2854494b782e33abd74510ff8645427d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2854494b782e33abd74510ff8645427d_JaffaCakes118
Size

1.7MB
MD5

2854494b782e33abd74510ff8645427d
SHA1

f2d25c1a9578d63e3ea29119ce123fd4f7957861
SHA256

0d6025d623510a7614f5c43679d9a1e3898b6992709ebc6ed27346a2b50c55ea
SHA512

7c10e003dc64d32202194c1ff1d80710fb75295aacb9fd281c3b11bf53f653a1e7f07c7220bd7b483b2a6254ba7d33cdd7cbcf2c0ba74f2e51a8c362913047d1
SSDEEP

24576:givhr5xlvrwx7UehYF19XXvDkqJL4ytleIRW7ygCfrtYr2n6jBnLyHwbsVJuB+wt:gwrrlsx7LUD1/e0wL6rO6ne9bOAB54GH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/dsi_avb.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/dsi_avb.exe
unpack003/out.upx
unpack001/avbrospuzzlepro12.exe

Files

2854494b782e33abd74510ff8645427d_JaffaCakes118
.zip
AV Bros Puzzle Pro KeyGen.zip
.zip
dsi_avb.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 140KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
avbrospuzzlepro12.exe
.exe windows:4 windows x86 arch:x86

54d4061255ed0736af49534fee5700e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
GetProcessVersion
GlobalFlags
SetErrorMode
GetCPInfo
LocalReAlloc
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
TlsFree
TlsSetValue
ExitProcess
GlobalReAlloc
HeapReAlloc
TerminateProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetACP
HeapSize
HeapDestroy
HeapCreate
VirtualFree
GetStartupInfoA
GetCommandLineA
RaiseException
FreeEnvironmentStringsA
FreeEnvironmentStringsW
LocalAlloc
GlobalHandle
GetVolumeInformationA
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
FreeLibrary
GetDiskFreeSpaceA
Sleep
GetWindowsDirectoryA
FatalAppExitA
FindResourceA
LoadResource
LockResource
GetProfileStringA
TlsAlloc
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
InitializeCriticalSection
FileTimeToLocalFileTime
GlobalGetAtomNameA
GetVersion
lstrcatA
WritePrivateProfileStringA
GlobalAddAtomA
GlobalFindAtomA
GlobalFree
lstrcmpA
GlobalAlloc
GlobalDeleteAtom
GlobalLock
GetCurrentThread
GetCurrentThreadId
GetModuleHandleA
GlobalUnlock
MulDiv
LocalFree
GetFileAttributesA
GetFileTime
GetFileSize
lstrcmpiA
GetModuleFileNameA
GetFullPathNameA
GetEnvironmentStrings
FindFirstFileA
FindClose
SizeofResource
lstrcpyA
SetEndOfFile
UnlockFile
LockFile
CloseHandle
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetCurrentProcess
DuplicateHandle
lstrcpynA
SetLastError
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetLogicalDrives
CreateDirectoryA
GetLastError
GetEnvironmentStringsW
SetHandleCount
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter

user32

DefWindowProcA
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
AdjustWindowRectEx
GetSysColor
MapWindowPoints
UpdateWindow
LoadStringA
LoadCursorA
GetSysColorBrush
GetClassNameA
PtInRect
DestroyMenu
InvalidateRect
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
RegisterWindowMessageA
OffsetRect
SystemParametersInfoA
GetWindowPlacement
EndDialog
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetMessageA
TranslateMessage
DispatchMessageA
CallNextHookEx
ValidateRect
PeekMessageA
SetWindowsHookExA
SetCursor
PostQuitMessage
PostMessageA
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgCtrlID
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
IsDialogMessageA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
MessageBoxA
CharUpperA
wsprintfA
UnhookWindowsHookEx
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetCursorPos
WindowFromPoint
GetParent
EnableWindow
SetTimer
KillTimer
IsIconic
GetSystemMetrics
DrawIcon
SetClassLongA
GetWindowRect
SetWindowRgn
LoadIconA
IsRectEmpty
IsWindowVisible
CopyRect
IntersectRect
GetClientRect
GetDC
ReleaseDC
SendMessageA
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
GetActiveWindow
GetKeyState
SendDlgItemMessageA
MoveWindow
InflateRect
DefDlgProcA
UnregisterClassA
HideCaret
ShowCaret
DrawFocusRect
IsWindowUnicode
CharNextA
ExcludeUpdateRgn

gdi32

GetDeviceCaps
CombineRgn
CreateRectRgn
CreateSolidBrush
CreateCompatibleBitmap
CreateBitmap
DeleteDC
SaveDC
RestoreDC
SelectObject
GetStockObject
SetBkColor
SetBkMode
SetTextColor
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
GetClipBox
ScaleWindowExtEx
IntersectClipRect
CreateCompatibleDC
CreateDIBSection
PtVisible
TextOutA
ExtTextOutA
RectVisible
GetObjectA
Escape
CreateDIBitmap
GetTextExtentPointA
DeleteObject
CreatePolygonRgn
BitBlt
PatBlt

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc

comctl32

ord17

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 228KB

UPX1 Size: 140KB - Virtual size: 144KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

CODE Size: 267KB - Virtual size: 267KB

DATA Size: 3KB - Virtual size: 3KB

BSS Size: - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 7KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 18KB - Virtual size: 18KB

.rsrc Size: 39KB - Virtual size: 39KB

54d4061255ed0736af49534fee5700e0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

ole32

Sections

.text Size: 164KB - Virtual size: 162KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 16KB - Virtual size: 29KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

UPX0
Size: - Virtual size: 228KB

UPX1
Size: 140KB - Virtual size: 144KB

.rsrc
Size: 4KB - Virtual size: 8KB

CODE
Size: 267KB - Virtual size: 267KB

DATA
Size: 3KB - Virtual size: 3KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 7KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 39KB - Virtual size: 39KB

.text
Size: 164KB - Virtual size: 162KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 16KB - Virtual size: 29KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB