98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118
Size 450KB
Sample240402-2d36baff76
SHA256 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
MD5 98d2d5ac3bd493d77f0a7300a43d045b
SHA1 7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
SHA512 32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3
SSDEEP 12288:g4fXqKkoo4mdIaFOyzsfUvCqqTb+3e3DcGv2:9PbkoodWaEXU6P/2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118
unpack001/$PLUGINSDIR/gyalquzbu.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118

.exe 450KB
$PLUGINSDIR/gyalquzbu.dll

.dll 33KB
djr4rhq6jcukl62j

214KB

98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
MD5 98d2d5ac3bd493d77f0a7300a43d045b
SHA1 7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
SHA512 32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3
SSDEEP 12288:g4fXqKkoo4mdIaFOyzsfUvCqqTb+3e3DcGv2:9PbkoodWaEXU6P/2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/gyalquzbu.dll

IMPHASH e2d6fd4d471668e21347452fad4e179e
SHA256 db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76
MD5 a8caa6d267951ad22e835233b5e50c46
SHA1 45c722c5958d99727a95d30eaa3032203d1f4ab2
SHA512 9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7
SSDEEP 384:8o2En0QXbRRe9fsWZAmSlmMNAC8Qqgqdq9RHvHZXktPaa+LiJtLydc8f1eWU9Rkj:L2zf9HPaa+2tLKJcMaTxOMFs0o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

24892

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gdi32

CreateCompatibleBitmap GetCharWidth32W GetLogColorSpaceA ScaleWindowExtEx SelectClipRgn SetDIBits

mpr

MultinetGetConnectionPerformanceW WNetAddConnectionW WNetConnectionDialog1A WNetGetUniversalNameW

mswsock

EnumProtocolsW GetAcceptExSockaddrs GetNameByTypeW rexec s_perror

user32

CharUpperA CopyImage DlgDirSelectExA OpenDesktopW VkKeyScanW

urlmon

CreateURLMoniker HlinkSimpleNavigateToMoniker HlinkSimpleNavigateToString IsLoggingEnabledA MkParseDisplayNameEx RegisterFormatEnumerator

resutils

ResUtilFindSzProperty ResUtilGetBinaryProperty ResUtilGetBinaryValue ResUtilSetBinaryValue ResUtilSetExpandSzValue ResUtilSetSzValue ResUtilStopService

loadperf

LoadPerfCounterTextStringsW UnloadPerfCounterTextStringsA UnloadPerfCounterTextStringsW

kernel32

CloseHandle CompareFileTime CreateFileMappingW CreateFileW DeleteFileW EnumSystemCodePagesW FileTimeToSystemTime GetFileSize GetLastError GetLocalTime GetVersion GetWindowsDirectoryW MapViewOfFile SearchPathW SetFilePointer Sleep SystemTimeToFileTime UnmapViewOfFile WriteFile lstrcatW lstrcpyW lstrlenW

ole32

CoCreateGuid CoTaskMemAlloc CoTaskMemFree

oleaut32

SysFreeString

msvcrt

_adjust_fdiv _initterm free malloc memcpy memmove memset wcschr

98d2d5ac3bd493d77f0a7300a43d045b_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/gyalquzbu.dll

gdi32

mpr

mswsock

user32

urlmon

resutils

loadperf

kernel32

ole32

oleaut32

msvcrt

generic

djr4rhq6jcukl62j