d31b2cd4fa2a2d98b75489fa674d196e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
d31b2cd4fa2a2d98b75489fa674d196e_JaffaCakes118
Size 1.3MB
Sample240908-abwjxavfmc
SHA256 b44655a992ed75cea0dc7121cabed752085c9aa23028c7224c9689691a398bbc
MD5 d31b2cd4fa2a2d98b75489fa674d196e
SHA1 2a567832b4e938d47b85c5c39d3c0a426cde4589
SHA512 e770a2a8acf7e3a37fccf721bad862b98c2dfc65b473fd3a2e251aee7d0ae004ce0f0faf74f7fa27a4ed015075e72fea0a518d6becfa0be14d3922b22ce849ae
SSDEEP 24576:o563ey8gZqj4ye9/BW9kOTrtMb7+aA/xB3Y37QNDXJ+IRDI:8/+qEygpcLTebiaCI37klR0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d31b2cd4fa2a2d98b75489fa674d196e_JaffaCakes118

File Explorer

d31b2cd4fa2a2d98b75489fa674d196e_JaffaCakes118

.exe 1.3MB

d31b2cd4fa2a2d98b75489fa674d196e_JaffaCakes118

IMPHASH 29d41f4be522c34c9ff2d81aebbd845b
SHA256 b44655a992ed75cea0dc7121cabed752085c9aa23028c7224c9689691a398bbc
MD5 d31b2cd4fa2a2d98b75489fa674d196e
SHA1 2a567832b4e938d47b85c5c39d3c0a426cde4589
SHA512 e770a2a8acf7e3a37fccf721bad862b98c2dfc65b473fd3a2e251aee7d0ae004ce0f0faf74f7fa27a4ed015075e72fea0a518d6becfa0be14d3922b22ce849ae
SSDEEP 24576:o563ey8gZqj4ye9/BW9kOTrtMb7+aA/xB3Y37QNDXJ+IRDI:8/+qEygpcLTebiaCI37klR0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2342912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CreateThread GlobalUnlock GlobalLock GlobalAlloc GetTickCount WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GetModuleHandleA GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW FreeConsole GetEnvironmentVariableA VirtualProtect VirtualAlloc GetProcAddress GetLastError LoadLibraryA SetLastError SetThreadPriority GetCurrentThread CreateProcessA GetCommandLineA GetStartupInfoA SetEnvironmentVariableA ReleaseMutex WaitForSingleObject CreateMutexA OpenMutexA SetErrorMode GetCurrentThreadId CreateFileA FindClose FindFirstFileA FindFirstFileW VirtualQueryEx GetExitCodeProcess ReadProcessMemory VirtualProtectEx UnmapViewOfFile ContinueDebugEvent SetThreadContext GetThreadContext WaitForDebugEvent SuspendThread DebugActiveProcess ResumeThread CreateProcessW CloseHandle GetStartupInfoW MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA WriteProcessMemory ExitProcess FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA HeapSize HeapReAlloc QueryPerformanceCounter VirtualFree HeapCreate HeapDestroy GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA RtlUnwind DeleteCriticalSection GetStdHandle WriteFile TlsFree TlsSetValue TlsAlloc TlsGetValue Sleep EnterCriticalSection LeaveCriticalSection GetVersionExA InitializeCriticalSection GetCurrentProcessId GetModuleFileNameW GetShortPathNameW GetModuleFileNameA GetCommandLineW GetShortPathNameA GetSystemTimeAsFileTime HeapFree HeapAlloc GetProcessHeap RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage

user32

GetDesktopWindow MoveWindow SetPropA EnumThreadWindows GetPropA GetMessageA GetSystemMetrics SetTimer GetAsyncKeyState KillTimer BeginPaint EndPaint SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow LoadStringA LoadStringW FindWindowA WaitForInputIdle MessageBoxA InSendMessage UnpackDDElParam FreeDDElParam DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW SendMessageA PeekMessageA TranslateMessage DispatchMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow DestroyWindow

gdi32

CreateDCA CreateDIBitmap CreateCompatibleDC SelectObject SelectPalette RealizePalette BitBlt DeleteDC DeleteObject CreatePalette

Name

UPX0

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX1

Size

340KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

244KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

48KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

584KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

d31b2cd4fa2a2d98b75489fa674d196e_JaffaCakes118

kernel32

user32

gdi32

generic