282bf710a0ca864a0f1555a630cf17e4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

282bf710a0ca864a0f1555a630cf17e4_JaffaCakes118
Size

124KB
MD5

282bf710a0ca864a0f1555a630cf17e4
SHA1

b1bd5ce3e09684b9509655ec53029f0452c66b22
SHA256

d447223b0da37e09559f24a65ccb69066f9791e2aec6d79f8d38ac3c20b71163
SHA512

1cd1f578f7886f000745e5be31e15045f5f3ac6c1b208c79ba5a0717260c110f25097519038f902c0bcd7076ffc190116ba9b59e5e1aad0c7072bc3e89bd89e2
SSDEEP

3072:1dH0dhGT7br0zcgHieX3/SqRXSCftsE5eJD:1dAhq7izHb3/SqYCftVeV

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
282bf710a0ca864a0f1555a630cf17e4_JaffaCakes118

Files

282bf710a0ca864a0f1555a630cf17e4_JaffaCakes118
.exe windows:6 windows x86 arch:x86

0b1d972c1276383c9bd98a78f7c28bed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

chkntfs.pdb

Imports

kernel32

SetErrorMode
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
UnhandledExceptionFilter

msvcrt

__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__getmainargs
exit
_controlfp
_except_handler4_common
_wcsicmp
?terminate@@YAXXZ

ulib

?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
?Initialize@MULTIPLE_PATH_ARGUMENT@@QAEEPADEE@Z
??1ARRAY@@UAE@XZ
?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z
?Initialize@STRING_ARGUMENT@@QAEEPAD@Z
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@PROGRAM@@QAEEKKK@Z
??0LONG_ARGUMENT@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
?Initialize@CLASS_DESCRIPTOR@@QAEEXZ
??0CLASS_DESCRIPTOR@@QAE@XZ
?PutSeparators@ARGUMENT_LEXEMIZER@@QAEXPBD@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?GetLexeme@ARGUMENT@@QAEPAVWSTRING@@XZ
?IsValueSet@ARGUMENT@@QAEEXZ
??0DSTRING@@QAE@XZ
??0PATH@@QAE@XZ
??1PATH@@UAE@XZ
?AnalyzePath@PATH@@QAE?AW4PATH_ANALYZE_CODE@@PAVWSTRING@@PAV1@0@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?QueryDriveType@SYSTEM@@SG?AW4DRIVE_TYPE@@PBVWSTRING@@@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
?QueryString@WSTRING@@QBEPAV1@KK@Z
??1DSTRING@@UAE@XZ
??1OBJECT@@UAE@XZ
??1MULTIPLE_PATH_ARGUMENT@@UAE@XZ
??1PROGRAM@@UAE@XZ
?ValidateVersion@PROGRAM@@UBEXKK@Z
?Usage@PROGRAM@@UBEXXZ
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
??1ARGUMENT_LEXEMIZER@@UAE@XZ
??1STRING_ARGUMENT@@UAE@XZ
?GetStandardError@PROGRAM@@UAEPAVSTREAM@@XZ
?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ
?GetStandardInput@PROGRAM@@UAEPAVSTREAM@@XZ
?Fatal@PROGRAM@@UBEXXZ
?Fatal@PROGRAM@@UBAXKKPADZZ
?DisplayMessage@PROGRAM@@UBEEKW4MESSAGE_TYPE@@@Z
?DisplayMessage@PROGRAM@@UBAEKW4MESSAGE_TYPE@@PADZZ
?Compare@OBJECT@@UBEJPBV1@@Z
??0PROGRAM@@IAE@XZ
??0MULTIPLE_PATH_ARGUMENT@@QAE@XZ
?Initialize@WSTRING@@QAEEPBDK@Z
?Initialize@LONG_ARGUMENT@@QAEEPAD@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

ifsutil

?IsVolumeDirty@IFS_SYSTEM@@SGEPAVWSTRING@@PAE1PAJ@Z
?PushEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@0@Z
?QueryFileSystemName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@PAJ1@Z
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
??0MOUNT_POINT_TUPLE@@QAE@XZ
?Initialize@MOUNT_POINT_MAP@@QAEEXZ
?SetAutochkTimeOut@VOL_LIODPDRV@@SGEK@Z
?QueryAutochkTimeOut@VOL_LIODPDRV@@SGEPAK@Z
??1MOUNT_POINT_MAP@@UAE@XZ
??1DP_DRIVE@@UAE@XZ
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@E@Z
??0DP_DRIVE@@QAE@XZ
??0MOUNT_POINT_MAP@@QAE@XZ
?IsFrontEndPresent@AUTOREG@@SGEPBVWSTRING@@0@Z

ntdll

RtlAllocateHeap
RtlFreeHeap

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 870B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.UPX0
Size: 108KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0b1d972c1276383c9bd98a78f7c28bed

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

ulib

ifsutil

ntdll

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 896B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 870B

.UPX0 Size: 108KB - Virtual size: 260KB

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 896B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 870B

.UPX0
Size: 108KB - Virtual size: 260KB