ardamax | 237ee27dfb8638589cbb8730bae98e98_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

237ee27dfb8638589cbb8730bae98e98_JaffaCakes118
Size

540KB
MD5

237ee27dfb8638589cbb8730bae98e98
SHA1

f862bcc281590f347a5b9659f99b5d54a3f3b7be
SHA256

c580f1437a5bfd8d6bb7ffb7ca6b0e560ec8453c4a6ce356b19429a09c0bd653
SHA512

0537519a30bc704a6029fe6cf1d9c9db2930db94efa13017c91c34d3e3eeb4431f87ee54a01cea4a7e5d6e9e65b547ad510aa60fca7fc6c0993b976c319f2441
SSDEEP

6144:lNOM9kpW7eCoPn8OXPXFli5bL/vlObEtpRxqbXuZDy/qV5N8TtAfM8:laceCoPnD9lO/NBzRSurB

Score

10^/10

ardamax

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
237ee27dfb8638589cbb8730bae98e98_JaffaCakes118

Files

237ee27dfb8638589cbb8730bae98e98_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7abe063625d77267a1c6705f52c45587

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlUnescapeW
StrCmpIW
StrFormatByteSizeW
PathStripPathW
PathRemoveFileSpecW
PathFileExistsW
PathRemoveExtensionW
PathFindExtensionW
StrDupW
PathFindFileNameW

ws2_32

recv
send
WSAStartup
htons
WSACleanup
getservbyname
inet_addr
gethostbyname
socket
closesocket
shutdown
select
connect

comctl32

_TrackMouseEvent
ImageList_Create
ImageList_LoadImageW
ImageList_Destroy
CreatePropertySheetPageW
ImageList_GetImageCount
InitCommonControlsEx
PropertySheetW
DestroyPropertySheetPage
ImageList_Draw
ImageList_ReplaceIcon

shell32

SHChangeNotify
ShellExecuteW
ShellExecuteExW
ExtractIconW
DoEnvironmentSubstW
SHFileOperationW
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetSpecialFolderLocation

wininet

InternetGetLastResponseInfoW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpDeleteFileW
FtpSetCurrentDirectoryW
InternetConnectW
InternetOpenW
InternetCloseHandle
FtpPutFileW

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

LCMapStringW
GetThreadLocale
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
LeaveCriticalSection
DeleteFileW
lstrlenA
InitializeCriticalSection
SetLastError
lstrcpyA
SetProcessWorkingSetSize
CreateMutexW
lstrcmpiW
GetCurrentProcess
lstrcmpA
GetLastError
EnterCriticalSection
GetDateFormatW
RaiseException
VirtualAlloc
lstrcmpW
VirtualFree
CompareStringW
InterlockedIncrement
GetUserDefaultLangID
GetModuleHandleW
CreateThread
GlobalLock
GetProcAddress
SetThreadPriority
SizeofResource
GlobalUnlock
ResumeThread
InterlockedDecrement
LoadResource
LoadLibraryW
GetLocalTime
FindResourceW
GetVersion
SystemTimeToFileTime
LoadLibraryExW
MultiByteToWideChar
GetSystemTimeAsFileTime
CompareFileTime
FindResourceExW
GetVersionExW
WideCharToMultiByte
lstrcpynW
lstrcatW
FlushInstructionCache
FreeLibrary
GetModuleFileNameW
OpenProcess
RemoveDirectoryW
GetShortPathNameW
DeleteCriticalSection
lstrcpyW
CreateDirectoryW
GetEnvironmentVariableW
LockResource
SetFileAttributesW
SetPriorityClass
Sleep
GetCurrentThread
SetProcessPriorityBoost
MoveFileExW
CloseHandle
lstrlenW
ExitProcess
GetCurrentThreadId
CreateFileW
WriteFile
GetCurrentProcessId
EnumResourceNamesW
LocalAlloc
LocalReAlloc
ReadFile
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetFilePointer
LocalFree
FormatMessageW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
OutputDebugStringW
GetTimeZoneInformation
GetComputerNameW
lstrcmpiA
GetTimeFormatW
GetTickCount
CopyFileW
GetTempFileNameW
GetTempPathW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesW
MoveFileW
HeapReAlloc
HeapAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetProcessHeap
GetStartupInfoW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
HeapDestroy
HeapCreate
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
InterlockedExchange
LoadLibraryA
RtlUnwind
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
VirtualQuery
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

user32

GetClientRect
SendMessageW
WindowFromPoint
UnhookWindowsHookEx
OpenClipboard
SetWindowLongW
DdeInitializeW
GetMessagePos
FrameRect
PeekMessageW
DdeCreateStringHandleW
DdeConnect
MessageBeep
PtInRect
DdeClientTransaction
GetClipboardData
DdeAccessData
OffsetRect
GetFocus
ScrollWindow
DrawEdge
DestroyWindow
ReleaseDC
SetWindowTextW
DispatchMessageW
MoveWindow
CloseClipboard
EnableWindow
DdeDisconnect
TranslateMessage
SetCursor
EndDialog
DdeFreeStringHandle
IsWindow
CharNextW
TrackPopupMenuEx
GetActiveWindow
DdeUninitialize
GetMessageW
LoadCursorW
GetWindowRect
PostQuitMessage
GetMonitorInfoW
ModifyMenuW
MonitorFromPoint
CopyRect
CheckMenuItem
GetSysColorBrush
ShowWindow
RegisterWindowMessageW
GetWindowThreadProcessId
CallNextHookEx
DrawTextW
GetSubMenu
SystemParametersInfoW
GetDC
GetWindowModuleFileNameW
GetKeyState
SetWindowsHookExW
MessageBoxW
DestroyIcon
IsMenu
GetClassLongW
SetTimer
GetCursorPos
BeginPaint
DestroyMenu
GetDlgCtrlID
GetDesktopWindow
SetWindowPos
GetWindowLongW
IsClipboardFormatAvailable
GetDlgItem
GetAncestor
IsWindowVisible
GetForegroundWindow
DrawFocusRect
EndPaint
CreateWindowExW
GetClassNameW
GetWindowDC
GetMenu
DefWindowProcW
GetMenuItemCount
InflateRect
GetDlgItemTextW
DeleteMenu
DialogBoxParamW
GetWindow
AdjustWindowRectEx
EnumWindows
GetMenuItemInfoW
DrawFrameControl
PostMessageW
SetForegroundWindow
SetRectEmpty
GetSystemMetrics
LoadMenuW
SetMenuItemInfoW
ReleaseCapture
SendMessageTimeoutW
InvalidateRect
GetCapture
SetFocus
IsWindowEnabled
GetSysColor
LoadIconW
UpdateWindow
FindWindowW
CallWindowProcW
SetCapture
MapVirtualKeyW
GetKeyNameTextW
wsprintfW
UnregisterClassA
LoadImageW
RegisterClassExW
MapWindowPoints
FillRect
RegisterHotKey
TrackPopupMenu
SetDlgItemTextW
GetParent
GetWindowTextW
ChangeClipboardChain
ScreenToClient
SetDlgItemInt
GetWindowTextLengthW
SetClipboardViewer
CharLowerW
GetDlgItemInt
UnregisterHotKey
GetClassInfoExW
KillTimer

gdi32

SetBkColor
CreateRectRgnIndirect
BitBlt
SelectObject
GetObjectW
CreateFontIndirectW
GetTextExtentPoint32W
Polygon
DeleteObject
DeleteDC
TextOutW
ExcludeClipRect
GetDIBits
CreateBitmap
RealizePalette
CombineRgn
SetPolyFillMode
SetBkMode
CreateFontW
CreatePen
CreateCompatibleBitmap
GetTextMetricsW
SetTextColor
CreatePatternBrush
CreateSolidBrush
SetBrushOrgEx
PatBlt
GetStockObject
CreateDIBSection
CreateCompatibleDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize

oleaut32

SysFreeString
VarUI4FromStr

Sections

.text
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7abe063625d77267a1c6705f52c45587

Headers

File Characteristics

Imports

shlwapi

ws2_32

comctl32

shell32

wininet

mpr

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

Sections

.text Size: 365KB - Virtual size: 365KB

.rdata Size: 54KB - Virtual size: 54KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 110KB - Virtual size: 110KB

.text
Size: 365KB - Virtual size: 365KB

.rdata
Size: 54KB - Virtual size: 54KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 110KB - Virtual size: 110KB