ardamax | 3cfc021fc0ac08a93c07914e0bee61b7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3cfc021fc0ac08a93c07914e0bee61b7_JaffaCakes118
Size

475KB
MD5

3cfc021fc0ac08a93c07914e0bee61b7
SHA1

600104fd3da32bbb3042838f2b49063a7018aadc
SHA256

6f23ca0726d1cc6d0949fcc977c185471a52ea455667fe0d8b2c6fe4f8ba1810
SHA512

bca460f934a5ab1d98cfe0f9e9e8dff8c8b1334564e765175d00f8241a4fb49e12973b365334a510efcf7bd1aaf45302e4b26ff68c61a447928a5a22dfe642be
SSDEEP

6144:YFnklflL4oruT1bl3zquTRYztOf+Hy/qVFNcuUAL:xlfA1IGRYMCL

Score

10^/10

ardamax

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cfc021fc0ac08a93c07914e0bee61b7_JaffaCakes118

Files

3cfc021fc0ac08a93c07914e0bee61b7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0d2ac63c04cf516c4b8588c9a608a804

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

UrlUnescapeW
StrCmpIW
StrDupW
PathRemoveExtensionW
PathStripPathW
PathFindExtensionW
PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW
StrFormatByteSizeW

ws2_32

recv
select
closesocket
shutdown
connect
inet_addr
socket
gethostbyname
WSAStartup
htons
WSACleanup
getservbyname
send

comctl32

InitCommonControlsEx
ImageList_Draw
ImageList_Create
ImageList_ReplaceIcon
CreatePropertySheetPageW
PropertySheetW
DestroyPropertySheetPage
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetImageCount
_TrackMouseEvent

shell32

SHChangeNotify
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW
ExtractIconW
DoEnvironmentSubstW
ShellExecuteW

wininet

FtpSetCurrentDirectoryW
FtpDeleteFileW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpPutFileW
InternetCloseHandle
InternetGetLastResponseInfoW
InternetOpenW
InternetConnectW

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

GetStringTypeW
IsProcessorFeaturePresent
InterlockedCompareExchange
GetThreadLocale
SetEnvironmentVariableA
lstrcpyW
lstrlenW
CreateFileW
lstrcmpW
DeleteFileW
SetLastError
GetModuleHandleW
GetProcAddress
lstrlenA
lstrcpyA
lstrcmpA
LoadLibraryW
GetVersion
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
CloseHandle
WriteFile
lstrcmpiW
GetDateFormatW
FindResourceExW
Sleep
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
OpenProcess
SetProcessWorkingSetSize
GetCurrentProcess
GlobalLock
GlobalUnlock
lstrcpynW
GetFileAttributesW
SetFileAttributesW
CreateThread
SetThreadPriority
ResumeThread
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetModuleFileNameW
GetShortPathNameW
GetEnvironmentVariableW
lstrcatW
SetPriorityClass
GetCurrentThread
SetProcessPriorityBoost
MoveFileExW
ExitProcess
GetCurrentProcessId
CreateMutexW
GetLastError
InitializeCriticalSection
RaiseException
FlushInstructionCache
LockResource
InterlockedIncrement
InterlockedDecrement
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
DeleteCriticalSection
CompareStringW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
EnumResourceNamesW
LocalAlloc
LocalReAlloc
ReadFile
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetFilePointer
LocalFree
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FormatMessageW
GetTimeZoneInformation
GetTimeFormatW
GetTickCount
OutputDebugStringW
GetComputerNameW
lstrcmpiA
CopyFileW
GetTempFileNameW
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
MoveFileW
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetProcessHeap
GetStartupInfoW
HeapDestroy
HeapCreate
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
LoadLibraryA
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
VirtualQuery
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA

user32

DestroyIcon
EndDialog
RegisterWindowMessageW
GetAncestor
SendMessageTimeoutW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
GetWindowThreadProcessId
GetWindowModuleFileNameW
GetDlgCtrlID
IsWindowVisible
GetClassNameW
GetWindow
EnumWindows
SetClipboardViewer
ChangeClipboardChain
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
IsWindow
PostQuitMessage
GetCursorPos
SetForegroundWindow
FindWindowW
RegisterHotKey
UnregisterHotKey
GetDesktopWindow
GetForegroundWindow
GetWindowDC
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
DrawFocusRect
SetRectEmpty
DeleteMenu
CheckMenuItem
GetSubMenu
LoadMenuW
LoadIconW
CallWindowProcW
DialogBoxParamW
InvalidateRect
SetWindowPos
GetMenu
AdjustWindowRectEx
RegisterClassExW
GetClassInfoExW
DestroyWindow
IsMenu
DestroyMenu
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
UpdateWindow
GetParent
MessageBeep
LoadStringW
CharNextW
DrawTextW
GetClassLongW
SetWindowLongW
ReleaseDC
GetDlgItem
LoadCursorW
GetSysColorBrush
SystemParametersInfoW
GetWindowLongW
InflateRect
DrawFrameControl
CreateWindowExW
SetDlgItemInt
ReleaseCapture
GetCapture
SetCapture
ScreenToClient
WindowFromPoint
GetMessagePos
GetKeyState
FrameRect
OffsetRect
DrawEdge
IsWindowEnabled
CharLowerW
PeekMessageW
PtInRect
GetFocus
ModifyMenuW
TrackPopupMenuEx
GetMonitorInfoW
MonitorFromPoint
MapWindowPoints
FillRect
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
wsprintfW
MapVirtualKeyW
GetKeyNameTextW
UnregisterClassA
CopyRect
GetSystemMetrics
GetSysColor
TrackPopupMenu
MessageBoxW
ShowWindow
EndPaint
BeginPaint
GetWindowRect
MoveWindow
ScrollWindow
GetClientRect
LoadImageW
PostMessageW
KillTimer
GetDlgItemTextW
SetFocus
GetDlgItemInt
SetDlgItemTextW
SetWindowTextW
EnableWindow
GetActiveWindow
GetDC
SetTimer
SetCursor

gdi32

GetObjectW
CreateFontIndirectW
DeleteObject
PatBlt
CreateDIBSection
CreateCompatibleDC
SetBkColor
BitBlt
DeleteDC
CreateCompatibleBitmap
CreatePatternBrush
SetBrushOrgEx
GetDIBits
CreatePen
RealizePalette
CreateBitmap
GetTextMetricsW
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
SetTextColor
GetStockObject
CreateSolidBrush
CreateFontW
TextOutW
Polygon
SetPolyFillMode
SetBkMode
SelectObject
GetTextExtentPoint32W

comdlg32

GetSaveFileNameW
GetOpenFileNameW

ole32

CoTaskMemRealloc
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree

oleaut32

VarUI4FromStr
DispCallFunc
VariantInit
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringLen
VariantClear

Sections

.text
Size: 358KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d2ac63c04cf516c4b8588c9a608a804

Headers

File Characteristics

Imports

shlwapi

ws2_32

comctl32

shell32

wininet

mpr

kernel32

user32

gdi32

comdlg32

ole32

oleaut32

Sections

.text Size: 358KB - Virtual size: 358KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 19KB

.rsrc Size: 47KB - Virtual size: 47KB

.text
Size: 358KB - Virtual size: 358KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 47KB - Virtual size: 47KB