66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118
Size 245KB
Sample240401-d6hhbach93
SHA256 662b44a7fd7d5d5042c05dd3e049e52844d613febdde0ee9dd96d50a3ac55513
MD5 66a64f84f91c1dd2bc4b9f01faf15d40
SHA1 21812f5c0a37e7b479f1dcc63237d0070e04c076
SHA512 08b4fe874cc4cf0cc70a501e92a55a66396918197cf718b1ae632b223d899b56f0132925314cfadacb2f08f373559df331bd223257a792cb656fbcefec783380
SSDEEP 6144:wBlL/ch4YPNYPUL6BM+WUT71/+F9XZHoN1zELbMeVD5Zc+B0I6:Ceh4GN8RM+j0za1gPxVD5FB0b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118
unpack001/$PLUGINSDIR/atzfnwlbz.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118

.exe 245KB
$PLUGINSDIR/atzfnwlbz.dll

.dll 43KB
jjvbeha0xkkpzklmop

212KB

66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 662b44a7fd7d5d5042c05dd3e049e52844d613febdde0ee9dd96d50a3ac55513
MD5 66a64f84f91c1dd2bc4b9f01faf15d40
SHA1 21812f5c0a37e7b479f1dcc63237d0070e04c076
SHA512 08b4fe874cc4cf0cc70a501e92a55a66396918197cf718b1ae632b223d899b56f0132925314cfadacb2f08f373559df331bd223257a792cb656fbcefec783380
SSDEEP 6144:wBlL/ch4YPNYPUL6BM+WUT71/+F9XZHoN1zELbMeVD5Zc+B0I6:Ceh4GN8RM+j0za1gPxVD5FB0b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/atzfnwlbz.dll

IMPHASH e9577343458a44825d81a0ce7518e573
SHA256 649545c1a63dc5397987051b5d2a345fcb87bbf7ea8cfc1e15f668f0c3f5bb18
MD5 b19970ad6a9300060d8b0f43cb4de34a
SHA1 60e4629ed93e58eb0e894a23254028353aaa71ae
SHA512 4eddef779ceea9abe92be5a9cf151709c89e3cae92dc916bdd075deb0df3f430950f8183a6a45730c9e1c16838673474b79e233c54cd13fe23495d2f5210d864
SSDEEP 768:E6tefip4O73Qet5EdYkyHgrm+ukNO9yyjYsUAPH4IEt:E6teqpB7gDYvTjYsUAPMt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

35807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

imm32

ImmCreateSoftKeyboard ImmEnumRegisterWordA ImmEnumRegisterWordW ImmGetCompositionFontW ImmGetImeMenuItemsA ImmGetProperty ImmGetVirtualKey ImmInstallIMEA ImmSetOpenStatus

shlwapi

StrRChrIA StrStrIW

odbc32

ord227 ord207 ord110 ord44 ord219 ord139 ord250 ord150 ord22 ord68 ord52 ord70

mswsock

GetServiceW MigrateWinsockConfiguration WSARecvEx inet_network rcmd rexec s_perror

ole32

CLSIDFromString HMETAFILEPICT_UserMarshal OleSave SNB_UserMarshal STGMEDIUM_UserFree StgOpenPropStg

urlmon

HlinkGoForward ReleaseBindInfo URLOpenBlockingStreamA URLOpenStreamW UrlMkGetSessionOption WriteHitLogging

user32

GetKeyboardState InsertMenuItemA LoadStringW SetMessageExtraInfo ShowOwnedPopups UserHandleGrantAccess

comdlg32

FindTextA FindTextW GetOpenFileNameW GetSaveFileNameW PageSetupDlgW PrintDlgA PrintDlgExA PrintDlgExW PrintDlgW

ws2_32

WSAAsyncGetProtoByName WSAEnumNameSpaceProvidersW WSAGetLastError WSASetBlockingHook WSASetEvent WSAStringToAddressW WSCInstallProvider

shell32

SHEmptyRecycleBinA SHGetDiskFreeSpaceA

advapi32

GetUserNameA GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CreateFileW ExpandEnvironmentStringsW FreeLibrary GetDriveTypeA GetDriveTypeW GetLastError GetProcAddress GetProcessHeap HeapAlloc HeapFree LoadLibraryW MultiByteToWideChar SetLastError VirtualProtect WideCharToMultiByte lstrcmpW lstrcpyA lstrcpyW lstrlenA lstrlenW

msvcrt

_adjust_fdiv _initterm free iswctype malloc memcpy memset strcpy strlen swprintf wcschr

66a64f84f91c1dd2bc4b9f01faf15d40_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/atzfnwlbz.dll

imm32

shlwapi

odbc32

mswsock

ole32

urlmon

user32

comdlg32

ws2_32

shell32

advapi32

kernel32

msvcrt

generic

jjvbeha0xkkpzklmop