ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118
Size 116KB
Sample240411-kpdlcsbb2t
SHA256 e802660af8ef63ea2dfdc796c151e5676f5dee45666f7fe8133eca22361886d4
MD5 ed0601de9daaf2befcc7d488324c2b39
SHA1 c17cd422200cb197cea4c6df63e994f174cbdc24
SHA512 d44ff0dc6175128903a87cd9885ee613ca1e901021739765504984058b97c251374cd7f93d77c89c1dc6c876e8467684c335d35b335ed94e6a3b876d71d10967
SSDEEP 1536:VtYuscB6qhtBu/HMDHmJd4Romu/fduJ82U/gsB4VyfYZZdMQeMB8EHDPNW1aaz:VKQXtg/sDHmJd45Sd41UIsOX7zmYlu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$_2_/$R0
unpack001/$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

File Explorer

ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118

.exe 116KB
$PLUGINSDIR/System.dll

.dll 10KB
$_2_/$R0

.dll 156KB
$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe

.exe 5KB

ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 e802660af8ef63ea2dfdc796c151e5676f5dee45666f7fe8133eca22361886d4
MD5 ed0601de9daaf2befcc7d488324c2b39
SHA1 c17cd422200cb197cea4c6df63e994f174cbdc24
SHA512 d44ff0dc6175128903a87cd9885ee613ca1e901021739765504984058b97c251374cd7f93d77c89c1dc6c876e8467684c335d35b335ed94e6a3b876d71d10967
SSDEEP 1536:VtYuscB6qhtBu/HMDHmJd4Romu/fduJ82U/gsB4VyfYZZdMQeMB8EHDPNW1aaz:VKQXtg/sDHmJd45Sd41UIsOX7zmYlu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
MD5 bf01b2d04e8fad306ba2f364cfc4edfa
SHA1 58f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA512 30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
SSDEEP 192:aO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1angMO:vKAFERdlxhGRYUzqZan
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_2_/$R0

IMPHASH 8746e32055fab62b4b3bce7e61e5853d
SHA256 1c2a6089585666c2c9ce8b738618f5f30ff12b4100e6bfdc6334bc53a8937726
MD5 ca0b2a57ba75f9520bea84ba04d684d9
SHA1 fd751510f0ead9e26703f534c70c2abdc37ee78b
SHA512 750025c5cbbf3f71ab44c00deb681760bf6a97f6d83e4f96c81030185fe803ef64de31962d77d1392c85f1a4983bbf3e64eae74df807166adc7a01a0324324f1
SSDEEP 3072:I4EPpQaK3SXZVEMcdt8YR1MTVa/oGabn:I9GaBVEFVcTV8a
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

83053

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

HttpOpenRequestA InternetAttemptConnect InternetCrackUrlA HttpQueryInfoA InternetReadFile InternetCloseHandle HttpAddRequestHeadersA HttpSendRequestA InternetOpenA InternetConnectA

kernel32

lstrlenW FreeLibrary DeleteFileA GetTempPathA WideCharToMultiByte MultiByteToWideChar lstrlenA CloseHandle CreateFileA GetFileAttributesA WaitForSingleObject GetVersion OpenMutexA CreateMutexA ReadFile WriteFile CreateDirectoryA GetSystemDirectoryA ReleaseMutex GetLocalTime LeaveCriticalSection MoveFileExA MoveFileA GetFileSize SetFilePointer DeleteCriticalSection GetTempFileNameA GetShortPathNameA SetFileAttributesA LocalFree LCMapStringW LCMapStringA SetStdHandle GetOEMCP GetACP GetCPInfo GetStringTypeW GetStringTypeA GetEnvironmentVariableA EnterCriticalSection InterlockedDecrement InterlockedIncrement InitializeCriticalSection GetWindowsDirectoryA GetPrivateProfileIntA WritePrivateProfileStringA DisableThreadLibraryCalls GetModuleFileNameA LoadLibraryA GetProcAddress IsBadCodePtr HeapCreate HeapDestroy GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType FlushFileBuffers CompareStringA CompareStringW SetEnvironmentVariableA lstrcatA IsBadReadPtr IsBadWritePtr VirtualAlloc RtlUnwind GetTimeZoneInformation GetSystemTime RaiseException GetCommandLineA HeapAlloc HeapFree GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetLastError ExitProcess TerminateProcess GetCurrentProcess HeapReAlloc HeapSize SetUnhandledExceptionFilter SetHandleCount GetStdHandle VirtualFree

user32

BringWindowToTop SetFocus wsprintfA GetDC ReleaseDC ShowWindow SetWindowPos SetActiveWindow SetForegroundWindow

gdi32

GetDeviceCaps

advapi32

RegCloseKey RegOpenKeyExA RegEnumKeyExA RegQueryInfoKeyA RegQueryValueExA SetNamedSecurityInfoA SetEntriesInAclA GetNamedSecurityInfoA GetUserNameA RegDeleteKeyA

ole32

CoCreateInstance

oleaut32

SysAllocString VariantChangeType VariantClear SysAllocStringLen SysStringLen LoadRegTypeLi SysFreeString

atl

ord15 ord57 ord18 ord16 ord21 ord32 ord58 ord30 ord31 ord23

rpcrt4

UuidCreate UuidToStringA

$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe

IMPHASH a56a9c58ddb2b2da8fde66551747ce70
SHA256 db6885decc954136455b54731b8b8937396d45c261134eda8ef58e3144650457
MD5 0d1cca1c19703fc33b0bac7ea413bbba
SHA1 79c0021638bec535d8c1394aa2deb9f580d65692
SHA512 0f56db4c4757e4c7dd7bb9c4e2951ea76f2accae73d3b60f2a9a164fba358ec29c4f07c1fae3f4614ff4310c3a8f9b64b47fc7593512f419d733821eedb27218
SSDEEP 96:YFw199EdjXxf7FsS7bVs2ddqB4DDZH/6:919CZfsS7bVbddqaHZH/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ed0601de9daaf2befcc7d488324c2b39_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_2_/$R0

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl

rpcrt4

generic

$_2_/$R2/NSIS.Library.RegTool.v2.$_4_.exe

kernel32

oleaut32

advapi32

user32

ole32

generic