de6e5244d7ac1bb5e394d1fe69816fcd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

de6e5244d7ac1bb5e394d1fe69816fcd_JaffaCakes118
Size

506KB
MD5

de6e5244d7ac1bb5e394d1fe69816fcd
SHA1

17b082fe7e2376f50be1bb2caace06c4d8fada81
SHA256

1da2ea9315ef483dacfd27b33818191118896c65dcf6561f1c96b246af37ce1a
SHA512

d86dd47bfaa0c61346f8bfdce991d33e89ce0cffd2411d39d5f7bdb0d43e63d10328d235f7a4cb70090185aaf49aecbcb1ee73304b9bf163fdad47a8976f5e4d
SSDEEP

12288:ZAa9B0NmJkKffADCtLpm1ELDCtLpm1Ek2PuhV85Z/:WTOtLpwltLpwtT2Z/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de6e5244d7ac1bb5e394d1fe69816fcd_JaffaCakes118

Files

de6e5244d7ac1bb5e394d1fe69816fcd_JaffaCakes118
.exe windows:6 windows x86 arch:x86

672843b45149ca14d33380b71a25272a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msinfo32.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCloseKey

kernel32

GetNativeSystemInfo
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
SetFilePointer
ReadFile
CreateFileW
GetLastError
CreateDirectoryExW
GetSystemWow64DirectoryW
SetCurrentDirectoryW
FreeLibrary
FormatMessageW
EnterCriticalSection
GetFileSize
LocalFree
CreateEventW
GlobalLock
GlobalAlloc
GetComputerNameW
GetCurrentDirectoryW
GetCommandLineW
RegisterApplicationRestart
HeapSetInformation
MultiByteToWideChar
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateThread
ResetEvent
DeleteCriticalSection
SetEvent
TerminateThread
CloseHandle
GetTempPathW
GetTickCount
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
InitializeCriticalSection
WaitForSingleObject
GetVersionExW
DnsHostnameToComputerNameW
GlobalUnlock
lstrlenW
LeaveCriticalSection
LoadLibraryW
UnhandledExceptionFilter

gdi32

CreateSolidBrush
GetObjectW
CreateFontIndirectW
TextOutW
EndPage
EndDoc
StartPage
StartDocW
GetTextExtentPoint32W
GetDeviceCaps
CreateFontW
SetTextColor

user32

SetClassLongW
SetRect
GetSysColor
FillRect
SetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetSubMenu
SetMenuItemInfoW
GetFocus
UpdateWindow
ScreenToClient
CopyRect
PtInRect
SetCursor
ReleaseCapture
LoadCursorW
SetCapture
GetClientRect
IsWindowEnabled
LoadIconW
IsWindowVisible
ShowWindow
GetWindowRect
EndDialog
SendMessageW
SetTimer
GetWindowTextW
GetDlgItem
EnableWindow
SetWindowTextW
CheckRadioButton
SetDlgItemTextW
IsDlgButtonChecked
KillTimer
DialogBoxParamW
LoadStringW
PostMessageW
MessageBoxW
SetWindowPlacement
SystemParametersInfoW
EndPaint
DrawFocusRect
BeginPaint
InvalidateRect
LoadAcceleratorsW
SetMenu
GetClipboardData
LoadMenuW
IsClipboardFormatAvailable
MoveWindow
PostQuitMessage
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
CreateDialogParamW
SetProcessDPIAware
RedrawWindow
OffsetRect
CheckDlgButton
InflateRect

mfc42u

ord542
ord826
ord269
ord1173
ord1240
ord1571
ord600
ord6867
ord2559
ord5790
ord6168
ord5871
ord5785
ord640
ord6921
ord6919
ord5781
ord2755
ord5597
ord6563
ord2757
ord5618
ord802
ord6928
ord6565
ord698
ord4182
ord5588
ord911
ord396
ord860
ord323
ord1633
ord825
ord861
ord858
ord5568
ord2910
ord800
ord540
ord2606
ord538
ord4124
ord913
ord1165
ord535
ord4155
ord823
ord922
ord5706
ord2756
ord1594
ord2810
ord940
ord4184
ord6278
ord941
ord398
ord700
ord2809
ord501
ord909
ord773
ord696
ord5586
ord3430
ord5596
ord1083
ord4180
ord5617
ord998
ord394
ord6466
ord1184
ord834
ord6218
ord6279
ord2768
ord5852
ord4197
ord925
ord927
ord2805
ord4199
ord3432
ord3658
ord349
ord3608
ord3121
ord5647
ord1560
ord2385
ord537
ord1172
ord3621
ord2406
ord268
ord3614
ord1634
ord352
ord942
ord2813
ord3806
ord2776
ord2819
ord2442

msvcrt

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__CxxFrameHandler3
_wcsicoll
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
__wgetmainargs
_wtoi
_wcsicmp
memcpy
_purecall
swprintf_s
_cexit
wcstol
memset
malloc
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncpy_s
_wtol
_ftol2_sse
wcstod
_wcsupr
free
_CxxThrowException
_ftol2
wcstoul
iswalpha

atl

ord30

ntdll

WinSqmAddToStream

oleaut32

SysFreeString
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysAllocStringLen
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SysAllocString

ole32

StringFromCLSID
CoTaskMemFree
CoInitializeSecurity
CoCreateInstance
CoCreateGuid
CoInitialize
CoUninitialize

shlwapi

StrFormatByteSizeEx

setupapi

SetupIterateCabinetW

comdlg32

GetOpenFileNameW
PrintDlgExW
GetSaveFileNameW

shell32

CommandLineToArgvW

comctl32

InitCommonControlsEx

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 249KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

672843b45149ca14d33380b71a25272a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

mfc42u

msvcrt

atl

ntdll

oleaut32

ole32

shlwapi

setupapi

comdlg32

shell32

comctl32

Sections

.text Size: 137KB - Virtual size: 136KB

.data Size: 1KB - Virtual size: 20KB

.rsrc Size: 249KB - Virtual size: 249KB

.reloc Size: 9KB - Virtual size: 9KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 137KB - Virtual size: 136KB

.data
Size: 1KB - Virtual size: 20KB

.rsrc
Size: 249KB - Virtual size: 249KB

.reloc
Size: 9KB - Virtual size: 9KB

.UPX0
Size: 108KB - Virtual size: 260KB