53e0ffb4bae3b44092706ccb01cf99f5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
53e0ffb4bae3b44092706ccb01cf99f5_JaffaCakes118
Size 242KB
Sample240331-l81exaaf94
SHA256 1707bc697b6509cc471011f836effe5815d4c553a6d07eac628dd8757141c7cf
MD5 53e0ffb4bae3b44092706ccb01cf99f5
SHA1 ee0f7110864268980343c6801252264c798e1ba0
SHA512 a6eac1c4ba736e0739d435809438a071dcca8c80d6ebed40dae14f92b37c4b1b3a43246045c1d3a520e0c2cb68164fea848a54688fd484141fff9bef86196313
SSDEEP 6144:wBlL/cZTredk/2YjU1276/AhChM3hz580vpoW3s535zx:CeKk/2292gcM3xe0p3s19x
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
53e0ffb4bae3b44092706ccb01cf99f5_JaffaCakes118
unpack001/$PLUGINSDIR/pwmzqotvoug.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

53e0ffb4bae3b44092706ccb01cf99f5_JaffaCakes118

.exe 242KB
$PLUGINSDIR/pwmzqotvoug.dll

.dll 28KB
jvtqf9zamy45u

211KB

53e0ffb4bae3b44092706ccb01cf99f5_JaffaCakes118

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 1707bc697b6509cc471011f836effe5815d4c553a6d07eac628dd8757141c7cf
MD5 53e0ffb4bae3b44092706ccb01cf99f5
SHA1 ee0f7110864268980343c6801252264c798e1ba0
SHA512 a6eac1c4ba736e0739d435809438a071dcca8c80d6ebed40dae14f92b37c4b1b3a43246045c1d3a520e0c2cb68164fea848a54688fd484141fff9bef86196313
SSDEEP 6144:wBlL/cZTredk/2YjU1276/AhChM3hz580vpoW3s535zx:CeKk/2292gcM3xe0p3s19x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/pwmzqotvoug.dll

IMPHASH e881d312c0694c341cda23551160b108
SHA256 5fd383ebda46cdadf9fcec02b74982cbf75688498475bbb655f18f4271988f3d
MD5 8bce90199381e2d4765729b5a75314bf
SHA1 fe94312ad5450fa37a6b4fb4557f0a18df93cb3f
SHA512 1f93e885e556ad1dc6882fc3d05bf4794fdf639f14f20a919b6bcb344eecc1fa5b28bb5c83461b4315ba01b880f2b70ab18cb6ce098b44a58d1e3088bc905e1f
SSDEEP 384:gT2ogsNzG9THkywV7wVhx1udVG4eH6tIFlykk66oXh/allX9mRBRVNSwFSg:gCFIIDk9KAdV/eHbFcrW/NROwP
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

imm32

ImmReSizeIMCC ImmGetHotKey ImmGetCandidateListW ImmDestroyIMCC ImmLockIMC ImmGetStatusWindowPos

kernel32

SetFilePointer WriteFile CloseHandle GetLastError Sleep GetLocalTime GetVersion GetWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrcpyW lstrcatW lstrlenW DeleteFileW SystemTimeToFileTime EnumSystemCodePagesW GetFileSize SearchPathW FileTimeToSystemTime CompareFileTime CreateFileW

resutils

ResUtilSetPropertyTable ResUtilGetProperty ResUtilSetPrivatePropertyList ResUtilGetResourceNameDependency ResUtilSetPropertyParameterBlock ResUtilGetPropertiesToParameterBlock ClusWorkerTerminate ResUtilGetAllProperties

user32

ToUnicode EndDialog MonitorFromRect RealGetWindowClassA WinHelpW IsDialogMessage

pdh

PdhEnumObjectItemsW PdhOpenQuery PdhLookupPerfNameByIndexW PdhOpenQueryW PdhVbGetCounterPathFromList PdhBrowseCountersA

ole32

STGMEDIUM_UserSize CoTaskMemAlloc OleDestroyMenuDescriptor CoTaskMemFree MonikerRelativePathTo HPALETTE_UserFree HGLOBAL_UserSize CoCreateGuid HMETAFILEPICT_UserSize FreePropVariantArray WriteStringStream

avifil32

AVIFileWriteData AVIFileInit AVIFileOpen AVISaveVA

msvfw32

ICOpenFunction DrawDibEnd GetOpenFileNamePreview

msacm32

acmFilterTagDetailsW acmStreamPrepareHeader acmFilterTagEnumW acmDriverAddA acmFilterEnumW acmFormatChooseW acmStreamMessage acmFilterChooseW acmDriverClose

oleaut32

SysFreeString

msvcrt

wcschr malloc memcmp memcpy memset memmove

53e0ffb4bae3b44092706ccb01cf99f5_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/pwmzqotvoug.dll

imm32

kernel32

resutils

user32

pdh

ole32

avifil32

msvfw32

msacm32

oleaut32

msvcrt

generic

jvtqf9zamy45u