e36d8136f0e3279fdb08f978684f2a30_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e36d8136f0e3279fdb08f978684f2a30_JaffaCakes118
Size 641KB
Sample240406-2c418acg7x
SHA256 ac337efd7c48119844958675acb785741108f8ba41acd53ad4a7659c9cd2d2d9
MD5 e36d8136f0e3279fdb08f978684f2a30
SHA1 fee4c95b4afbb66a286583708d454c26f4a3cf2e
SHA512 633212cbab7db25714c34f3d3c4bba6f7f098fa631a582bafcfddb212bb9a3fefa0955a3ac05b6828239bf0690f627a83f5b1785c0aaf7fa4380dcddb630a10d
SSDEEP 12288:bnbgZF1S8rVYFwoISuItrI5l5GqKFtjAc1r835fFkBCRLZwBE:rMZFM8an1xI5lh0t71Y37LZwBE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/100.exe
unpack001/40.exe

File Explorer

e36d8136f0e3279fdb08f978684f2a30_JaffaCakes118

.cab 641KB
100.exe

.exe 256KB
40.exe

.exe 1.0MB
rdns.exe

.exe 80KB

e36d8136f0e3279fdb08f978684f2a30_JaffaCakes118

SHA256 ac337efd7c48119844958675acb785741108f8ba41acd53ad4a7659c9cd2d2d9
MD5 e36d8136f0e3279fdb08f978684f2a30
SHA1 fee4c95b4afbb66a286583708d454c26f4a3cf2e
SHA512 633212cbab7db25714c34f3d3c4bba6f7f098fa631a582bafcfddb212bb9a3fefa0955a3ac05b6828239bf0690f627a83f5b1785c0aaf7fa4380dcddb630a10d
SSDEEP 12288:bnbgZF1S8rVYFwoISuItrI5l5GqKFtjAc1r835fFkBCRLZwBE:rMZFM8an1xI5lh0t71Y37LZwBE
MD5 SHA1 SHA512 SSDEEP

100.exe

IMPHASH 48854cdf6e69f6b54d34e8040f7295e8
SHA256 50f8ce3d2974f841523f481362059382d1dce9b4dc840d6050751f4360bef4e3
MD5 1849c7d166fe9c2738f69c8d9fc8166b
SHA1 e1cd056eef47dd85d90e44d94b5bf5842bcaa755
SHA512 bbc9325ff61d73512c03a238986203b5667e40018fa7dc1350e755e16c5820d4495e34f4ee5f9c9110ad98bee98f680d1ee2660f2a066fbb40271b2d13d155bc
SSDEEP 3072:QojVNpbe9kk19/dQAnZOGIjNkieT1uZRV2qwrVHNz+f2xQYXvpI0m5xBPa+g4cVr:/pbPwQAnkVBEhYP4tz+ApIVs4ce6Bh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128308

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

TlsFree WritePrivateProfileStringA GlobalFlags SetErrorMode FileTimeToLocalFileTime GetFileAttributesA GetFileTime lstrcmpW GlobalFindAtomA GetCPInfo GetOEMCP HeapFree HeapAlloc GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetProcessHeap GetStartupInfoA RtlUnwind RaiseException ExitProcess HeapSize DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode HeapDestroy HeapCreate VirtualFree GetStdHandle GetACP FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEnvironmentVariableA LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetModuleFileNameW InterlockedDecrement InterlockedIncrement FileTimeToSystemTime GlobalGetAtomNameA GetCurrentProcessId GlobalAddAtomA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetThreadLocale GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer ReadFile GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA GlobalDeleteAtom GetModuleHandleA SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree GetVersion CompareStringA InterlockedExchange CompareStringW lstrlenA WriteFile CreateFileA CreateDirectoryA GetCommandLineA CopyFileExA FindResourceA LoadResource LockResource SizeofResource Sleep DeleteFileA CopyFileA GetVersionExA GetModuleFileNameA OpenMutexA CloseHandle FreeLibrary GetProcAddress LoadLibraryA GetLastError CreateMutexA GetTempPathA MultiByteToWideChar lstrcmpA WideCharToMultiByte TerminateProcess

user32

RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA CopyRect DefWindowProcA CallWindowProcA SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GrayStringA DrawTextExA TabbedTextOutA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameA PtInRect SetWindowTextA UnhookWindowsHookEx LoadCursorA GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextA GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxA SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA ShowWindow DestroyMenu SetWindowLongA UnregisterClassA GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus GetParent SendMessageA ModifyMenuA EnableMenuItem CheckMenuItem GetSystemMetrics PostMessageA PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu CharUpperA DrawTextA AdjustWindowRectEx

gdi32

SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible CreateBitmap GetDeviceCaps GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC DeleteObject

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey RegQueryValueExA RegOpenKeyA SetNamedSecurityInfoA

shell32

SHGetSpecialFolderPathA ShellExecuteA

shlwapi

PathFindExtensionA StrStrA PathAppendA PathRemoveFileSpecA StrToIntA SHGetValueA PathFileExistsA PathFindFileNameA StrToIntExA PathStripToRootA PathIsDirectoryA PathIsUNCA

ole32

CoUninitialize CoInitialize

oleaut32

VariantInit VariantChangeType VariantClear

ws2_32

socket inet_addr connect gethostbyname WSAStartup WSAGetLastError closesocket recv getsockname send

40.exe

IMPHASH 6ecf757d65a5044e7592dd7ab6c00fc9
SHA256 986f4b9b0c86141db624d8e1811a3743d067896da7300840df59db962a97d87d
MD5 9f1520c12a9aaabb48d786c7b0afbd88
SHA1 bc6f959c52b034b3d8cf47bd6601fee196019a2a
SHA512 6d281ee8c29006fe0c558df836c149904fbda6dcca3cdf5e2a0b297b08b8c365fe505a74db8b87f2fd2f08b305bac5187517e6c85beae64f0b7f1f14dc0b79a1
SSDEEP 12288:RNE20t/TBdp9TuxviU3vuEqV/a68TSfqzpSwyovU59nP3V7Rh1E1:J0t3AvHzqohTMZNVPfhG1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Work\Tangobar2\Installers\NN_TangoBar_Installer_songza\Release\NN_Bar75.pdb

kernel32

SetErrorMode GetCPInfo GetOEMCP GetSystemTimeAsFileTime HeapFree HeapAlloc VirtualAlloc HeapReAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitProcess RaiseException HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetACP GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentProcess FlushFileBuffers SetFilePointer ReadFile GlobalFindAtomA lstrcmpW GetVersionExA GetThreadLocale GlobalGetAtomNameA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GetModuleFileNameW GlobalFlags WritePrivateProfileStringA GetCurrentProcessId GlobalAddAtomA SetLastError GlobalFree GlobalUnlock FormatMessageA LocalFree GetCurrentThread GetCurrentThreadId ConvertDefaultLocale GetModuleFileNameA EnumResourceLanguagesA GetLocaleInfoA GlobalLock lstrcmpA GlobalAlloc GlobalDeleteAtom GetModuleHandleA GetVersion CompareStringA GetLastError InterlockedExchange FreeLibrary Sleep CloseHandle WriteFile LoadResource FindResourceA CreateFileA MultiByteToWideChar lstrlenA GetSystemDirectoryA CreateProcessA LockResource SizeofResource WideCharToMultiByte GetProcAddress HeapDestroy LoadLibraryA

user32

ShowWindow RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA SetPropA GetPropA RemovePropA IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx CopyRect DefWindowProcA CallWindowProcA SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement LoadCursorA GetSystemMetrics GetSysColorBrush GetSysColor ReleaseDC GetDC GrayStringA DrawTextExA DrawTextA TabbedTextOutA UnhookWindowsHookEx ClientToScreen PostQuitMessage PostMessageA GetWindow GetDlgCtrlID GetWindowRect GetClassNameA PtInRect GetWindowTextA SetWindowTextA GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled EnableWindow UnregisterClassA DestroyMenu GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState CheckMenuItem EnableMenuItem ModifyMenuA SendMessageA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageA MessageBoxA SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState SetWindowLongA

gdi32

ScaleWindowExtEx DeleteDC GetStockObject SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible GetDeviceCaps GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC DeleteObject CreateBitmap PtVisible

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyA RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

SHGetFolderPathA

shlwapi

PathFindExtensionA PathFindFileNameA

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantClear VariantChangeType VariantInit

rdns.exe

IMPHASH 3ffd59ca416f95b01ca80f71161f013d
SHA256 77e295dc521ad53cf422f892685ce70655b4c9ea7086bcfc12cbf872f4b3e8a1
MD5 0d6fda58fcfa09839191731811f6ebf0
SHA1 579ebe643129f5e5d6773a67033af99846b74360
SHA512 23c0b87bd13a564459882abd7ca94211e5773d30a8c628840749e9d3eec66095f0a9c16a2934925913a839e3ce28124b2e8ac06b7f686cc44b14425f070c8b82
SSDEEP 1536:GzFZRPPgttvJ2F2X1BEV8f1ik/P7Gp7tx2/QBGrYltuy4L:GzFbPwm04KNYxx2/HYltY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

38:60:64:46:21:9d:6c:6e:19:59:24:d4:f4:e0:32:81:f8:64:32:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QuestBrowser.com,O=QuestBrowser.com,POSTALCODE=90245,STREET=Suite 2020+STREET=2141 Rosecrans Ave,L=El Segundo,ST=CA,C=US

Chains

Nov 2, 2010

Minor OS version

Major OS version

Entry point

32048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Develop\Firstlook\Projects\StubInstaller\stub\Release\stub.pdb

shlwapi

PathAppendA PathRemoveFileSpecA StrStrA wnsprintfA

wintrust

WinVerifyTrust

crypt32

CertGetNameStringA CryptQueryObject CryptMsgGetParam CertCloseStore CryptMsgClose CertFindCertificateInStore

rpcrt4

UuidCreate

kernel32

LocalFree LCMapStringW LCMapStringA lstrcpyA lstrlenA SetFilePointer CreateFileA CloseHandle WriteFile InterlockedExchange GetVersionExA GetACP GetLocaleInfoA GetThreadLocale lstrcpynA InterlockedDecrement MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection GetLastError ResumeThread SetPriorityClass GetCurrentProcess GetCurrentThread SetThreadPriority CreateProcessA GetModuleFileNameA RemoveDirectoryA DeleteFileA GetExitCodeProcess WaitForSingleObject SizeofResource LockResource LoadResource FindResourceA CreateDirectoryA GetTempFileNameA GetTempPathA lstrcmpiA lstrcmpA Sleep LoadLibraryA FreeLibrary GetProcAddress GetSystemInfo VirtualProtect GetEnvironmentStringsW WideCharToMultiByte SetHandleCount RaiseException GetCPInfo GetOEMCP GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle IsBadWritePtr RtlUnwind ExitProcess HeapFree HeapAlloc GetModuleHandleA GetStartupInfoA GetCommandLineA SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc TerminateProcess HeapSize VirtualQuery HeapDestroy HeapCreate VirtualFree VirtualAlloc GetFileType

user32

MessageBoxA

advapi32

RegSetValueExA RegOpenKeyExA RegCloseKey

ole32

CoCreateInstance CoInitializeSecurity CoUninitialize CoInitializeEx CoSetProxyBlanket

oleaut32

VariantChangeType SysFreeString SysAllocString VariantInit VariantClear

e36d8136f0e3279fdb08f978684f2a30_JaffaCakes118

100.exe

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

ws2_32

generic

40.exe

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic

rdns.exe

PE Signature issue

shlwapi

wintrust

crypt32

rpcrt4

kernel32

user32

advapi32

ole32

oleaut32

generic