ardamax | dd614b6d42b278b8609383d88323eb57_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dd614b6d42b278b8609383d88323eb57_JaffaCakes118
Size

228KB
MD5

dd614b6d42b278b8609383d88323eb57
SHA1

84fd67334cd40d1460be85593b7259c23613fbce
SHA256

e951fe0b24942760f9533087e56e19aadd0b1d613f11ec029d3a986068d6cc91
SHA512

0b54a9099cc5759e541a5b297272ed0622a2a3999625467e3b0d342ab80d12ff4fec54ed0a647a8284ef2c6273e4dcbd2c23e4c58fecf2b0c2d581812eeeabf8
SSDEEP

3072:OlZpskT76ON4Ou8ugkiUzp9fKGbIgvpWwHuZcMxJpmJ5Tup6bTEnl1yYyRIdB+2r:IpPTxki0zPOcMxbETv/mlYhRcYvZAC

Score

10^/10

ardamax

Malware Config

Signatures

Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
sample	family_ardamax

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd614b6d42b278b8609383d88323eb57_JaffaCakes118

Files

dd614b6d42b278b8609383d88323eb57_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4495217cc00342360e6df9daeb85cfcc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenA
FtpPutFileA
InternetCloseHandle
FtpCreateDirectoryA
FtpSetCurrentDirectoryA
InternetConnectA

kernel32

LeaveCriticalSection
EnterCriticalSection
DeleteFileA
OpenFile
GetFileSize
CloseHandle
CreateFileA
SetFilePointer
WriteFile
GetSystemTimeAsFileTime
FindResourceExA
CreateToolhelp32Snapshot
Module32First
Module32Next
Process32First
Process32Next
OpenProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
CompareStringW
GetLocalTime
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetTickCount
ReadFile
OutputDebugStringA
GetComputerNameA
FormatMessageA
LocalFree
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
InitializeCriticalSection
SetLastError
TlsAlloc
TerminateProcess
IsBadWritePtr
VirtualFree
HeapCreate
RtlUnwind
ExitProcess
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapSize
HeapReAlloc
HeapDestroy
TlsFree
TlsSetValue
TlsGetValue
GetOEMCP
GetCPInfo
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
DeleteCriticalSection
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetLastError
GetModuleHandleA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryExA
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
FindResourceA
LoadResource
SizeofResource
IsDBCSLeadByte
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
CompareStringA
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
lstrcmpiA
HeapFree
RaiseException
LockResource
GetModuleFileNameA
FreeLibrary
GetCurrentProcessId
CreateThread
SetFileAttributesA
GetFileAttributesA
lstrcatA
lstrcpynA
GetProcAddress
LoadLibraryA
lstrcmpA
lstrlenA
lstrcpyA
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
ReadProcessMemory
SetEnvironmentVariableA

user32

CallNextHookEx
IsWindow
SetWindowsHookExA
DrawTextA
ReleaseDC
GetWindowDC
GetForegroundWindow
FrameRect
GetSystemMetrics
GetWindowThreadProcessId
GetKeyState
GetMessagePos
WindowFromPoint
ScreenToClient
DrawFocusRect
InvalidateRect
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
SetDlgItemInt
GetDlgItemInt
GetWindowLongA
UnhookWindowsHookEx
CreateWindowExA
DrawFrameControl
SystemParametersInfoA
GetSysColorBrush
LoadCursorA
SetCursor
GetSysColor
CharNextA
SetFocus
MessageBeep
GetParent
SetWindowPos
GetClassNameA
UpdateWindow
SetMenuItemInfoA
GetMenuItemInfoA
GetMenuItemCount
DestroyMenu
IsMenu
DestroyWindow
FillRect
MapWindowPoints
InflateRect
TrackPopupMenuEx
ModifyMenuA
GetClassInfoExA
RegisterClassExA
AdjustWindowRectEx
GetMenu
EndDialog
DialogBoxParamA
UnregisterClassA
GetFocus
PtInRect
PeekMessageA
IsWindowVisible
CharLowerA
IsWindowEnabled
DrawEdge
OffsetRect
SetWindowLongA
GetWindowTextLengthA
GetWindowTextA
CallWindowProcA
LoadIconA
LoadMenuA
GetSubMenu
CreateCursor
GetDC
SetRectEmpty
SendMessageA
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
EnableWindow
wsprintfA
KillTimer
SetTimer
UnregisterHotKey
RegisterHotKey
GetKeyNameTextA
MapVirtualKeyA
FindWindowA
SetForegroundWindow
GetCursorPos
PostQuitMessage
RegisterWindowMessageA
DestroyCursor
EndPaint
BeginPaint
GetWindowRect
MoveWindow
ScrollWindow
GetClientRect
LoadImageA
PostMessageA
GetActiveWindow
GetWindow
SetDlgItemTextA
GetDlgItemTextA
ShowWindow
GetDlgItem
SetWindowTextA
MessageBoxA
LoadStringA

gdi32

GetObjectA
CreateFontIndirectA
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
CreateDIBSection
CreateBitmap
SetBkColor
BitBlt
CreatePatternBrush
SetBrushOrgEx
SelectObject
CreateSolidBrush
SetTextColor
GetStockObject
CreateFontA
TextOutA
GetTextExtentPoint32A
SetBkMode

advapi32

RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
GetUserNameA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegQueryValueExA

shell32

SHGetPathFromIDListA
Shell_NotifyIconA
SHGetSpecialFolderLocation
ShellExecuteA

ole32

CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameA
PathRemoveFileSpecA
PathStripPathA
PathRemoveExtensionA
StrFormatByteSizeA

comctl32

ImageList_GetImageCount
ImageList_Destroy
ImageList_LoadImageA
DestroyPropertySheetPage
PropertySheetA
CreatePropertySheetPageA
ImageList_ReplaceIcon
ImageList_Create
_TrackMouseEvent
ImageList_Draw
InitCommonControlsEx

wsock32

socket
gethostbyname
ioctlsocket
connect
getservbyname
WSACleanup
WSAStartup
shutdown
closesocket
select
recv
send
htons

Sections

.text
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4495217cc00342360e6df9daeb85cfcc

Headers

File Characteristics

Imports

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wsock32

Sections

.text Size: 160KB - Virtual size: 156KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 36KB - Virtual size: 33KB

.text
Size: 160KB - Virtual size: 156KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 36KB - Virtual size: 33KB