neshta | faedecbc8ac500275e912b6e22d8f9a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
faedecbc8ac500275e912b6e22d8f9a2_JaffaCakes118
Size 2.1MB
Sample240419-xbf6jsdb5w
SHA256 b57d8d85d1e71a18b98c4e245e2b2da5e9dbb4ff36a6f5d2d88e9ea5c3549410
MD5 faedecbc8ac500275e912b6e22d8f9a2
SHA1 c361bdac3f09706d7eb689626fedc1279087df87
SHA512 ac8a9625342f2a8448684373b19117c1ca7700383cc37506f7e33999eb78ac29eafb594f3dfbea17617a4c430f04b3f7470f3e3cc638ef909324b6884446a27d
SSDEEP 49152:DS02EDe4ogzwvMMjsT9N9Rh9hhLniyTIv:DP2P4o31wHGyTI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

File Explorer

faedecbc8ac500275e912b6e22d8f9a2_JaffaCakes118

.exe 2.1MB

faedecbc8ac500275e912b6e22d8f9a2_JaffaCakes118

IMPHASH 6eb054e03f1be9ccf49548ee097cad32
SHA256 b57d8d85d1e71a18b98c4e245e2b2da5e9dbb4ff36a6f5d2d88e9ea5c3549410
MD5 faedecbc8ac500275e912b6e22d8f9a2
SHA1 c361bdac3f09706d7eb689626fedc1279087df87
SHA512 ac8a9625342f2a8448684373b19117c1ca7700383cc37506f7e33999eb78ac29eafb594f3dfbea17617a4c430f04b3f7470f3e3cc638ef909324b6884446a27d
SSDEEP 49152:DS02EDe4ogzwvMMjsT9N9Rh9hhLniyTIv:DP2P4o31wHGyTI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Neshta payload

PE Signature issue

Digest

e9:db:54:a1:37:d7:71:c2:c8:a9:55:53:17:65:8b:31:da:3f:be:f2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Blizzard Entertainment,OU=TECHNICAL SUPPORT,O=Blizzard Entertainment,L=Irvine,ST=California,C=US

Chains

Jan 14, 2009

Minor OS version

Major OS version

Entry point

656335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\buildserver\work-launcher-2-0\core-repository\branches\launcher-2-0\downloader\release\BlizzardDownloader.pdb

iphlpapi

GetTcpTable GetAdaptersInfo

wininet

HttpQueryInfoA InternetReadFileExA InternetCloseHandle InternetGetConnectedState InternetSetStatusCallbackA InternetReadFile InternetCrackUrlA InternetSetStatusCallback InternetSetCookieA HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetConnectA InternetOpenA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

comctl32

ord17

rpcrt4

UuidCreate

ws2_32

__WSAFDIsSet gethostname connect closesocket bind ntohs send recv getsockname htons gethostbyname ntohl htonl inet_ntoa socket getsockopt setsockopt WSAStartup WSASetLastError WSAGetLastError select ioctlsocket accept WSACleanup listen getpeername

kernel32

InterlockedExchange OpenMutexA WriteFile SetEvent CompareStringA CompareStringW DeleteFileA CopyFileA GetCurrentDirectoryA CreateThread WaitForSingleObject CreateFileA CreateMutexA GetModuleHandleA MulDiv GetFileSize GlobalFree GlobalAlloc FreeResource SizeofResource LockResource LoadResource FindResourceA FreeLibrary GetCurrentProcessId GetCurrentThreadId CreateEventA GetThreadLocale SetEnvironmentVariableA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID EnterCriticalSection GetLastError GetStringTypeA GetLocaleInfoA GetDriveTypeA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP GetACP GetConsoleMode GetConsoleCP GetFileType SetHandleCount HeapCreate HeapDestroy HeapSize GetStdHandle GetCPInfo LCMapStringW LCMapStringA SetConsoleCtrlHandler ExitThread GetFullPathNameA GetStartupInfoA GetProcessHeap GetCommandLineA VirtualQuery HeapAlloc HeapReAlloc ExitProcess HeapFree UnhandledExceptionFilter TerminateProcess RaiseException RtlUnwind VirtualFree VirtualAlloc SetLastError SetFileTime SetEndOfFile RemoveDirectoryA CreateDirectoryA GetShortPathNameA FlushFileBuffers FindFirstFileA FindNextFileA FindClose SetCurrentDirectoryA TlsSetValue DuplicateHandle CreateProcessA WaitForSingleObjectEx MoveFileA GetFileAttributesA GetFileAttributesExA GetCurrentThread InterlockedIncrement InterlockedDecrement SetFilePointer ReadFile GetDiskFreeSpaceA GetComputerNameA GetVersionExA GetDiskFreeSpaceExA SetFileAttributesA CloseHandle LoadLibraryA GetProcAddress MultiByteToWideChar WideCharToMultiByte GetUserDefaultLangID GetTempFileNameA GetModuleFileNameA Sleep LeaveCriticalSection DeleteCriticalSection GetStringTypeW TlsAlloc InitializeCriticalSection GetSystemInfo GetCurrentProcess IsDebuggerPresent GetExitCodeProcess TlsGetValue TlsFree SignalObjectAndWait GetSystemTimeAsFileTime FileTimeToLocalFileTime GetTempPathA GetTickCount FileTimeToSystemTime SetUnhandledExceptionFilter

user32

ReleaseDC wsprintfA TrackPopupMenu GetMenuItemInfoA GetMenuStringA GetMenuItemID IsMenu GetClassNameA GetFocus DrawFocusRect BeginPaint EndPaint DestroyIcon IsZoomed CreateWindowExA DrawIconEx IsWindowEnabled SetWindowRgn TrackMouseEvent MsgWaitForMultipleObjects WaitForInputIdle SetTimer KillTimer GetWindowTextA SendMessageA GetDlgItem MoveWindow DefWindowProcA GetWindowDC OffsetRect SetRect InflateRect LoadMenuA LoadAcceleratorsA SetWindowsHookExA GetMenuItemCount GetSubMenu IsIconic DrawIcon DestroyMenu UnhookWindowsHookEx TranslateAcceleratorA CallNextHookEx GetDlgCtrlID GetClientRect GetSystemMetrics GetScrollInfo SystemParametersInfoA SetWindowPos CopyImage DrawTextA EnumChildWindows GetWindowTextLengthA GetParent SetPropA GetWindowLongA GetCapture SetCapture ClientToScreen PtInRect ReleaseCapture LoadCursorA SetCursor GetPropA CallWindowProcA RemovePropA GetDesktopWindow IsWindowVisible EnableWindow LoadImageA CreateDialogParamA BringWindowToTop SetFocus GetMenu ModifyMenuA DialogBoxParamA SetForegroundWindow SetWindowLongA GetDC ScreenToClient FillRect DestroyWindow CheckDlgButton IsDlgButtonChecked EndDialog MessageBoxA SetDlgItemTextA SetWindowTextA LoadIconA ShowWindow InvalidateRect FindWindowA EnumWindows GetWindowThreadProcessId PostMessageA IsWindow GetWindowRect

gdi32

CreatePen MoveToEx LineTo Rectangle GetPixel BitBlt GetTextExtentPoint32A CreateRectRgnIndirect CreateRectRgn GetDeviceCaps GetObjectA SelectClipRgn GetTextColor SaveDC RestoreDC DeleteDC CreatePolygonRgn CreateFontIndirectA DeleteObject SetBkMode SetBkColor SetTextColor GetStockObject StretchBlt CreateCompatibleDC CreateCompatibleBitmap CreateSolidBrush SelectObject SetPixel ExcludeClipRect CreateEllipticRgn

comdlg32

GetSaveFileNameA

advapi32

RegEnumKeyExA RegCloseKey RegQueryValueExA GetUserNameA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteKeyA RegSetValueExA RegCreateKeyExA

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA ShellExecuteA Shell_NotifyIconA

ole32

OleCreate OleInitialize CreateStreamOnHGlobal OleSetContainedObject CoCreateInstance CoInitialize CoUninitialize

oleaut32

OleLoadPicture VariantInit VariantClear SysStringLen SysFreeString SysAllocString

msimg32

TransparentBlt