ce2726910431dbf7681be460e85a2d40_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ce2726910431dbf7681be460e85a2d40_JaffaCakes118
Size

590KB
MD5

ce2726910431dbf7681be460e85a2d40
SHA1

a019c4e46ff1d70c071adb5d49556777a8e0d3da
SHA256

16259e3a30d3568f9b87d9d8bac539b6ab07c588867ec53c4afcefa0a8a2aa74
SHA512

1befe5d4565f299e1febe4bc548954dbd67e54f693354b829595b0a028b660ce8d41811abd5c7e4b250fa9a3c229fc006b5db3b14b28adaad30ba244ec5bdc92
SSDEEP

12288:/dZTua+I00o0v1qdaa6YvqJE4R41OQ4Cgh6W4y/lB0bFHGJ:/dZd+I00J0dnvqOu41OsQ3dB0bwJ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/DLL.dll	vmprotect
static1/unpack001/LoadDll.dll	vmprotect

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/DLL.dll
unpack001/EXE.exe
unpack001/LoadDll.dll

Files

ce2726910431dbf7681be460e85a2d40_JaffaCakes118
.rar
DLL.dll
.dll windows:4 windows x86 arch:x86

a9ac6f2144766a6f86214c4fd37e82d3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
GetFileSize
GetFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
TerminateProcess
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
HeapAlloc
RaiseException
HeapSize
HeapReAlloc
SetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFullPathNameW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
DuplicateHandle
GetProcessVersion
GetCurrentDirectoryW
GlobalFlags
lstrcmpiW
MulDiv
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
FindNextFileW
FindFirstFileW
SetLastError
FindClose
DeleteCriticalSection
LocalAlloc
lstrcpynW
FormatMessageW
LocalFree
InterlockedIncrement
GetModuleHandleA
LoadLibraryA
lstrlenA
GetVersion
lstrcatW
GlobalAddAtomW
GlobalFindAtomW
lstrcpyW
GlobalUnlock
GlobalFree
LockResource
FindResourceW
LoadResource
InterlockedDecrement
WaitForSingleObject
GlobalLock
lstrcmpW
GlobalAlloc
InterlockedExchange
GlobalDeleteAtom
lstrlenW
GetCurrentThread
GetCurrentThreadId
CreateFileMappingW
GetLastError
MapViewOfFile
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
EnterCriticalSection
IsBadReadPtr
LeaveCriticalSection
VirtualQuery
VirtualProtect
InitializeCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcessId
ExitProcess
GetModuleHandleW
CreateThread
CloseHandle
GetTickCount
GetStartupInfoA
Sleep

user32

LoadIconW
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
wvsprintfW
UnregisterClassW
PtInRect
ClientToScreen
TabbedTextOutW
DrawTextW
GrayStringW
LoadCursorW
GetSysColorBrush
LoadStringW
DestroyMenu
CharUpperW
GetSysColor
SetFocus
AdjustWindowRectEx
GetTopWindow
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthW
UpdateWindow
GetDlgCtrlID
DefWindowProcW
CreateWindowExW
SetPropW
GetPropW
RemovePropW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongW
SetWindowPos
RegisterWindowMessageW
SystemParametersInfoW
IsIconic
GetWindowPlacement
GetWindowRect
CopyRect
GetDC
ReleaseDC
EndDialog
SetActiveWindow
IsWindow
GetSystemMetrics
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
ValidateRect
IsWindowVisible
GetClientRect
SetTimer
SendMessageW
EnableWindow
CallNextHookEx
SetWindowsHookExW
PeekMessageW
GetCursorPos
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongW
MessageBoxW
SetCursor
PostQuitMessage
wsprintfW
PostMessageW
SendDlgItemMessageW
SendDlgItemMessageA
GetWindowTextW
MapWindowPoints
EnumWindows
UnhookWindowsHookEx
GetWindowThreadProcessId
GetClassNameW
CallWindowProcW

gdi32

SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
OffsetViewportOrgEx
GetDeviceCaps
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

shell32

ShellExecuteW

comctl32

ImageList_Destroy
ord17

wininet

InternetGetLastResponseInfoW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetQueryOptionW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW

Sections

.text
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EXE.exe
.exe windows:4 windows x86 arch:x86

293907b456b97d093e4d2bf974ff62bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetErrorMode
GetStartupInfoW
ExitProcess
RtlUnwind
TerminateProcess
HeapFree
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetProcessVersion
WritePrivateProfileStringW
InterlockedExchange
GlobalFlags
lstrcmpiW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalFree
LocalAlloc
lstrcpynW
EnterCriticalSection
GetLastError
MulDiv
SetLastError
InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
lstrlenA
GetVersion
lstrcatW
GlobalAddAtomW
GlobalFindAtomW
lstrcpyW
GetModuleHandleW
GlobalUnlock
GlobalFree
LockResource
FindResourceW
LoadResource
WaitForSingleObject
CloseHandle
GlobalLock
lstrcmpW
GlobalAlloc
GlobalDeleteAtom
lstrlenW
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetTickCount
LoadLibraryW
GetProcAddress
Sleep
GetCommandLineA
FreeLibrary

user32

AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
SendDlgItemMessageA
SendDlgItemMessageW
UpdateWindow
IsDialogMessageW
SetWindowTextW
ShowWindow
ClientToScreen
GetDC
ReleaseDC
BeginPaint
EndPaint
TabbedTextOutW
DrawTextW
GrayStringW
LoadCursorW
GetClassNameW
PtInRect
GetSysColorBrush
LoadStringW
DestroyMenu
CopyRect
GetTopWindow
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthW
GetWindowTextW
GetDlgCtrlID
DefWindowProcW
CreateWindowExW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongW
SetWindowPos
RegisterWindowMessageW
SystemParametersInfoW
GetWindowPlacement
GetWindowRect
EndDialog
SetActiveWindow
CreateDialogIndirectParamW
GetDlgItem
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageW
GetCursorPos
SetWindowsHookExW
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongW
MessageBoxW
SetCursor
PostQuitMessage
PostMessageW
wsprintfW
EnableWindow
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
SendMessageW
SetTimer
LoadIconW
FindWindowW
IsWindow
DestroyWindow
UnregisterClassW

gdi32

SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteObject
OffsetViewportOrgEx
SetMapMode
GetObjectW
GetDeviceCaps
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
SetBkColor
SetTextColor
GetClipBox
GetStockObject
SelectObject
RestoreDC
SaveDC
CreateBitmap
DeleteDC

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

comctl32

ord17

Sections

.text
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LoadDll.dll
.dll windows:4 windows x86 arch:x86

380634dd6700d478f3e6486d64928c62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcessId
GetModuleFileNameW
LoadLibraryW
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetCurrentProcess
GetModuleHandleW
GetStringTypeA
GetProcAddress
HeapFree
HeapAlloc
RtlUnwind
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeW

user32

GetWindowThreadProcessId
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

Exports

Exports

CloseHook
SetHook

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.myseg
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9ac6f2144766a6f86214c4fd37e82d3

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

wininet

Sections

.text Size: 156KB - Virtual size: 152KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 12KB - Virtual size: 9KB

.vmp0 Size: 24KB - Virtual size: 21KB

.vmp1 Size: 400KB - Virtual size: 399KB

.reloc Size: 16KB - Virtual size: 13KB

293907b456b97d093e4d2bf974ff62bc

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

Sections

.text Size: 76KB - Virtual size: 73KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 12KB - Virtual size: 10KB

.vmp0 Size: 28KB - Virtual size: 24KB

.reloc Size: 4KB - Virtual size: 180B

380634dd6700d478f3e6486d64928c62

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 3KB

.myseg Size: 4KB - Virtual size: 4B

.vmp0 Size: 4KB - Virtual size: 1KB

.vmp1 Size: 12KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 156KB - Virtual size: 152KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 12KB - Virtual size: 9KB

.vmp0
Size: 24KB - Virtual size: 21KB

.vmp1
Size: 400KB - Virtual size: 399KB

.reloc
Size: 16KB - Virtual size: 13KB

.text
Size: 76KB - Virtual size: 73KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 12KB - Virtual size: 10KB

.vmp0
Size: 28KB - Virtual size: 24KB

.reloc
Size: 4KB - Virtual size: 180B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 3KB

.myseg
Size: 4KB - Virtual size: 4B

.vmp0
Size: 4KB - Virtual size: 1KB

.vmp1
Size: 12KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 1KB