d2acff313847101117633b1c794fea6c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d2acff313847101117633b1c794fea6c_JaffaCakes118
Size

537KB
MD5

d2acff313847101117633b1c794fea6c
SHA1

c928d81c6e88d2be6498ed56d9c63c13ec7d0c39
SHA256

b45603d53ef9db44f2262fee73e700b98a2afe4017beaa7ea6ca8831196d5262
SHA512

1df0fd4b545f80a1ae9ce32cd52dc61a3a8edbe9ca72269a7aa3ab9ad0fd95a5dccf0a905a20847dd72d93bdcbd99ebadda05f9595557f46d87ece9a3d938d87
SSDEEP

12288:l8Nw12F/vLxco50GiUzmJqqPKVbP3hncWRAtPEju:qNw12Bxa93pCVbflReEju

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d2acff313847101117633b1c794fea6c_JaffaCakes118
unpack001/out.upx

Files

d2acff313847101117633b1c794fea6c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 924KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 397KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

??$MakeCheckOpValueString@C@google@@YAXPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABC@Z
??$MakeCheckOpValueString@D@google@@YAXPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABD@Z
??$MakeCheckOpValueString@E@google@@YAXPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABE@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0CheckOpMessageBuilder@base@google@@QAE@PBD@Z
??0ErrnoLogMessage@google@@QAE@PBDHHHP8LogMessage@1@AEXXZ@Z
??0LogMessage@google@@QAE@PBDH@Z
??0LogMessage@google@@QAE@PBDHABUCheckOpString@1@@Z
??0LogMessage@google@@QAE@PBDHH@Z
??0LogMessage@google@@QAE@PBDHHHP801@AEXXZ@Z
??0LogMessage@google@@QAE@PBDHHPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0LogMessage@google@@QAE@PBDHHPAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
??0LogMessage@google@@QAE@PBDHHPAVLogSink@1@_N@Z
??0LogMessageFatal@google@@QAE@PBDH@Z
??0LogMessageFatal@google@@QAE@PBDHABUCheckOpString@1@@Z
??0LogMessageVoidify@google@@QAE@XZ
??0LogSink@google@@QAE@ABV01@@Z
??0LogSink@google@@QAE@XZ
??0LogStream@LogMessage@google@@QAE@PADHH@Z
??0Logger@base@google@@QAE@ABV012@@Z
??0Logger@base@google@@QAE@XZ
??0NullStream@google@@QAE@PBDHABUCheckOpString@1@@Z
??0NullStream@google@@QAE@XZ
??0NullStreamFatal@google@@QAE@PBDHABUCheckOpString@1@@Z
??0NullStreamFatal@google@@QAE@XZ
??1CheckOpMessageBuilder@base@google@@QAE@XZ
??1ErrnoLogMessage@google@@QAE@XZ
??1LogMessage@google@@QAE@XZ
??1LogMessageFatal@google@@QAE@XZ
??1LogSink@google@@UAE@XZ
??1LogStream@LogMessage@google@@UAE@XZ
??1Logger@base@google@@UAE@XZ
??1NullStream@google@@UAE@XZ
??1NullStreamFatal@google@@UAE@XZ
??4CheckOpMessageBuilder@base@google@@QAEAAV012@ABV012@@Z
??4LogMessageVoidify@google@@QAEAAV01@ABV01@@Z
??4LogSink@google@@QAEAAV01@ABV01@@Z
??4Logger@base@google@@QAEAAV012@ABV012@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6google@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV12@ABW4PRIVATE_Counter@0@@Z
??ILogMessageVoidify@google@@QAEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??_7LogSink@google@@6B@
??_7LogStream@LogMessage@google@@6B@
??_7Logger@base@google@@6B@
??_7NullStream@google@@6B@
??_7NullStreamFatal@google@@6B@
??_8LogStream@LogMessage@google@@7B@
??_8NullStream@google@@7B@
??_8NullStreamFatal@google@@7B@
??_DLogStream@LogMessage@google@@QAEXXZ
??_DNullStream@google@@QAEXXZ
??_DNullStreamFatal@google@@QAEXXZ
?AddLogSink@google@@YAXPAVLogSink@1@@Z
?CheckstrcasecmpfalseImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?CheckstrcasecmptrueImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?CheckstrcmpfalseImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?CheckstrcmptrueImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?FLAGS_alsologtoemail@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_alsologtostderr@fLB@@3_NA
?FLAGS_colorlogtostderr@fLB@@3_NA
?FLAGS_log_backtrace_at@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_log_dir@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_log_link@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_log_prefix@fLB@@3_NA
?FLAGS_logbuflevel@fLI@@3HA
?FLAGS_logbufsecs@fLI@@3HA
?FLAGS_logemaillevel@fLI@@3HA
?FLAGS_logmailer@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_logtostderr@fLB@@3_NA
?FLAGS_max_log_size@fLI@@3HA
?FLAGS_minloglevel@fLI@@3HA
?FLAGS_stderrthreshold@fLI@@3HA
?FLAGS_stop_logging_if_full_disk@fLB@@3_NA
?FLAGS_v@fLI@@3HA
?FLAGS_vmodule@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?Fail@LogMessage@google@@SAXXZ
?Flush@LogMessage@google@@QAEXXZ
?FlushLogFiles@google@@YAXH@Z
?FlushLogFilesUnsafe@google@@YAXH@Z
?ForVar1@CheckOpMessageBuilder@base@google@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?ForVar2@CheckOpMessageBuilder@base@google@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?GetExistingTempDirectories@google@@YAXPAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?GetLogSeverityName@google@@YAPBDH@Z
?GetLogger@base@google@@YAPAVLogger@12@H@Z
?GetLoggingDirectories@google@@YAABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?Init@LogMessage@google@@AAEXPBDHHP812@AEXXZ@Z
?InitGoogleLogging@google@@YAXPBD@Z
?InitVLOG3__@google@@YA_NPAPAHPAHPBDH@Z
?InstallFailureFunction@google@@YAXP6AXXZ@Z
?LogSeverityNames@google@@3QBQBDB
?LogToStderr@google@@YAXXZ
?NewString@CheckOpMessageBuilder@base@google@@QAEPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?RawLog__@google@@YAXHPBDH0ZZ
?RawLog__SetLastTime@google@@YAXABUtm@@H@Z
?RecordCrashReason@LogMessage@google@@AAEXPAUCrashReason@glog_internal_namespace_@2@@Z
?RemoveLogSink@google@@YAXPAVLogSink@1@@Z
?ReprintFatalMessage@google@@YAXXZ
?SafeFNMatch_@glog_internal_namespace_@google@@YA_NPBDI0I@Z
?SaveOrSendToLog@LogMessage@google@@AAEXXZ
?SendEmail@google@@YA_NPBD00@Z
?SendToLog@LogMessage@google@@QAEXXZ
?SendToSink@LogMessage@google@@AAEXXZ
?SendToSinkAndLog@LogMessage@google@@AAEXXZ
?SendToSyslogAndLog@LogMessage@google@@QAEXXZ
?SetEmailLogging@google@@YAXHPBD@Z
?SetLogDestination@google@@YAXHPBD@Z
?SetLogFilenameExtension@google@@YAXPBD@Z
?SetLogSymlink@google@@YAXHPBD@Z
?SetLogger@base@google@@YAXHPAVLogger@12@@Z
?SetStderrLogging@google@@YAXH@Z
?SetVLOGLevel@google@@YAHPBDH@Z
?ShutdownGoogleLogging@google@@YAXXZ
?ToString@LogSink@google@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HPBDHPBUtm@@0I@Z
?TruncateLogFile@google@@YAXPBD_J1@Z
?TruncateStdoutStderr@google@@YAXXZ
?WaitTillSent@LogSink@google@@UAEXXZ
?WriteToStringAndLog@LogMessage@google@@AAEXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z
?ctr@LogStream@LogMessage@google@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?g_logging_fail_func@google@@3P6AXXZA
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?kMaxLogMessageLen@LogMessage@google@@2IB
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z
?num_messages@LogMessage@google@@SA_JH@Z
?num_messages_@LogMessage@google@@0PA_JA
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?pbase@LogStream@LogMessage@google@@QBEPADXZ
?pcount@LogStream@LogMessage@google@@QBEIXZ
?posix_strerror_r@google@@YAHHPADI@Z
?preserved_errno@LogMessage@google@@QBEHXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?self@LogStream@LogMessage@google@@QBEPAV123@XZ
?set_ctr@LogStream@LogMessage@google@@QAEXH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z
?str@LogStream@LogMessage@google@@QBEPADXZ
?stream@LogMessage@google@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?stream@NullStream@google@@QAEAAV12@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z

Sections

.text
Size: 778KB - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 924KB

UPX1 Size: 397KB - Virtual size: 400KB

.rsrc Size: 139KB - Virtual size: 140KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 778KB - Virtual size: 778KB

.rdata Size: 175KB - Virtual size: 174KB

.data Size: 22KB - Virtual size: 105KB

.rsrc Size: 149KB - Virtual size: 148KB

.reloc Size: 69KB - Virtual size: 69KB

UPX0
Size: - Virtual size: 924KB

UPX1
Size: 397KB - Virtual size: 400KB

.rsrc
Size: 139KB - Virtual size: 140KB

.text
Size: 778KB - Virtual size: 778KB

.rdata
Size: 175KB - Virtual size: 174KB

.data
Size: 22KB - Virtual size: 105KB

.rsrc
Size: 149KB - Virtual size: 148KB

.reloc
Size: 69KB - Virtual size: 69KB