087ef30b8cec93427594dc8ddad3c40c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

087ef30b8cec93427594dc8ddad3c40c_JaffaCakes118
Size

505KB
MD5

087ef30b8cec93427594dc8ddad3c40c
SHA1

3c3b1b564372f646cfffc3fe523c5f74fb0bedb2
SHA256

73c1e5567918aef38dcaadc8141db88f2266d54e59b8349f19f3b9fc29ef3b78
SHA512

8605dfe1c90e018a7db2a10eef68866132bf435592e0bb8ee5e4a6350c8c36e48a5547904f4818b06cd1c2a8d84343573cbbc75101c162d97f2a18ee863f40b1
SSDEEP

12288:QVRVXdAgSWJRHvdOzEZA7P/96tH17x+dXa:56FQzcY96tH1kdq

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/SXX-2010-1228/DLL.DLL	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SXX-2010-1228/DLL.DLL
unpack001/SXX-2010-1228/EXE.exe

Files

087ef30b8cec93427594dc8ddad3c40c_JaffaCakes118
.rar
SXX-2010-1228/DLL.DLL
.dll windows:4 windows x86 arch:x86

fbe49f87b8b45a71de3b64d1c99d8455

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
GetFileTime
TerminateProcess
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
GetCommandLineA
HeapAlloc
RaiseException
SetStdHandle
GetFileType
HeapSize
HeapReAlloc
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFullPathNameW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcessVersion
GetCurrentDirectoryW
GlobalFlags
lstrcmpiW
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
DeleteCriticalSection
LocalAlloc
lstrcpynW
FindNextFileW
FindFirstFileW
FindClose
MulDiv
SetLastError
FormatMessageW
LocalFree
InterlockedIncrement
GetModuleHandleA
LoadLibraryA
FreeLibrary
lstrlenA
GetVersion
lstrcatW
GlobalAddAtomW
GlobalFindAtomW
lstrcpyW
GetModuleHandleW
GetProcAddress
GlobalUnlock
GlobalFree
LockResource
FindResourceW
LoadResource
InterlockedDecrement
WaitForSingleObject
GlobalLock
InterlockedExchange
lstrcmpW
GlobalAlloc
GlobalDeleteAtom
lstrlenW
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetTickCount
GetPrivateProfileStringW
WritePrivateProfileStringW
IsBadReadPtr
GetFileAttributesW
GetCurrentProcessId
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ExitProcess
CreateThread
CloseHandle
GetStdHandle
Sleep

user32

SendDlgItemMessageW
UpdateWindow
LoadIconW
CheckRadioButton
IsDlgButtonChecked
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
wvsprintfW
ReleaseDC
GetDC
ClientToScreen
BeginPaint
EndPaint
TabbedTextOutW
DrawTextW
GrayStringW
DestroyMenu
UnregisterClassW
PtInRect
LoadCursorW
GetSysColorBrush
LoadStringW
CharUpperW
AdjustWindowRectEx
CopyRect
GetTopWindow
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemID
TrackPopupMenu
GetWindowTextLengthW
GetWindowTextW
SendDlgItemMessageA
DefWindowProcW
CreateWindowExW
SetPropW
GetPropW
RemovePropW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongW
SetWindowPos
RegisterWindowMessageW
SystemParametersInfoW
GetWindowPlacement
GetWindowRect
EndDialog
SetActiveWindow
IsWindow
GetSystemMetrics
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
GetFocus
GetNextDlgTabItem
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
ValidateRect
IsWindowVisible
PeekMessageW
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongW
MessageBoxW
SetCursor
EnableWindow
GetClientRect
SetTimer
InvalidateRect
IsIconic
SendMessageW
PostMessageW
PostQuitMessage
wsprintfW
KillTimer
LoadMenuW
GetSubMenu
GetCursorPos
GetMenuItemCount
EnableMenuItem
EnumWindows
GetWindowThreadProcessId
MapWindowPoints
GetSysColor
GetDlgCtrlID
SetFocus
GetClassNameW
SetWindowsHookExW
CallNextHookEx
GetKeyNameTextW
CallWindowProcW

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteObject
SetViewportExtEx
GetDeviceCaps
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox
CreateBitmap

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW

shell32

ShellExecuteW

comctl32

ord17
ImageList_Destroy

wininet

InternetGetLastResponseInfoW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetQueryOptionW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 168KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SXX-2010-1228/EXE.exe
.exe windows:4 windows x86 arch:x86

7a5413ecfac6382256ba3d910dd65367

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVolumeInformationW
GetFullPathNameW
GetFileAttributesW
GetFileSize
GetFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
GetStartupInfoW
ExitProcess
RtlUnwind
TerminateProcess
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineA
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetModuleFileNameA
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetStringTypeA
GetStringTypeW
GetDriveTypeA
CompareStringA
CompareStringW
GetACP
GetOEMCP
SetEnvironmentVariableA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
DuplicateHandle
GetThreadLocale
GetProcessVersion
GetCurrentDirectoryW
GlobalFlags
lstrcmpiW
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
FindNextFileW
FindFirstFileW
FindClose
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LocalAlloc
lstrcpynW
EnterCriticalSection
MulDiv
SetLastError
FormatMessageW
LocalFree
InterlockedDecrement
InterlockedIncrement
GetModuleHandleA
LoadLibraryA
FreeLibrary
lstrlenA
GetVersion
lstrcatW
GlobalAddAtomW
GlobalFindAtomW
lstrcpyW
GlobalUnlock
GlobalFree
LockResource
FindResourceW
LoadResource
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
GlobalDeleteAtom
lstrlenW
GetCurrentThread
GetCurrentThreadId
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
VirtualProtect
GetTickCount
GetPrivateProfileStringW
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
CreateToolhelp32Snapshot
GetLastError
Process32FirstW
DeleteFileW
CopyFileW
GetProcAddress
Thread32First
OpenThread
QueueUserAPC
Thread32Next
CloseHandle
Process32NextW
GetModuleHandleW
GetCommandLineW
Sleep

user32

CharUpperW
RegisterClipboardFormatW
PostThreadMessageW
LoadStringW
GetSysColorBrush
PtInRect
GetClassNameW
LoadCursorW
GetDesktopWindow
GrayStringW
DrawTextW
TabbedTextOutW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
UpdateWindow
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
GetSysColor
SetFocus
AdjustWindowRectEx
DestroyMenu
CopyRect
GetTopWindow
IsChild
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextW
GetDlgCtrlID
CreateWindowExW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
SetWindowLongW
RegisterWindowMessageW
OffsetRect
SystemParametersInfoW
GetWindowPlacement
GetWindowRect
MapDialogRect
SetWindowPos
GetWindow
SetWindowContextHelpId
EndDialog
SetActiveWindow
IsWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
MessageBeep
GetNextDlgGroupItem
SetRect
CopyAcceleratorTableW
CharNextW
GetFocus
GetNextDlgTabItem
GetMessageW
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExW
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongW
MessageBoxW
SetCursor
PostQuitMessage
PostMessageW
FindWindowW
GetWindowThreadProcessId
wsprintfW
LoadIconW
EnableWindow
GetClientRect
IsIconic
SendMessageW
DrawIcon
PeekMessageW
TranslateMessage
DispatchMessageW
GetSystemMetrics
DefWindowProcW
UnregisterClassW

gdi32

PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
GetTextColor
GetBkColor
LPtoDP
GetMapMode
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
DeleteObject
DPtoLP
CreateBitmap
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

AdjustTokenPrivileges
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW

comctl32

ord17

oledlg

OleUIBusyW

ole32

OleIsCurrentClipboard
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
OleFlushClipboard
CoRegisterMessageFilter
CoRevokeClassObject

olepro32

ord253

oleaut32

SysStringLen
SysAllocString
VariantChangeType
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysFreeString

wininet

InternetCloseHandle
InternetGetLastResponseInfoW
HttpQueryInfoW
InternetQueryDataAvailable
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenW
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenUrlW

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SXX-2010-1228/skills/攻擊.gcs
SXX-2010-1228/skills/跳躍.gcs
SXX-2010-1228/skills/輔助.gcs

Sharing

General

Malware Config

Signatures

Files

fbe49f87b8b45a71de3b64d1c99d8455

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

wininet

Sections

.text Size: 132KB - Virtual size: 131KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 8KB - Virtual size: 23KB

.rsrc Size: 8KB - Virtual size: 7KB

.vmp0 Size: 24KB - Virtual size: 20KB

.vmp1 Size: 168KB - Virtual size: 164KB

.reloc Size: 16KB - Virtual size: 12KB

7a5413ecfac6382256ba3d910dd65367

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

oledlg

ole32

olepro32

oleaut32

wininet

Sections

.text Size: 172KB - Virtual size: 171KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 12KB - Virtual size: 10KB

.vmp0 Size: 148KB - Virtual size: 145KB

.reloc Size: 4KB - Virtual size: 264B

.text
Size: 132KB - Virtual size: 131KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 8KB - Virtual size: 7KB

.vmp0
Size: 24KB - Virtual size: 20KB

.vmp1
Size: 168KB - Virtual size: 164KB

.reloc
Size: 16KB - Virtual size: 12KB

.text
Size: 172KB - Virtual size: 171KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 12KB - Virtual size: 10KB

.vmp0
Size: 148KB - Virtual size: 145KB

.reloc
Size: 4KB - Virtual size: 264B