110198d8521b98743194da04438024c1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

110198d8521b98743194da04438024c1_JaffaCakes118
Size

284KB
MD5

110198d8521b98743194da04438024c1
SHA1

2e641379fa391e1ceb2ce6a2f317b46c6defa75f
SHA256

dc06ed3ef028fc47a6410d25d777b62b15e696e2e64f4adf580494ee6aba2bb9
SHA512

67b8a568039f5387752381d4e744e572398c69b66d9353da2620aeecb7bd437d75b08a68ea92e2bd74db36c061119f3243a5e35b34640a461bb78adaa7486dd2
SSDEEP

6144:95DupdwjQkUjU80VBXLneW1VzY/gEmvD/TtafQV23Aa2JFsA/3K/n:LqGUjKeWc/5mXtB

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
110198d8521b98743194da04438024c1_JaffaCakes118

Files

110198d8521b98743194da04438024c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2e0c19f7c778673fbf330a549ecaacb5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
GetModuleBaseNameA

kernel32

SetFilePointer
FlushFileBuffers
FindClose
FindFirstFileA
GetFullPathNameA
FileTimeToLocalFileTime
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
GetDriveTypeA
GetProcessHeap
GetStartupInfoA
RaiseException
HeapSize
ExitProcess
GetACP
TerminateProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA
LCMapStringW
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetCurrentDirectoryA
GetOEMCP
GetCPInfo
GetLocaleInfoA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
FileTimeToSystemTime
GetThreadLocale
GlobalGetAtomNameA
GlobalFlags
InterlockedIncrement
InterlockedDecrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetCurrentProcessId
lstrcmpA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceA
LoadResource
LockResource
SizeofResource
SetLastError
GetCommandLineA
GetCurrentThreadId
GetTickCount
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleA
lstrlenA
CompareStringW
CompareStringA
FormatMessageA
LocalFree
CloseHandle
WriteFile
OutputDebugStringA
GetCurrentProcess
GetTempPathA
CreateFileA
GetVersion
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
UnhandledExceptionFilter

user32

PostQuitMessage
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetSystemMetrics
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
RegisterWindowMessageA
DispatchMessageA
TranslateMessage
PeekMessageA
PostMessageA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
MessageBoxA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetWindowTextA
SetWindowTextA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
GetKeyState
ValidateRect
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageA
GetParent

gdi32

DeleteDC
GetStockObject
SetViewportOrgEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
GetDeviceCaps
SelectObject
Escape
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
OffsetViewportOrgEx

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA
GetPrinterDriverDirectoryA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

LaunchApplications
LoadIniFile
LoadPnPLaunch
LocateIniFile

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2e0c19f7c778673fbf330a549ecaacb5

Headers

File Characteristics

Imports

psapi

kernel32

user32

gdi32

winspool.drv

advapi32

oleaut32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 8KB - Virtual size: 21KB

.rsrc Size: 4KB - Virtual size: 984B

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 4KB - Virtual size: 984B

.UPX0
Size: 108KB - Virtual size: 260KB