d6dd9200ad93749440e1168210a8af63_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d6dd9200ad93749440e1168210a8af63_JaffaCakes118
Size

272KB
MD5

d6dd9200ad93749440e1168210a8af63
SHA1

ff9d4e8c5f68bb7adeeb37a311f8d9ed198c7979
SHA256

13c5fc597d6e66e7e36f5f8ac2742c65e7db58c65e0392d2e67d84dc5dd4650b
SHA512

7b0b159c368379ef34bb6bf0230e9f03433064f70be0e9e5372f2f2d6cddffdb56f7b9b8584e78c75efb774b8244760f72bbaabedb498dab89a50e208e4e03f2
SSDEEP

6144:Ml8yi2wb/OsDazr3uQN8nHXNXOlZfpxU:MlNYb/Tazr3BN8HXNXOlZfY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6dd9200ad93749440e1168210a8af63_JaffaCakes118

Files

d6dd9200ad93749440e1168210a8af63_JaffaCakes118
.exe windows:6 windows x86 arch:x86

f169c26bcf194db002a4290ad9c63d82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ehSched.pdb

Imports

advapi32

CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeleteService
ControlService
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
GetLengthSid
IsValidSid
ChangeServiceConfig2W
CreateServiceW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupAccountNameW
RegGetValueW
GetTokenInformation
OpenThreadToken
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
LookupAccountSidW
CreateWellKnownSid
OpenProcessToken
SetNamedSecurityInfoW
SetSecurityInfo

kernel32

CloseHandle
SetEvent
GetModuleFileNameW
MultiByteToWideChar
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
GetCurrentThread
FreeLibrary
SizeofResource
lstrcmpiW
FindResourceW
LoadLibraryExW
GetModuleHandleW
ResetEvent
CreateEventW
ExitThread
WaitForSingleObject
CreateThread
WaitForMultipleObjects
CancelWaitableTimer
OpenThread
CreateWaitableTimerW
GetCurrentThreadId
GetCommandLineW
HeapSetInformation
QueueUserWorkItem
SetWaitableTimer
GetSystemTimeAsFileTime
QueueUserAPC
OutputDebugStringW
OutputDebugStringA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
LocalFree
InterlockedExchange
GetVersionExA
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
LoadResource
EncodeSystemPointer
GetProcAddress
LoadLibraryW

user32

TranslateMessage
RegisterDeviceNotificationW
UnregisterDeviceNotification
MsgWaitForMultipleObjectsEx
DispatchMessageW
UnregisterClassA
PeekMessageW
CharNextW
PostThreadMessageW

msvcrt

_errno
realloc
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_vsnwprintf
_resetstkoflw
memset
calloc
_purecall
wcscat_s
wcsncpy_s
wcscpy_s
memcpy_s
free
malloc
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_controlfp
fflush
_except_handler4_common
fputws
_wcsnicmp

ole32

CoRevertToSelf
CoTaskMemAlloc
CoCreateGuid
CoInitialize
CoInitializeEx
CoUninitialize
CoImpersonateClient
CoSetProxyBlanket
CoInitializeSecurity
StringFromGUID2
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysStringLen
SysStringByteLen
SysAllocStringByteLen
SafeArrayCopy
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SystemTimeToVariantTime
LoadTypeLi
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
SysFreeString

slc

SLGetWindowsInformationDWORD

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f169c26bcf194db002a4290ad9c63d82

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ole32

oleaut32

slc

Sections

.text Size: 117KB - Virtual size: 116KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 4KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 117KB - Virtual size: 116KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 4KB

UPX0
Size: 144KB - Virtual size: 380KB