d5f480d1d4cf7902094668a09856c79a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
d5f480d1d4cf7902094668a09856c79a_JaffaCakes118
Size 254KB
Sample240405-rh56cseb51
SHA256 2bba05f9769bd1ae9620ad64421955575bfbdb145e551bedcf55cad61a0819e5
MD5 d5f480d1d4cf7902094668a09856c79a
SHA1 d2b34a5580ade8bf67f18a655089bdd5041806e6
SHA512 504a66b98b286d812a9543fca96adc8342fd9c593b9551b24ab1d1c150b81633894b40fcd1cf0e9d8db05c4e5a64bb2e83f6c1d9df35c6459749b07cc56d505c
SSDEEP 6144:wBlL/cHjOU/I7FKWrwIj06jElBuJRHr7jAF0Z5oBb+Mf9O:CeDOU/IpU6jYBuDXOtzf9O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d5f480d1d4cf7902094668a09856c79a_JaffaCakes118
unpack001/$PLUGINSDIR/ftzcfimfl.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

d5f480d1d4cf7902094668a09856c79a_JaffaCakes118

.exe 254KB
$PLUGINSDIR/ftzcfimfl.dll

.dll 31KB
w5m9v8u0v1ayl2hqa

214KB

d5f480d1d4cf7902094668a09856c79a_JaffaCakes118

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 2bba05f9769bd1ae9620ad64421955575bfbdb145e551bedcf55cad61a0819e5
MD5 d5f480d1d4cf7902094668a09856c79a
SHA1 d2b34a5580ade8bf67f18a655089bdd5041806e6
SHA512 504a66b98b286d812a9543fca96adc8342fd9c593b9551b24ab1d1c150b81633894b40fcd1cf0e9d8db05c4e5a64bb2e83f6c1d9df35c6459749b07cc56d505c
SSDEEP 6144:wBlL/cHjOU/I7FKWrwIj06jElBuJRHr7jAF0Z5oBb+Mf9O:CeDOU/IpU6jYBuDXOtzf9O
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/ftzcfimfl.dll

IMPHASH a48f1aed62ee2040b575f3ac5a5c2fad
SHA256 c8b41f14eb72a177801664827eb9942534a410678a37894566fd09fc7e7dbcb4
MD5 25e960f61eb87320c923a7cd60280f35
SHA1 849dfc82b9ff6235c663993ba9924ab1f2a0213b
SHA512 42f3fc92d9b2778c3a8d5ef9edce3e8778b2fb414b59573efdcba88c4b73245c4f255cd15a6c46f77a30738bcf8e3636bdddd28be7df81403755400ebef71270
SSDEEP 384:5pHCFR+Fe3ffVNHKFOQAFVVK9rl0ngCz4QWm81g3C7X8C4oVYQ20oXQ7KudmrdA6:/CBPNpKFaXgrPCz/8jXemYQotudmZA6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

22819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

CoInternetGetSession Extract IsLoggingEnabledA RegisterFormatEnumerator RevokeBindStatusCallback URLDownloadToFileA

wsnmp32

ord902 ord503 ord102 ord904 ord903

odbc32

ord25 ord206 ord41 ord262

resutils

ResUtilGetMultiSzProperty ResUtilSetPrivatePropertyList

loadperf

LoadPerfCounterTextStringsW UnloadPerfCounterTextStringsA

rpcrt4

I_RpcClearMutex I_RpcNsBindingSetEntryNameA NdrServerInitializeMarshall RpcBindingInqAuthInfoExW

winmm

joyReleaseCapture mmioWrite timeGetDevCaps timeSetEvent

msi

ord7 ord60 ord97 ord117 ord120 ord134 ord152

avifil32

AVIFileEndRecord AVIFileInfoA AVIStreamGetFrameClose AVIStreamOpenFromFileA EditStreamClone

msvfw32

MCIWndCreate MCIWndCreateW

avicap32

videoThunk32

kernel32

CreateThread DeleteCriticalSection EnterCriticalSection GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection lstrcatW lstrcmpW lstrlenW

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegGetValueW RegNotifyChangeKeyValue RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

ole32

CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree PropVariantClear StringFromGUID2

user32

wsprintfW

msvcrt

_adjust_fdiv _initterm free malloc memcpy memset wcstol

d5f480d1d4cf7902094668a09856c79a_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/ftzcfimfl.dll

urlmon

wsnmp32

odbc32

resutils

loadperf

rpcrt4

winmm

msi

avifil32

msvfw32

avicap32

kernel32

advapi32

ole32

user32

msvcrt

generic

w5m9v8u0v1ayl2hqa