130a267f761881beed7cd892992ed20b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

130a267f761881beed7cd892992ed20b_JaffaCakes118
Size

299KB
MD5

130a267f761881beed7cd892992ed20b
SHA1

44d77aa2622f887377721696bbef7b463734e368
SHA256

682e3da21347a01280f07a6701e243ddce5152a14dc3501545546b7c6f489601
SHA512

424f546b9f9fe3d8897c0089b8863d85c7a87a3540d50e844e9ea2b22580a2388bfe252ef5885e2a7e37c6f994bbb7b6146c33a6f255c53344066b1c541d408f
SSDEEP

6144:HwuukFOjRKCA86jNcgm8SoGK+w45mrEty+jO2Vz/cNDH:QuulK1tmXo1V+mrEtywO2Vz/UH

Score

9^/10

upx

Malware Config

Signatures

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
static1/unpack001/WebBrowserPassView.exe	Nirsoft
static1/unpack002/out.upx	Nirsoft
static1/unpack003/out.upx	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
static1/unpack002/out.upx	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
static1/unpack001/WebBrowserPassView.exe	WebBrowserPassView

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/mailpv.exe	upx
static1/unpack001/mspass.exe	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/WebBrowserPassView.exe
unpack001/mailpv.exe
unpack002/out.upx
unpack001/mspass.exe
unpack003/out.upx

Files

130a267f761881beed7cd892992ed20b_JaffaCakes118
.zip
WebBrowserPassView.exe
.exe windows:4 windows x86 arch:x86

65d1b1de6af8e4cfc3f0920cb8d513df

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

Imports

msvcrt

__wgetmainargs
_initterm
wcsncat
__setusermatherr
_adjust_fdiv
memchr
strftime
realloc
_gmtime64
qsort
_purecall
_itow
_strlwr
_wcmdln
_wcslwr
strchr
wcsncmp
_wcsicmp
malloc
wcschr
free
_c_exit
modf
_exit
exit
_cexit
_XcptFilter
_wcsupr
_wtoi
_memicmp
wcstoul
strcmp
strcpy
_wcsnicmp
wcsrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
memcmp
wcslen
memcpy
wcscpy
memset
strlen
_snwprintf
wcscat
__set_app_type
_controlfp
_except_handler3
_onexit
__dllonexit
wcscmp
__p__fmode
__p__commode

comctl32

ord17
ImageList_AddMasked
ImageList_Create
ImageList_SetImageCount
ImageList_ReplaceIcon
CreateStatusWindowW
CreateToolbarEx

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

DeleteFileA
GetDiskFreeSpaceW
AreFileApisANSI
EnterCriticalSection
GetSystemTime
LockFileEx
FormatMessageA
GetTempPathA
GetSystemTimeAsFileTime
UnlockFileEx
GetTickCount
GetFullPathNameA
InitializeCriticalSection
CreateFileA
CreateFileMappingW
GetModuleHandleA
GetStartupInfoW
GetFullPathNameW
LockFile
FlushFileBuffers
UnlockFile
InterlockedCompareExchange
DeleteCriticalSection
GetFileAttributesExW
CopyFileW
CreateFileW
CloseHandle
FileTimeToLocalFileTime
DeleteFileW
LocalFree
SystemTimeToFileTime
WriteFile
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetProcAddress
GetLastError
GetFileSize
GetCurrentDirectoryW
ExpandEnvironmentStringsW
CompareFileTime
MultiByteToWideChar
GetTempFileNameW
GetWindowsDirectoryW
GetFileAttributesW
FindFirstFileW
GetModuleHandleW
SetFilePointer
ReadFile
GetModuleFileNameW
LockResource
lstrcpyW
lstrlenW
FindResourceW
GlobalAlloc
GlobalUnlock
LoadResource
GetTempPathW
LoadLibraryExW
FindNextFileW
SizeofResource
GetFileTime
GlobalLock
FormatMessageW
FindClose
GetVersionExW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
SetErrorMode
ReadProcessMemory
GetCurrentProcessId
ExitProcess
GetCurrentProcess
SetCurrentDirectoryW
OpenProcess
EnumResourceTypesW
GetDiskFreeSpaceA
Sleep
MapViewOfFile
GetSystemInfo
UnmapViewOfFile
SetEndOfFile
LeaveCriticalSection
GetFileAttributesA
QueryPerformanceCounter

user32

LoadStringW
GetMessageW
PostQuitMessage
DispatchMessageW
EndDeferWindowPos
TrackPopupMenu
RegisterWindowMessageW
SetCursor
GetSysColorBrush
LoadCursorW
ChildWindowFromPoint
ShowWindow
SetDlgItemInt
SetWindowTextW
UpdateWindow
GetClientRect
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
CreateWindowExW
GetWindowRect
GetDlgItemInt
SendDlgItemMessageW
EndDialog
SetWindowLongW
GetDlgItem
InvalidateRect
LoadAcceleratorsW
PostMessageW
DefWindowProcW
TranslateAcceleratorW
SendMessageW
SetWindowPlacement
RegisterClassW
MessageBoxW
SetMenu
GetWindowPlacement
LoadImageW
LoadIconW
GetWindowLongW
SetFocus
GetMenuItemCount
CloseClipboard
CheckMenuItem
GetParent
GetCursorPos
GetSysColor
SetClipboardData
GetMenu
EnableWindow
MapWindowPoints
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
GetMenuStringW
BeginDeferWindowPos
MoveWindow
CreateDialogParamW
DestroyWindow
EnumChildWindows
SetWindowPos
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DialogBoxParamW
DestroyMenu
DrawTextExW
IsDialogMessageW
TranslateMessage

gdi32

SetBkColor
SelectObject
GetDeviceCaps
SetBkMode
DeleteObject
SetTextColor
CreateFontIndirectW
GetTextExtentPoint32W
GetStockObject

comdlg32

GetOpenFileNameW
FindTextW
GetSaveFileNameW

advapi32

RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey

shell32

SHGetPathFromIDListW
SHGetMalloc
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW

ole32

CoUninitialize
CoInitialize
CoTaskMemFree

Sections

.text
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mailpv.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mspass.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 59KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65d1b1de6af8e4cfc3f0920cb8d513df

Headers

File Characteristics

PDB Paths

Imports

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 246KB - Virtual size: 245KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 5KB - Virtual size: 11KB

.rsrc Size: 19KB - Virtual size: 19KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 64KB

UPX1 Size: 45KB - Virtual size: 48KB

.rsrc Size: 5KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 66KB - Virtual size: 66KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 11KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 80KB

UPX1 Size: 59KB - Virtual size: 60KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 76KB - Virtual size: 76KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 11KB - Virtual size: 15KB

.rsrc Size: 11KB - Virtual size: 11KB

.text
Size: 246KB - Virtual size: 245KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 5KB - Virtual size: 11KB

.rsrc
Size: 19KB - Virtual size: 19KB

UPX0
Size: - Virtual size: 64KB

UPX1
Size: 45KB - Virtual size: 48KB

.rsrc
Size: 5KB - Virtual size: 8KB

.text
Size: 66KB - Virtual size: 66KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 11KB

UPX0
Size: - Virtual size: 80KB

UPX1
Size: 59KB - Virtual size: 60KB

.rsrc
Size: 4KB - Virtual size: 8KB

.text
Size: 76KB - Virtual size: 76KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 11KB - Virtual size: 15KB

.rsrc
Size: 11KB - Virtual size: 11KB