10516b313f7cc36c07918f6fe6666017_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
10516b313f7cc36c07918f6fe6666017_JaffaCakes118
Size 339KB
Sample240503-mphw7acf7t
SHA256 e6dbe8a4bbb6d337ad5b42ada7b7323552e33c503a58f4d5ed7a5792df9a9e13
MD5 10516b313f7cc36c07918f6fe6666017
SHA1 0292ad3a8a8f879af013f27b486a1091445637b0
SHA512 02119628e796514f7197dde806ec18d8fc1fab6a0f8d65f2dda2fcfa13dce0984f4607497bc325017111b3bfef648ef8ce0e740639c8fcf5b4bd6ad52dca76d5
SSDEEP 6144:UFJ0VtdtHbhiRh7Sm12P1pPWxHsvlP++6H4xcRvwiaT2phmQwNmGkgb:13tG7Sm0PW8oH4qX3phmVm8
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

10516b313f7cc36c07918f6fe6666017_JaffaCakes118

.exe 339KB
beeiibcjea.exe

.exe 538KB

10516b313f7cc36c07918f6fe6666017_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 e6dbe8a4bbb6d337ad5b42ada7b7323552e33c503a58f4d5ed7a5792df9a9e13
MD5 10516b313f7cc36c07918f6fe6666017
SHA1 0292ad3a8a8f879af013f27b486a1091445637b0
SHA512 02119628e796514f7197dde806ec18d8fc1fab6a0f8d65f2dda2fcfa13dce0984f4607497bc325017111b3bfef648ef8ce0e740639c8fcf5b4bd6ad52dca76d5
SSDEEP 6144:UFJ0VtdtHbhiRh7Sm12P1pPWxHsvlP++6H4xcRvwiaT2phmQwNmGkgb:13tG7Sm0PW8oH4qX3phmVm8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1e:3a:63:3a:c9:cf:34:87:29:a3:b6:38:c5:a4:52:19:9a:e8:c4:df

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Great ApPs TlD,O=Great ApPs TlD,L=Dublin,ST=Dublin,C=IE

Chains

May 2, 2024

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

beeiibcjea.exe

IMPHASH 3482a83942e73ad4b6d45788d049b56f
SHA256 dccc0c35c9c633afe40c4e2db6b2b55cb836887e2d48540f835b4a0bb9ed7b6e
MD5 54fa8dd2d61c6dd39fe304e26620d36d
SHA1 177332ee322db4f3c41cbc93d2f77ce9c5657267
SHA512 fbea379fbb25dbc740668883200eb5857538d20b08ed38af09a05f8b8f985a41ef1da1dfb1ac8cdc5c456457390624118fd121c5b65c85a3728fff6a94f99923
SSDEEP 12288:P/HeIuvYRE8t6vh/Bfj4Rx8C9mfS/SKV83PnNTb:P2IuvYREffkRx8OSyQPFb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

76:76:b8:59:b4:6d:5d:e9:28:18:55:98:b4:fc:a6:bb:c1:8a:aa:66

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Great ApPs TlD,O=Great ApPs TlD,L=Dublin,ST=Dublin,C=IE

Chains

May 2, 2024

Minor OS version

Major OS version

Entry point

298648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

kernel32

InterlockedDecrement DecodePointer LockResource GlobalAlloc GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess ExitProcess RaiseException GetCurrentThreadId GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource MulDiv lstrcmpW GetModuleFileNameW FindResourceW MultiByteToWideChar GetCommandLineW GlobalHandle GlobalFree CreateThread GetVersion GetExitCodeProcess WaitForSingleObject Sleep CloseHandle CreateProcessW DeleteFileW GetVolumeInformationW IsWow64Process WideCharToMultiByte SetEvent HeapAlloc HeapReAlloc HeapFree TlsAlloc GetProcessHeap LocalFree SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage WriteFile GetStdHandle GetSystemTimeAsFileTime AreFileApisANSI GetProcAddress GetModuleHandleExW RtlUnwind EncodePointer OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead TerminateProcess TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW FlushFileBuffers GetConsoleCP GetConsoleMode GetFileType TlsSetValue ReadFile SetFilePointerEx GetTimeZoneInformation QueryPerformanceCounter GetCurrentProcessId TlsGetValue GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW CreateFileW SetEndOfFile HeapSize CreateDirectoryW

user32

GetSysColor ClientToScreen MessageBoxW MessageBoxA GetClientRect FillRect GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint GetWindowLongW SetWindowLongW GetWindowTextLengthW GetDesktopWindow GetParent GetClassNameW GetWindow LoadCursorW CreateDialogIndirectParamW EndDialog GetSystemMetrics GetWindowRect SetWindowContextHelpId MapDialogRect GetMessageW TranslateMessage DispatchMessageA BeginPaint ReleaseDC GetDC UpdateWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW SendDlgItemMessageW GetDlgItem SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW RegisterWindowMessageW PostMessageW PostThreadMessageW SetTimer KillTimer ScreenToClient

gdi32

SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC GetObjectW BitBlt CreateCompatibleBitmap

advapi32

RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

ShellExecuteW Shell_NotifyIconW SHGetFolderPathW

ole32

CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize OleLockRunning CreateStreamOnHGlobal CoInitialize CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance

oleaut32

LoadTypeLi SysFreeString SysAllocStringLen SysStringLen VariantCopy SysAllocStringByteLen SysStringByteLen DispCallFunc OleCreateFontIndirect LoadRegTypeLi VariantInit VariantClear SysAllocString

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

10516b313f7cc36c07918f6fe6666017_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

beeiibcjea.exe

PE Signature issue

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

iphlpapi

generic