3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118
Size 253KB
Sample240330-mldhasea53
SHA256 e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
MD5 3a5c5bb43232e4e48b63cdf123dec876
SHA1 95b478c57de28b87d6bd87dd32a4faec02b0d620
SHA512 59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281
SSDEEP 3072:wBynOpL12riocLMjve4LOk2AcxISCGn2rc2gGw7cMC9oyZ9rUoyBz92bO511D0tv:wBlL/c/LOk2Ac3CGn2cb1n5LD0t2lDy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118
unpack001/$PLUGINSDIR/ylbzgkuxqsi.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118

.exe 253KB
$PLUGINSDIR/ylbzgkuxqsi.dll

.dll 31KB
2w7qirwuhiwtme

214KB

3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
MD5 3a5c5bb43232e4e48b63cdf123dec876
SHA1 95b478c57de28b87d6bd87dd32a4faec02b0d620
SHA512 59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281
SSDEEP 3072:wBynOpL12riocLMjve4LOk2AcxISCGn2rc2gGw7cMC9oyZ9rUoyBz92bO511D0tv:wBlL/c/LOk2Ac3CGn2cb1n5LD0t2lDy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/ylbzgkuxqsi.dll

IMPHASH e3f2365d9edf746f002d9c0ddbefc414
SHA256 23e80d01cf007b17f91366fb1866568f0385ff08767434728f209535d3452fdd
MD5 51d6f1227b9a2e0b090c9d0dab9d4528
SHA1 43149a31386cd9613c5b0e8a218f1e7cc7f77af8
SHA512 b85fd793d0ddf2e96833b458fee64008ff13a863a4b9ba044bf916efc41947fdadc13cfb1deaa151d58c162d706e32226e14ea2a7ba82557eccff329c9e38afb
SSDEEP 768:ovoaaC/7aXedJGhoDJLpKQmZuu82bkBYQo/LukLt3KWA:ovoaaC/76eHGhippKQmZuu1wBYBLRJKX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

22851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

loadperf

LoadPerfCounterTextStringsA LoadPerfCounterTextStringsW UnloadPerfCounterTextStringsA

mscms

CloseColorProfile GetColorDirectoryA InstallColorProfileA RegisterCMMW SetColorProfileHeader UninstallColorProfileW

pdh

PdhBrowseCountersW PdhGetDefaultPerfObjectW PdhGetFormattedCounterArrayW PdhGetRawCounterValue PdhLookupPerfNameByIndexW

mswsock

GetTypeByNameA GetTypeByNameW SetServiceA TransmitFile rcmd rexec rresvport

crypt32

CertAddEncodedCertificateToSystemStoreW CertSaveStore CertStrToNameA CryptHashPublicKeyInfo

kernel32

CreateThread DeleteCriticalSection EnterCriticalSection GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection lstrcatW lstrcmpW lstrlenW

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegGetValueW RegNotifyChangeKeyValue RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree PropVariantClear StringFromGUID2

user32

wsprintfW

msvcrt

_adjust_fdiv _initterm free malloc memcpy memset wcstol

3a5c5bb43232e4e48b63cdf123dec876_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/ylbzgkuxqsi.dll

loadperf

mscms

pdh

mswsock

crypt32

kernel32

advapi32

ole32

user32

msvcrt

generic

2w7qirwuhiwtme