1353146c598262400e9160c179a8d02e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1353146c598262400e9160c179a8d02e_JaffaCakes118
Size

48KB
MD5

1353146c598262400e9160c179a8d02e
SHA1

257207eb965491f54f64d8eafc8d5c777cba481b
SHA256

5192c4ce75679ed482a6e52b201a063fa84e212336ebf0bad5decda28bed858b
SHA512

57b72bbfe1bb078d0e214f9bc74a631bdfb990d93560c3da33a561d7065c1d5c9b7f470c87a78431b4a8c9608ec3716432f74d9248750a162e76b878ec944512
SSDEEP

384:hIeqht6JKMvXAXTN7GIB850LuVFZjUPp9OnCFBS5rRqQc0YfrBzxM4witMQemKTV:It64+XAd82sFXAUl+xMffufg7

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1353146c598262400e9160c179a8d02e_JaffaCakes118

Files

1353146c598262400e9160c179a8d02e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

56b84c8fdd9b4bbd0589259fb7a2a024

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

WriteProcessMemory
WinExec
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
TerminateProcess
Sleep
SetSystemTime
SetFilePointer
ReadProcessMemory
ReadFile
OpenProcess
OpenFileMappingA
MoveFileExA
MapViewOfFile
LoadLibraryA
GlobalFindAtomA
GetWindowsDirectoryA
GetThreadLocale
GetTempPathA
GetSystemTime
GetStdHandle
GetProcessHeap
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetCurrentProcess
GetComputerNameA
FindFirstFileA
FindClose
DeleteFileA
CreateThread
CreateProcessA
CreateMutexA
CreateFileA
CompareStringA
CloseHandle
GetCurrentThreadId
ExitProcess
UnhandledExceptionFilter
RtlUnwind
RaiseException
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap

advapi32

RegSetValueExA
RegSaveKeyA
RegRestoreKeyA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyExA
RegCreateKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

urlmon

URLDownloadToFileA

user32

UnhookWindowsHookEx
ShowWindow
SetWindowsHookExA
SetThreadDesktop
SendMessageA
PostThreadMessageA
IsWindow
IsMenu
IsDlgButtonChecked
GetWindowThreadProcessId
GetWindowRgn
GetMessageA
GetMenuState
GetInputState
GetForegroundWindow
GetDlgItem
GetClassNameA
GetCaretBlinkTime
FindWindowExA
FindWindowA
CreateDesktopA
CloseDesktop
CallNextHookEx

winmm

timeKillEvent
timeSetEvent

wsock32

WSACleanup
WSAStartup
gethostbyname
socket
send
recv
htons
connect
closesocket

Exports

Exports

tl_ksHook
tl_tzHook

Sections

UPX0
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

56b84c8fdd9b4bbd0589259fb7a2a024

Headers

File Characteristics

Imports

kernel32

advapi32

urlmon

user32

winmm

wsock32

Exports

Exports

Sections

UPX0 Size: 44KB - Virtual size: 44KB

.rsrc Size: 1024B - Virtual size: 4KB

.avc Size: 2KB - Virtual size: 4KB

UPX0
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 1024B - Virtual size: 4KB

.avc
Size: 2KB - Virtual size: 4KB