095ea718dac638ebb15ce6c3f3cd1eda_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

095ea718dac638ebb15ce6c3f3cd1eda_JaffaCakes118
Size

1.3MB
MD5

095ea718dac638ebb15ce6c3f3cd1eda
SHA1

8b234e562c43a230641d3639a2c9f15a9a519691
SHA256

45db35301764179336470c4dcd6abf686693afd81bb648d9b7c75f6bd80ff838
SHA512

3667e2964e93967f7f5b6fd46a112a3d2d5517e708e647256f9f0c6d61cb49f2fceeb5aeca7f97c8b0f96189eae866966489992498e842b976536cd744c0ce82
SSDEEP

24576:lNknmErU7JA4/opcm2ymz7k4QBb3ysa20y9hi6mk5K:lNgyA4M92ymz7Zm3yf2d7xmk5K

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
095ea718dac638ebb15ce6c3f3cd1eda_JaffaCakes118

Files

095ea718dac638ebb15ce6c3f3cd1eda_JaffaCakes118
.exe windows:6 windows x86 arch:x86

8d5a58b089ab785ec0edf0550fae8005

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mip.pdb

Imports

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA

kernel32

RaiseException
GetTickCount
SetLastError
MulDiv
GetCurrentProcess
FlushInstructionCache
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentProcessId
HeapSetInformation
GetCommandLineW
OpenEventW
CloseHandle
CreateEventW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
GetUserDefaultLCID
GetSystemDefaultLangID
GetSystemDefaultLCID
GetACP
GetProfileIntA
DisableThreadLibraryCalls
HeapCreate
TryEnterCriticalSection
CreateThread
ResumeThread
WaitForMultipleObjects
SetThreadPriority
WaitForSingleObject
ResetEvent
FreeResource
GetUserDefaultUILanguage
GetLocaleInfoW
OutputDebugStringA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
VirtualAlloc
VirtualFree
LoadLibraryA
GetStringTypeExW
WideCharToMultiByte
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
lstrlenW
InitializeCriticalSection

gdi32

CreateDIBSection
BitBlt
CreateCompatibleDC
ExtSelectClipRgn
CreateSolidBrush
GetTextMetricsW
CreateFontIndirectW
GetTextExtentPointW
ExtCreateRegion
SetDIBColorTable
GetObjectW
GetDIBColorTable
SetBkMode
GetTextColor
StretchBlt
SetStretchBltMode
OffsetRgn
Ellipse
GetStockObject
GetBitmapBits
CreateBitmap
CreateCompatibleBitmap
CreateFontW
SetROP2
SetDCBrushColor
Polyline
SetLayout
SetWindowExtEx
StretchDIBits
GetRegionData
EnumFontFamiliesExW
RealizePalette
SelectPalette
CreatePalette
CreateICW
CreateRectRgnIndirect
CombineRgn
DeleteObject
GetDeviceCaps
CreateDCW
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateRectRgn
PtInRegion
PatBlt
SelectClipRgn
CreateRoundRectRgn
LineTo
MoveToEx
SelectObject
CreatePen
SetTextColor
Escape
GetObjectType
GetGlyphIndicesW
GetCurrentObject
GetBkColor
GetGlyphOutlineW
GetFontData
GetOutlineTextMetricsW
TranslateCharsetInfo
GetPixel
GetTextMetricsA
GetOutlineTextMetricsA
GetCharWidthW
GetCharWidthA
GetCharWidth32A
GetCharABCWidthsW
SetBkColor
ExtTextOutW
SetTextAlign
GetTextCharsetInfo
ExtTextOutA
GetTextFaceW
GetObjectA
CreateFontIndirectA

user32

GetKeyboardLayoutList
GetDoubleClickTime
InvertRect
UnregisterClassW
CharUpperW
GetKeyboardLayout
CharNextW
IsWindowUnicode
SendMessageA
LoadCursorA
LoadBitmapW
LoadBitmapA
SetCaretBlinkTime
DestroyCaret
SetMenuItemInfoW
MonitorFromRect
DeleteMenu
WindowFromDC
GetSystemMetrics
MenuItemFromPoint
DestroyIcon
GetClassInfoW
RegisterClassW
GetMessageTime
DestroyCursor
SetFocus
GetDesktopWindow
GetWindowDC
CreateCursor
DrawTextW
SystemParametersInfoW
DrawFrameControl
InflateRect
GetParent
GetMessagePos
NotifyWinEvent
TrackMouseEvent
GetPropW
SendMessageW
EnumDisplayMonitors
GetMonitorInfoW
FillRect
ScreenToClient
GetSysColorBrush
FrameRect
BeginDeferWindowPos
EndDeferWindowPos
GetWindow
DeferWindowPos
SetWindowRgn
ShowWindow
ValidateRect
GetUpdateRect
GetWindowRect
SetWindowPos
PostMessageW
GetSysColor
DrawIconEx
IntersectRect
EqualRect
RegisterWindowMessageW
CreateWindowExW
GetFocus
IsChild
RegisterClassExW
IsWindow
GetKeyState
BeginPaint
GetClientRect
EndPaint
GetDC
ReleaseDC
GetClassInfoExW
UnionRect
PtInRect
DestroyWindow
CreatePopupMenu
GetCursorPos
AppendMenuW
SetMenuDefaultItem
PostQuitMessage
DestroyMenu
EmptyClipboard
SetClipboardData
CloseClipboard
SendInput
SetWindowsHookExW
SetWinEventHook
TrackPopupMenuEx
UnhookWinEvent
UnhookWindowsHookEx
AdjustWindowRectEx
LoadIconW
OffsetRect
SetRectEmpty
IsRectEmpty
CopyRect
OpenClipboard
KillTimer
SetTimer
InvalidateRect
ClientToScreen
RegisterClipboardFormatW
GetClipboardFormatNameW
WindowFromPoint
GetWindowThreadProcessId
EndMenu
CallNextHookEx
LoadCursorW
SetCursor
GetThreadDesktop
GetUserObjectInformationW
SetProcessDPIAware
PeekMessageW
MsgWaitForMultipleObjectsEx
DispatchMessageW
PostThreadMessageW
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
UnregisterClassA
SetForegroundWindow
GetForegroundWindow
SetCapture
ReleaseCapture
SetPropW
RemovePropW

msvcrt

_controlfp
ceil
_ltow_s
_ltow
floor
_CIsqrt
_wcsnicmp
wcstol
iswdigit
_wcslwr_s
_wcsicmp
_wtol
_wtoi
memmove
_onexit
_lock
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_callnewh
vswprintf_s
_vscwprintf
wcsncmp
_resetstkoflw
swprintf_s
calloc
memcpy
_ftol2_sse
_ftol2
_purecall
memset
__CxxFrameHandler3
wcscat_s
wcsncpy_s
wcscpy_s
memmove_s
_CxxThrowException
free
malloc
memcpy_s

ntdll

EtwEventUnregister
EtwEventWrite
EtwEventRegister

ole32

CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
OleInitialize
CoCreateFreeThreadedMarshaler
CoCreateInstance
StringFromGUID2
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
RevokeDragDrop
RegisterDragDrop
CoTaskMemFree
OleRegGetMiscStatus
OleUninitialize

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysStringLen
SysAllocString
OleCreatePropertyFrame
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
VarBstrCat
SysAllocStringLen
VariantInit
VariantClear
DispCallFunc
SafeArrayDestroy
LoadTypeLi
SafeArrayCreateVector
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen

oleacc

LresultFromObject
AccessibleObjectFromWindow

gdiplus

GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipDeleteBrush
GdipDrawImageI
GdipCloneImage
GdipCreatePen2
GdipCreateLineBrushI
GdipFree
GdipAlloc
GdipSetSolidFillColor
GdipCreatePen1
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipSetPenColor
GdipSetClipRectI
GdipFillEllipseI
GdipDrawEllipseI
GdipDrawRectangleI
GdipReleaseDC
GdipGetDC
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipSetPenDashArray
GdipSetPenDashStyle
GdipCloneBrush
GdipFillRectangleI
GdipDrawLineI
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipCreateSolidFill
GdipDeleteGraphics
GdipDeletePen

shell32

Shell_NotifyIconW
ShellAboutW

slc

SLGetWindowsInformationDWORD

comctl32

ord8

usp10

ScriptGetLogicalWidths
ScriptTextOut
ScriptGetProperties
ScriptFreeCache
ScriptGetCMap
ScriptItemize
ScriptShape
ScriptPlace

uxtheme

GetThemeColor
GetThemePartSize
GetThemeBackgroundRegion
DrawThemeText
DrawThemeIcon
DrawThemeEdge
DrawThemeBackground
OpenThemeData
DrawThemeTextEx
CloseThemeData
IsThemeActive
GetThemeMargins

msimg32

TransparentBlt
GradientFill
AlphaBlend

dwmapi

DwmIsCompositionEnabled
DwmEnableBlurBehindWindow

Exports

Exports

?REExtendedRegisterClass@@YGHXZ

Sections

.text
Size: 740KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 41KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8d5a58b089ab785ec0edf0550fae8005

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

oleaut32

oleacc

gdiplus

shell32

slc

comctl32

usp10

uxtheme

msimg32

dwmapi

Exports

Exports

Sections

.text Size: 740KB - Virtual size: 740KB

.data Size: 41KB - Virtual size: 45KB

.rsrc Size: 383KB - Virtual size: 382KB

.reloc Size: 27KB - Virtual size: 26KB

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 740KB - Virtual size: 740KB

.data
Size: 41KB - Virtual size: 45KB

.rsrc
Size: 383KB - Virtual size: 382KB

.reloc
Size: 27KB - Virtual size: 26KB

.UPX0
Size: 108KB - Virtual size: 260KB