sakula | a608a91ec75ba9dfd37d4c0e01c7858c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a608a91ec75ba9dfd37d4c0e01c7858c_JaffaCakes118
Size 3.9MB
Sample241127-fnrdlsvnhp
SHA256 43c1fc43939bfc76e72be7921eea9fae53bb5426f94df50ec02e543b44c662e9
MD5 a608a91ec75ba9dfd37d4c0e01c7858c
SHA1 c124fd5b61a3aa5428cab79f2449a93c3e69c0cd
SHA512 2664581551e97a62b0981f5f485688bfd4af18844d78da270969fb57e08a4230b35ab4adab579da35847b4d08d60b66158c99550c2339d31f17aad6a37a393c3
SSDEEP 24576:j0Xx/6oTNa1h3Qh3O+ZrIb1Eu8CTPq30pYZMmjjTjuSE5DBMYb:j+5TY76HZ68kQ0paMmjjTjzeaYb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a608a91ec75ba9dfd37d4c0e01c7858c_JaffaCakes118

File Explorer

a608a91ec75ba9dfd37d4c0e01c7858c_JaffaCakes118

.exe 3.9MB

a608a91ec75ba9dfd37d4c0e01c7858c_JaffaCakes118

IMPHASH 539502771da573641ecc7f6497e39f8f
SHA256 43c1fc43939bfc76e72be7921eea9fae53bb5426f94df50ec02e543b44c662e9
MD5 a608a91ec75ba9dfd37d4c0e01c7858c
SHA1 c124fd5b61a3aa5428cab79f2449a93c3e69c0cd
SHA512 2664581551e97a62b0981f5f485688bfd4af18844d78da270969fb57e08a4230b35ab4adab579da35847b4d08d60b66158c99550c2339d31f17aad6a37a393c3
SSDEEP 24576:j0Xx/6oTNa1h3Qh3O+ZrIb1Eu8CTPq30pYZMmjjTjuSE5DBMYb:j+5TY76HZ68kQ0paMmjjTjzeaYb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Sakula payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA ReadFile GetSystemDirectoryA MultiByteToWideChar SetThreadPriority GetTickCount GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA CreateDirectoryA ExitProcess CreateFileW GetProcessHeap SetEndOfFile HeapReAlloc GetStringTypeW LCMapStringW FlushFileBuffers WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW DecodePointer HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW HeapCreate RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize IsProcessorFeaturePresent

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Name

.text

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

YthjTtdK

Size

36KB

Virtual Size

35KB

Characteristics

Name

nZthxIkr

Size

104KB

Virtual Size

103KB

Characteristics

Name

TYERhsVL

Size

18KB

Virtual Size

18KB

Characteristics

Name

LTyKWdmL

Size

122KB

Virtual Size

121KB

Characteristics

Name

cXApKzpX

Size

166KB

Virtual Size

165KB

Characteristics

Name

OHXDivfp

Size

5KB

Virtual Size

4KB

Characteristics

Name

EADUrKCs

Size

73KB

Virtual Size

73KB

Characteristics

Name

WMzkEhJt

Size

38KB

Virtual Size

37KB

Characteristics

Name

FMeVVyMJ

Size

3KB

Virtual Size

2KB

Characteristics

Name

cDLjAPnl

Size

252KB

Virtual Size

252KB

Characteristics

Name

UAqkVkPt

Size

33KB

Virtual Size

32KB

Characteristics

Name

AAICZdzy

Size

5KB

Virtual Size

4KB

Characteristics

Name

IdHtIPFh

Size

82KB

Virtual Size

81KB

Characteristics

Name

rswxrnpN

Size

23KB

Virtual Size

23KB

Characteristics

Name

kKsQAkMH

Size

139KB

Virtual Size

139KB

Characteristics

Name

lYdLAJgH

Size

75KB

Virtual Size

74KB

Characteristics

Name

boLdeWKF

Size

512B

Virtual Size

110B

Characteristics

Name

vxvHJARj

Size

270KB

Virtual Size

270KB

Characteristics

Name

OKeqeIFb

Size

108KB

Virtual Size

107KB

Characteristics

Name

sWdCNdXo

Size

195KB

Virtual Size

194KB

Characteristics

Name

aOOumIfm

Size

44KB

Virtual Size

43KB

Characteristics

Name

ViSMaIKq

Size

124KB

Virtual Size

124KB

Characteristics

Name

wQKMzjRy

Size

21KB

Virtual Size

20KB

Characteristics

Name

KeERJrpF

Size

7KB

Virtual Size

6KB

Characteristics

Name

oJbZsuWv

Size

41KB

Virtual Size

40KB

Characteristics

Name

EeWNNVBr

Size

64KB

Virtual Size

64KB

Characteristics

Name

yCpVDjJP

Size

29KB

Virtual Size

28KB

Characteristics

Name

RBKWARaf

Size

15KB

Virtual Size

15KB

Characteristics

Name

wdRRxhZJ

Size

2KB

Virtual Size

2KB

Characteristics

Name

XOCDHLcp

Size

17KB

Virtual Size

17KB

Characteristics

Name

SSFqjgSJ

Size

39KB

Virtual Size

39KB

Characteristics

Name

EizEvGcw

Size

44KB

Virtual Size

44KB

Characteristics

Name

JdlTsRVw

Size

57KB

Virtual Size

56KB

Characteristics

Name

QrAFSlSk

Size

9KB

Virtual Size

9KB

Characteristics

Name

DrsmHyjm

Size

35KB

Virtual Size

34KB

Characteristics

Name

FMbNDdhh

Size

31KB

Virtual Size

30KB

Characteristics

Name

IhmPwwpL

Size

31KB

Virtual Size

31KB

Characteristics

Name

QCHuBcxm

Size

66KB

Virtual Size

66KB

Characteristics

Name

WhAczAlJ

Size

100KB

Virtual Size

100KB

Characteristics

Name

ZHaRwohD

Size

170KB

Virtual Size

170KB

Characteristics

Name

fWccgoMv

Size

85KB

Virtual Size

85KB

Characteristics

Name

ckHnXUHS

Size

78KB

Virtual Size

78KB

Characteristics

Name

LbZHwhqZ

Size

32KB

Virtual Size

31KB

Characteristics

Name

rwPJSCYH

Size

30KB

Virtual Size

30KB

Characteristics

Name

fDnwZvCk

Size

103KB

Virtual Size

102KB

Characteristics

Name

xquJTdei

Size

51KB

Virtual Size

50KB

Characteristics

Name

SGFRyOQs

Size

42KB

Virtual Size

41KB

Characteristics

Name

xlthyUeF

Size

44KB

Virtual Size

44KB

Characteristics

Name

cHZEsKrm

Size

47KB

Virtual Size

47KB

Characteristics

Name

bIlcqAsd

Size

4KB

Virtual Size

4KB

Characteristics

Name

vbknPSpF

Size

47KB

Virtual Size

47KB

Characteristics

Name

VWjgrFOL

Size

37KB

Virtual Size

37KB

Characteristics

Name

XAohaPuI

Size

6KB

Virtual Size

5KB

Characteristics

Name

clxNtTNS

Size

2KB

Virtual Size

2KB

Characteristics

Name

rMOCXTLm

Size

31KB

Virtual Size

31KB

Characteristics

Name

BSypJQwJ

Size

36KB

Virtual Size

35KB

Characteristics

Name

zmWALxuL

Size

54KB

Virtual Size

53KB

Characteristics

Name

ybTSPvph

Size

13KB

Virtual Size

13KB

Characteristics

Name

EnprsHUt

Size

4KB

Virtual Size

3KB

Characteristics

Name

HRFKniXC

Size

2KB

Virtual Size

2KB

Characteristics

Name

ZJUDkCPj

Size

73KB

Virtual Size

72KB

Characteristics

Name

SAIMbSjK

Size

512B

Virtual Size

135B

Characteristics

Name

BSZTKEZX

Size

10KB

Virtual Size

10KB

Characteristics

Name

KloVOCqn

Size

8KB

Virtual Size

7KB

Characteristics

Name

FFeqKPWg

Size

363KB

Virtual Size

362KB

Characteristics

Name

EkThKCAz

Size

16KB

Virtual Size

16KB

Characteristics

Name

RgNdonhV

Size

6KB

Virtual Size

6KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

a608a91ec75ba9dfd37d4c0e01c7858c_JaffaCakes118

kernel32

advapi32

shell32

wininet

generic