterClassA
CopyRect
GetSystemMetrics
GetSysColor
TrackPopupMenu
MessageBoxW
EndPaint
BeginPaint
GetWindowRect
MoveWindow
ScrollWindow
GetClientRect
LoadImageW
PostMessageW
KillTimer
SetTimer
ShowWindow
GetDlgItemTextW
SetFocus
GetDlgItemInt
SetDlgItemTextW
SetWindowTextW
EnableWindow
GetActiveWindow
GetDC
SetCursor

gdi32

GetObjectW
CreateFontIndirectW
DeleteObject
PatBlt
CreateDIBSection
CreateCompatibleDC
SetBkColor
BitBlt
DeleteDC
CreateCompatibleBitmap
CreatePatternBrush
SetBrushOrgEx
GetDIBits
CreatePen
RealizePalette
CreateBitmap
GetTextMetricsW
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
SetTextColor
GetStockObject
CreateSolidBrush
CreateFontW
TextOutW
Polygon
SetPolyFillMode
SetBkMode
SelectObject
GetTextExtentPoint32W

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoTaskMemRealloc
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree

oleaut32

VarUI4FromStr
DispCallFunc
VariantInit
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringLen
VariantClear

Sections

.text
Size: 359KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bae07f8a379204893304292b06dabc8d

Headers

File Characteristics

Imports

shlwapi

ws2_32

comctl32

shell32

wininet

mpr

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

Sections

.text Size: 359KB - Virtual size: 358KB

.rdata Size: 61KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 47KB - Virtual size: 47KB

.text
Size: 359KB - Virtual size: 358KB

.rdata
Size: 61KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 47KB - Virtual size: 47KB