JaffaCakes118_6dca5aec6e03722eef22d843bdb637ba

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_6dca5aec6e03722eef22d843bdb637ba
Size

212KB
MD5

6dca5aec6e03722eef22d843bdb637ba
SHA1

e0b6ce29fc0744188a7e9733be8c11063801506e
SHA256

46c9fd7564fb13697c91dcbbb8474aac921dcb5437f3563417f23d64a89f970d
SHA512

34de8d38f4438051d434fde9d3b6bdce5a47cc4da906618c5d21af223bb611ad6c1e40fa5640fb1b49bfc4d93a2968d8fa454c1fb38feae85089ab7fc8a3c0da
SSDEEP

6144:OYAUWh6S9N95hQDku5CFfqxCsEsZttcSZt:O6IX2MQdZttdZt

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_6dca5aec6e03722eef22d843bdb637ba

Files

JaffaCakes118_6dca5aec6e03722eef22d843bdb637ba
.exe windows:4 windows x86 arch:x86

54e865e60a8f78ac04d57e4b36bb7d88

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strcat
strcmp
free
_except_handler3
strrchr
rename
_iob
atoi
_errno
wcscpy
strtok
vsprintf
strncat
memset
rand
_beginthreadex
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
malloc
strcpy
memcmp
strlen
_ftol
memmove
_CxxThrowException
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
calloc
_strupr

ws2_32

getpeername
bind
getsockname
inet_addr
inet_ntoa
recv
send
select
closesocket
ntohs
socket
gethostbyname
htons
connect
setsockopt
WSACleanup
accept
listen
WSAStartup
sendto
gethostname
__WSAFDIsSet

msvcp60

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

kernel32

GetProcessHeap
CreateEventA
GetLocalTime
Sleep
GlobalFree
WriteFile
RemoveDirectoryA
LocalAlloc
GetDriveTypeA
OutputDebugStringA
ReleaseMutex
lstrcmpA
SetErrorMode
GetModuleHandleA
GetStartupInfoA
CreateProcessA
CreateDirectoryA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetPrivateProfileSectionNamesA
SetEvent
lstrcpyA
VirtualAlloc
VirtualFree
CloseHandle
LoadLibraryA
GetProcAddress

user32

PostMessageA
CreateWindowExA
CloseWindow
SendMessageA
IsWindow
GetSystemMetrics
OpenClipboard
SetClipboardData
GetThreadDesktop
SetCursorPos
WindowFromPoint
SetCapture
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
CharNextA
IsWindowVisible
GetWindowThreadProcessId
LoadCursorA
GetCursorPos
SetRect
ReleaseDC
CloseClipboard

advapi32

RegOpenKeyExA
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
RegCloseKey
RegQueryValueA
RegSetValueExA
RegCreateKeyExA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyA
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
LookupAccountSidA
GetTokenInformation

gdi32

CreateDIBSection
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
DeleteDC
DeleteObject

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

msvfw32

ICSeqCompressFrameEnd
ICSendMessage

Sections

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54e865e60a8f78ac04d57e4b36bb7d88

Headers

File Characteristics

Imports

msvcrt

ws2_32

msvcp60

kernel32

user32

advapi32

gdi32

shell32

msvfw32

Sections

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 156KB - Virtual size: 157KB

.rsrc Size: 40KB - Virtual size: 40KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 156KB - Virtual size: 157KB

.rsrc
Size: 40KB - Virtual size: 40KB