flagpro | 1b39dcc5de43d2840d6992a561e34eec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1b39dcc5de43d2840d6992a561e34eec_JaffaCakes118
Size 532KB
Sample240329-hfrerabg7t
SHA256 e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876
MD5 1b39dcc5de43d2840d6992a561e34eec
SHA1 abb567aadfbd5686b3fbed027dc297646e6bbf04
SHA512 1a63c915bf4a829bf3fdb50fdf8cd1dbdeebe0fc6265d5c45ed3eeec43be44f857aac7008c7ae453c0f859efa660ed4e77fb76ec9b83e5b5d5effd3bd4c0bdcb
SSDEEP 12288:f3kUNnIL4Qyva9myMBBWRb4omnOlydGuGEViW9bLMe:veL45a9c9oCOlydEU9nl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

downloader infostealer flagpro

Malware Config

Signatures

Detect Flagpro 1 IoCs

Detect FlagPro Stealer.

downloader infostealer

resource	yara_rule
sample	family_flagpro

Flagpro family
flagpro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b39dcc5de43d2840d6992a561e34eec_JaffaCakes118

File Explorer

1b39dcc5de43d2840d6992a561e34eec_JaffaCakes118

.exe 532KB

1b39dcc5de43d2840d6992a561e34eec_JaffaCakes118

IMPHASH 178d6f72c77b3a7784c0027a6bb97e64
SHA256 e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876
MD5 1b39dcc5de43d2840d6992a561e34eec
SHA1 abb567aadfbd5686b3fbed027dc297646e6bbf04
SHA512 1a63c915bf4a829bf3fdb50fdf8cd1dbdeebe0fc6265d5c45ed3eeec43be44f857aac7008c7ae453c0f859efa660ed4e77fb76ec9b83e5b5d5effd3bd4c0bdcb
SSDEEP 12288:f3kUNnIL4Qyva9myMBBWRb4omnOlydGuGEViW9bLMe:veL45a9c9oCOlydEU9nl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Flagpro

Detect FlagPro Stealer.

downloader infostealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

174574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx GetFileTime MoveFileA HeapFree HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree GetTempPathW CreateMutexA GetCPInfo GetFileAttributesW GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount GetTimeZoneInformation LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA GetStartupInfoW MultiByteToWideChar InterlockedCompareExchange CreatePipe LockResource LoadLibraryA GetProcAddress FileTimeToLocalFileTime SetErrorMode lstrlenA CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc FileTimeToSystemTime GetThreadLocale InterlockedIncrement GlobalFlags EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection GlobalFindAtomW GetVersionExW CompareStringW GetVersionExA FormatMessageW LocalFree MulDiv GetModuleHandleA GlobalUnlock FreeResource GlobalFree WritePrivateProfileStringW GlobalAddAtomW SetLastError GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc FreeLibrary GetModuleHandleW GetModuleFileNameW lstrlenW RaiseException DeleteFileA GetCurrentProcessId DeleteFileW GetACP CloseHandle GetSystemTimeAsFileTime GetLastError ReadFile TerminateProcess SizeofResource Sleep WideCharToMultiByte GetTickCount InterlockedDecrement CreateProcessW LoadResource FindResourceW FindResourceExW QueryPerformanceCounter GetTempFileNameW

user32

PostThreadMessageW MessageBeep GetNextDlgGroupItem CharUpperW CharNextW InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW GetSysColorBrush ReleaseCapture FindWindowExW GetWindowLongW SendMessageA FindWindowW PostMessageW EnableWindow SendMessageW GetSystemMetrics AppendMenuW GetClientRect IsIconic GetSystemMenu CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW GetParent GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps RegisterWindowMessageW PostQuitMessage SetCursor MessageBoxW IsWindowEnabled RegisterClipboardFormatW GetWindowThreadProcessId SetWindowPos MapDialogRect SetWindowContextHelpId GetWindow ValidateRect GetCursorPos PeekMessageW UnregisterClassW LoadCursorW SetCapture ShowWindow MoveWindow SetWindowTextW IsDialogMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetLastActivePopup UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect DestroyMenu CopyRect GetMenuItemID GetMenuItemCount GetSubMenu GetSysColor EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState

advapi32

CredFree RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey CredEnumerateA

ole32

CoRevokeClassObject OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleIsCurrentClipboard CoTaskMemAlloc CoTaskMemFree OleFlushClipboard CoRegisterMessageFilter CLSIDFromString CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize

oleaut32

SafeArrayDestroy SafeArrayCreate SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnaccessData LoadRegTypeLi DispCallFunc SysAllocStringLen VariantChangeType VariantCopy VariantClear SysFreeString VariantInit SysStringLen SysAllocString SystemTimeToVariantTime OleCreateFontIndirect VariantTimeToSystemTime

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

crypt32

CryptUnprotectData

gdi32

CreateBitmap RestoreDC SetBkColor SetTextColor SetMapMode GetClipBox DeleteObject GetObjectW GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetDeviceCaps CreateRectRgnIndirect GetRgnBox GetBkColor GetTextColor GetMapMode SaveDC

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

comctl32

InitCommonControlsEx

oledlg

OleUIBusyW