db0086d6c41fea58417b589f20de1b52_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
db0086d6c41fea58417b589f20de1b52_JaffaCakes118
Size 245KB
Sample240405-wpn8msaf2w
SHA256 ed5e8ff7e2e5e830e2265ab6d76a5889a656444e157237426c0504a21a517471
MD5 db0086d6c41fea58417b589f20de1b52
SHA1 8cfe6a4bee30822edc96334be85877edd40c1c81
SHA512 21f5c92f4bde2b1e4a8312bf6419b3dab3504a00299de8f4de1b361fbdb8aef18ac8cc5a222c5a4e6146a702c0437d34fccc0f7059c934f358bcd57a50699074
SSDEEP 6144:wBlL/c3OeNyv4fEHPol4kfzyvM0Sh9vIc9m5SeTicN4o:CedJfwZvpShq0Pcuo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
db0086d6c41fea58417b589f20de1b52_JaffaCakes118
unpack001/$PLUGINSDIR/sogqjgayoly.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

db0086d6c41fea58417b589f20de1b52_JaffaCakes118

.exe 245KB
$PLUGINSDIR/sogqjgayoly.dll

.dll 35KB
btt47s33zn58gaoyt8

213KB

db0086d6c41fea58417b589f20de1b52_JaffaCakes118

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 ed5e8ff7e2e5e830e2265ab6d76a5889a656444e157237426c0504a21a517471
MD5 db0086d6c41fea58417b589f20de1b52
SHA1 8cfe6a4bee30822edc96334be85877edd40c1c81
SHA512 21f5c92f4bde2b1e4a8312bf6419b3dab3504a00299de8f4de1b361fbdb8aef18ac8cc5a222c5a4e6146a702c0437d34fccc0f7059c934f358bcd57a50699074
SSDEEP 6144:wBlL/c3OeNyv4fEHPol4kfzyvM0Sh9vIc9m5SeTicN4o:CedJfwZvpShq0Pcuo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/sogqjgayoly.dll

IMPHASH 1734cf4b6159b98daf01884ad77b36dd
SHA256 416c75dbb19ed40f62e8d02219faa4ef0c1568e1507b7d58fc0090871534dd48
MD5 3486630808a1ce5c9754676814e058bd
SHA1 be6b220984f8554e4f98d6d4f9512d13525f5572
SHA512 3d9556ada0379eae4a70878317a609349f49c44f256e4c3cf4249e17cee4728eab476c6f30525dffc53422e17541534ed126a9059ec8b0dd055e380b4ec10452
SSDEEP 768:KYjdXnijLBTXd2JWMW3JNyXVciwrBus0+a7:hJnGLBTN2PVXVciGu5+a
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrCmpNIA

kernel32

GlobalLock GlobalHandle GlobalFree LocalAlloc LocalFree GlobalUnlock GetProcessHeap VirtualProtect HeapAlloc GlobalAlloc

mscms

UnregisterCMMA SetColorProfileElementReference SetColorProfileHeader GetCMMInfo

winspool.drv

ScheduleJob ord211 AddPrinterConnectionW SetFormA DeviceCapabilitiesA WritePrinter SetPortW DevQueryPrintEx AddPrinterDriverA GetJobA

loadperf

UnloadPerfCounterTextStringsA LoadPerfCounterTextStringsW

comdlg32

PrintDlgExA ReplaceTextW PageSetupDlgA GetOpenFileNameW GetSaveFileNameA FindTextA

user32

SendMessageTimeoutW EnumPropsA GetActiveWindow SetClassWord LoadStringW MessageBoxW IMPSetIMEA LoadKeyboardLayoutA

shell32

DuplicateIcon SHChangeNotify DragQueryFileA

oleaut32

VarCyNeg VarUI2FromR8 VarUI1FromUI2 SafeArrayDestroy VarI1FromR8 VarCyCmp VarR4FromCy

winmm

mmioClose DefDriverProc mmioAdvance waveInMessage midiInGetDevCapsW waveOutGetPosition midiOutOpen mmTaskCreate joySetThreshold midiConnect

msvcrt

memset memcpy _initterm _adjust_fdiv malloc free

db0086d6c41fea58417b589f20de1b52_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/sogqjgayoly.dll

shlwapi

kernel32

mscms

winspool.drv

loadperf

comdlg32

user32

shell32

oleaut32

winmm

msvcrt

generic

btt47s33zn58gaoyt8