ammyyadmin | bac69b8058800984cf42648b4580329d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

bac69b8058800984cf42648b4580329d_JaffaCakes118
Size

652KB
MD5

bac69b8058800984cf42648b4580329d
SHA1

be5017b00f9e70935b335c8cc98e197829bcce41
SHA256

2408c9b2932c10af7485c58bafde8c85e202f476bf226e973219554461918efd
SHA512

85c3f7c30da74adcd41ba82b1802556043fce2b6d1067424e4848a9c65fcd4e4459b7f8500e1a9ba4df739f9db09a95ac0775426da0ddfa7675ec0ea0f969423
SSDEEP

12288:WaA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6IilgB:qkK+waI8JRQMEJ2rufRtse9rtv8zlziA

Score

10^/10

ammyyadmin

Malware Config

Signatures

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
sample	family_ammyyadmin

Ammyyadmin family
ammyyadmin

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
bac69b8058800984cf42648b4580329d_JaffaCakes118

Files

bac69b8058800984cf42648b4580329d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ffb5ae016ce323172126d82e6bfb166f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetLastError
send
recv
shutdown
__WSAFDIsSet
accept
bind
listen
ioctlsocket
getservbyport
ntohs
gethostbyaddr
gethostbyname
getservbyname
htonl
inet_ntoa
inet_addr
socket
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
select
closesocket

gdi32

SetPixelV
GetSystemPaletteEntries
GetDIBits
GdiFlush
CombineRgn
CreateRectRgnIndirect
GetRegionData
SetStretchBltMode
CreateFontIndirectA
DPtoLP
GetDeviceCaps
GetStockObject
SetBkMode
SetBitmapBits
CreateDIBSection
DeleteDC
SetBrushOrgEx
StretchBlt
BitBlt
UpdateColors
SelectPalette
RealizePalette
CreateCompatibleBitmap
CreatePalette
CreateRectRgn
SelectClipRgn
SetBkColor
ExtTextOutA
GetBitmapBits
GetObjectA
SelectObject
SetTextColor
DeleteObject
CreateCompatibleDC

user32

FindWindowA
VkKeyScanExA
MapVirtualKeyA
GetIconInfo
SendMessageTimeoutA
SystemParametersInfoW
IntersectRect
EqualRect
OpenInputDesktop
GetUserObjectInformationA
DefWindowProcA
IsWindowVisible
EmptyClipboard
SetClipboardData
DrawIconEx
RegisterClassExA
OpenDesktopA
EnumDesktopWindows
CloseDesktop
GetDesktopWindow
MsgWaitForMultipleObjects
PeekMessageA
mouse_event
GetThreadDesktop
GetMessageA
SetTimer
MessageBoxA
wsprintfA
SetDlgItemTextA
ReleaseDC
SetThreadDesktop
keybd_event
GetCursorInfo
IsDialogMessageA
SetDlgItemInt
TranslateMessage
DispatchMessageA
GetKeyboardState
ToAsciiEx
LoadKeyboardLayoutA
DestroyAcceleratorTable
TranslateAcceleratorA
GetDC
SetDlgItemTextW
GetDlgItem
EnableWindow
EndDialog
LoadImageA
GetSubMenu
GetMenu
SetWindowLongA
CreateAcceleratorTableA
wsprintfW
ReleaseCapture
SetCapture
MoveWindow
GetAsyncKeyState
RegisterClassExW
DestroyCursor
MessageBeep
MessageBoxW
GetCursorPos
SetCursorPos
GetSystemMetrics
GetClipboardOwner
OpenClipboard
GetClipboardData
CloseClipboard
SetScrollInfo
GetFocus
GetWindow
WindowFromPoint
ScreenToClient
SetClassLongW
ChangeClipboardChain
PostQuitMessage
EnumWindows
GetClassNameA
GetWindowTextA
KillTimer
GetWindowLongW
SetRect
SetWindowPos
ShowScrollBar
IsIconic
ScrollWindowEx
SystemParametersInfoA
AdjustWindowRectEx
GetMenuState
GetWindowRect
GetWindowPlacement
SetWindowPlacement
GetSysColorBrush
RegisterClassW
DrawMenuBar
SetClipboardViewer
DrawTextA
DialogBoxIndirectParamA
DialogBoxParamA
CallWindowProcW
CallWindowProcA
DefWindowProcW
SetWindowLongW
IsWindowUnicode
GetSystemMenu
RedrawWindow
UpdateWindow
InvalidateRect
SendMessageW
CreateWindowExW
DrawStateA
DrawEdge
IsWindow
GetParent
DestroyWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
SetCursor
LoadCursorA
DestroyIcon
PostThreadMessageA
GetSysColor
CreateWindowExA
BeginPaint
EndPaint
PostMessageA
LoadIconA
GetKeyState
GetDlgItemInt
SendDlgItemMessageA
SetWindowTextW
SetMenuItemInfoW
GetMenuItemID
EnableMenuItem
GetMenuItemCount
CheckMenuItem
SetForegroundWindow
SetFocus
AppendMenuA
SetWindowTextA
ShowWindow
GetClientRect
SendMessageA
GetWindowLongA

shell32

ShellExecuteA
ShellExecuteExW
SHGetFileInfoW
SHGetFolderPathW
SHGetSpecialFolderPathW
Shell_NotifyIconA

msvcrt

_strnicmp
_strlwr
__CxxFrameHandler
strlen
isspace
memchr
_errno
strtol
isdigit
strstr
memcpy
??2@YAPAXI@Z
_purecall
_stricmp
_CxxThrowException
atol
memset
atoi
abs
sprintf
wcscmp
swprintf
wcscpy
_wtol
strcpy
iswspace
wcsncmp
wcslen
_wtoi
_ultow
wcschr
memcmp
strncpy
strchr
strcat
free
strtoul
calloc
strcmp
_ftol
wcsncpy
wcsrchr
vsprintf
vswprintf
memmove
strrchr
strncmp
mbstowcs
iswdigit
_beginthreadex
sscanf
_endthreadex
_i64tow
malloc
wcscat
time
srand
rand
exit
fprintf
_iob
getenv
floor
printf
realloc
fputc
_CIpow
_CIacos
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsrev
_wcsicmp

secur32

QuerySecurityPackageInfoA
FreeCredentialsHandle
InitializeSecurityContextA
AcquireCredentialsHandleA
FreeContextBuffer
CompleteAuthToken

setupapi

SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiClassGuidsFromNameA

advapi32

ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
SetEntriesInAclA
AllocateAndInitializeSid
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExA
SetServiceStatus
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CreateServiceW
DeleteService
ControlService
StartServiceA
RegCreateKeyExA
RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyA
InitializeSecurityDescriptor

comdlg32

GetOpenFileNameW
GetSaveFileNameW

userenv

LoadUserProfileA
UnloadUserProfile

comctl32

CreateToolbarEx
ImageList_Draw
ImageList_Add
ImageList_Create
ord17
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Destroy
_TrackMouseEvent
CreatePropertySheetPageW
PropertySheetW

wininet

HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetReadFile
InternetOpenA
HttpOpenRequestA

dsound

ord7
ord6
ord2
ord1

kernel32

FindResourceExA
SizeofResource
LoadResource
LockResource
GetLocalTime
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
SetEvent
OpenEventA
CreateEventA
ExitProcess
SetUnhandledExceptionFilter
CompareFileTime
QueryPerformanceFrequency
GetSystemDirectoryW
lstrcatW
LoadLibraryW
WaitNamedPipeW
ReadFile
SetLastError
GetExitCodeProcess
BeginUpdateResourceW
QueryPerformanceCounter
UpdateResourceA
TerminateProcess
CreateMutexA
Sleep
GetSystemDirectoryA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
FreeLibrary
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
CreateThread
GetStartupInfoW
CreateProcessW
GetVersion
MulDiv
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
LocalAlloc
GetExitCodeThread
SystemTimeToFileTime
MoveFileW
DeleteFileW
GetTempPathW
CreateFileW
FindFirstFileW
FindClose
GetUserDefaultUILanguage
GetModuleHandleA
GetProcAddress
GetLocaleInfoA
CreateFileA
DeviceIoControl
CreateDirectoryW
SetCurrentDirectoryW
SetProcessShutdownParameters
GetVersionExA
GetCurrentProcess
GetLastError
CloseHandle
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrlenW
GlobalUnlock
GlobalLock
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GetComputerNameA
GlobalAlloc
GetDriveTypeW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetLogicalDrives
GetFileTime
SetFileTime
GlobalFree
CreateDirectoryA
IsBadReadPtr
lstrcmpA
LocalFileTimeToFileTime
EndUpdateResourceW
lstrcpyA
GetCurrentDirectoryA
FindResourceA
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreA
SetThreadPriority
TlsSetValue
GetCurrentThread
TlsAlloc
ResumeThread
TlsGetValue
InterlockedExchange
GetStartupInfoA
GetSystemTimeAsFileTime

Sections

.text
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffb5ae016ce323172126d82e6bfb166f

Headers

File Characteristics

Imports

ws2_32

gdi32

user32

shell32

msvcrt

secur32

setupapi

advapi32

comdlg32

userenv

comctl32

wininet

dsound

kernel32

Sections

.text Size: 444KB - Virtual size: 443KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 76KB - Virtual size: 75KB

.rsrc Size: 72KB - Virtual size: 71KB

.text
Size: 444KB - Virtual size: 443KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 76KB - Virtual size: 75KB

.rsrc
Size: 72KB - Virtual size: 71KB