jaovu
Static task
static1
Behavioral task
behavioral1
Sample
DHL Original Invoice_pdf.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
DHL Original Invoice_pdf.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/svlainqhst.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/svlainqhst.dll
Resource
win10v2004-20240226-en
General
-
Target
4078890cd4faa4b8642b1b9d8028642e_JaffaCakes118
-
Size
233KB
-
MD5
4078890cd4faa4b8642b1b9d8028642e
-
SHA1
497a24116eb6974060e2201c44b81361842e522c
-
SHA256
03c65cd38dd679ebf5ded2fb84dc2cccf80b78291b3b10b174de6cca1108cbbb
-
SHA512
4293f5ba502cbb98fff159d76dd77b5e7434eead13047c43053f2424216b63565e2252cdcaf84488aa8dfba8e21d302916bc653de1390e244892c348e3bb1239
-
SSDEEP
6144:r7chA9TNjtNcFJ3pKMzU3X/vVXtyB8Os5YHyVzt:HlCf5svdt+HSR
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/DHL Original Invoice_pdf.exe unpack002/$PLUGINSDIR/svlainqhst.dll -
NSIS installer 2 IoCs
resource yara_rule static1/unpack001/DHL Original Invoice_pdf.exe nsis_installer_1 static1/unpack001/DHL Original Invoice_pdf.exe nsis_installer_2
Files
-
4078890cd4faa4b8642b1b9d8028642e_JaffaCakes118.rar
-
DHL Original Invoice_pdf.exe.exe windows:4 windows x86 arch:x86
b76363e9cb88bf9390860da8e50999d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
CompareFileTime
SearchPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
Sleep
lstrcmpiA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
lstrlenA
GetCommandLineA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
MultiByteToWideChar
LoadLibraryExA
GetModuleHandleA
FreeLibrary
user32
SetCursor
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
EndDialog
ScreenToClient
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
GetWindowLongA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
SetTimer
PostQuitMessage
SetWindowLongA
SendMessageTimeoutA
LoadImageA
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
CreateDialogParamA
DestroyWindow
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
advapi32
RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/svlainqhst.dll.dll windows:6 windows x86 arch:x86
44acdb9da6379974ac92c634a8a80970
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
PathFindExtensionA
PathRelativePathToW
SHDeleteValueW
SHRegOpenUSKeyA
StrCSpnIW
StrStrIW
StrTrimA
kernel32
CloseHandle
CreateFileW
DisableThreadLibraryCalls
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeLibrary
GetDriveTypeA
GetDriveTypeW
GetLastError
GetProcAddress
GetProcessHeap
GetStringTypeW
GetVersion
HeapAlloc
HeapFree
LoadLibraryW
MultiByteToWideChar
SetConsoleWindowInfo
SetLastError
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcmpW
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW
odbc32
ord210
ord31
ord232
ord44
ord262
ord139
ord170
winmm
WOW32DriverCallback
auxSetVolume
midiInOpen
midiInUnprepareHeader
midiStreamPause
midiStreamPosition
mixerOpen
waveInAddBuffer
msi
ord7
ord15
ord17
ord18
ord31
ord34
ord169
ord56
ord80
ord92
ord123
ord139
ord146
mpr
MultinetGetConnectionPerformanceW
oleaut32
SafeArrayLock
VarDateFromR8
VarDecDiv
VarDecFromCy
VarDecFromDisp
VarDecFromUI2
VarImp
VarR8FromUI4
VarUI1FromDisp
VariantCopy
mscms
AssociateColorProfileWithDeviceW
CloseColorProfile
CreateProfileFromLogColorSpaceW
GetPS2ColorSpaceArray
GetStandardColorSpaceProfileW
IsColorProfileTagPresent
SelectCMM
SetColorProfileHeader
TranslateColors
gdi32
AddFontResourceA
AddFontResourceExA
CreateDIBSection
CreateEnhMetaFileA
DPtoLP
ExtFloodFill
GdiGetPageCount
GetOutlineTextMetricsW
OffsetViewportOrgEx
SetLayout
advapi32
GetUserNameA
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenCurrentUser
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
user32
LoadStringW
msvcrt
_adjust_fdiv
_initterm
free
iswctype
malloc
memcpy
memset
strcpy
strlen
swprintf
wcschr
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
mcuee0c8wrpr