3f300257c2e1cd134e5701aba4244c36_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
3f300257c2e1cd134e5701aba4244c36_JaffaCakes118
Size 1.5MB
Sample240513-m8635acf24
SHA256 42f4921a7991e07e91787da231c892d3af1abecb2e848a2bbe297ebd1df36ead
MD5 3f300257c2e1cd134e5701aba4244c36
SHA1 605d344c15b8b164ad5f702348a29251ffde4610
SHA512 f76db4c0969ee22c4a2daa8f16dc780466d5051dfc80c10b71c009a55347222c849362d2f6ac231f061ebf203420350046abeeeb336f207f0836508aab7719f3
SSDEEP 49152:32/rQq04mxWXv+fu3Is6eg0F/mAgXQiwy:GTQsgWXJYsS0F/mqiwy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Dumpper.exe
unpack001/JumpLittle.exe
unpack001/WpsWin.exe

File Explorer

3f300257c2e1cd134e5701aba4244c36_JaffaCakes118

.zip 1.5MB
Dumpper.exe

.exe 1.9MB
JumpLittle.exe

.exe 1.6MB
PinList.txt

1KB
SoftDroids.url

112B
WpsWin.exe

.exe 116KB
readme.txt

62B

3f300257c2e1cd134e5701aba4244c36_JaffaCakes118

SHA256 42f4921a7991e07e91787da231c892d3af1abecb2e848a2bbe297ebd1df36ead
MD5 3f300257c2e1cd134e5701aba4244c36
SHA1 605d344c15b8b164ad5f702348a29251ffde4610
SHA512 f76db4c0969ee22c4a2daa8f16dc780466d5051dfc80c10b71c009a55347222c849362d2f6ac231f061ebf203420350046abeeeb336f207f0836508aab7719f3
SSDEEP 49152:32/rQq04mxWXv+fu3Is6eg0F/mAgXQiwy:GTQsgWXJYsS0F/mqiwy
MD5 SHA1 SHA512 SSDEEP

Dumpper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5be6d1e3596ede9739619e65382dc430fe0ab0cd3d2fcc1f0784728370fa5c7d
MD5 9cd55bd482a981987652da2516cff9e1
SHA1 eb2b52bbbe10b8aabfc69cb36cc55e4c27c64697
SHA512 877532be4422f25311a9ecc9f15798f8115d972e642d9935b88c242afa21a97b2aab912c1c6af37efb700a3c815c5bffc6e424a74d0d6d78b529a45c63f1a48d
SSDEEP 24576:5bzJTmVFIcXFIcLFIcg7FIcltfkJenGzzK/290SbuFaD30kPFIcRdFIcXFIcJiFj:3mDLbmJxMJeGzm/u0S30kNLLW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1900158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Sky\Documents\Dumpper v.90.7\Dumpper\obj\x86\Debug\Dumpper.pdb

JumpLittle.exe

IMPHASH 1d15063d1798e96e93f9fbb81fc51523
SHA256 177023c40080306164e32221c019b31dd91df3f94dce19a2416a74ae9061917f
MD5 1e0fe724ac8eee75461aa814c480705d
SHA1 baacf249a900cf87e0b0ec920c0dbdfe63878fc4
SHA512 733f0c773c7e1d88ea4bec0ee66895b094ad04c0eb2a8d06e84d1b7943fb1dbf5389bc8db78c2ef7e42bbd3c6fd6d6218d9847d51cc3e6ad96de4380c5164f47
SSDEEP 12288:Ke0SbVugzijPUrRUBqh1H5svFLoEcOZp7xdXB1a7cnyz9vSxb+pXu76tu76gIq2L:GQVPijPsekOZJxdBMzh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

410182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

avifil32

AVIStreamGetFrame AVIStreamGetFrameClose AVIStreamInfoW AVIStreamSampleToTime AVIStreamStart AVIStreamLength AVIStreamGetFrameOpen AVIStreamOpenFromFileW AVIFileInit AVIFileExit AVIStreamRelease

msvfw32

DrawDibOpen DrawDibDraw DrawDibClose

shlwapi

SHDeleteKeyW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW PathRemoveExtensionW

crypt32

CryptProtectData CryptUnprotectData

kernel32

GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GlobalFlags GlobalGetAtomNameW GetAtomNameW SetErrorMode FileTimeToLocalFileTime LocalFileTimeToFileTime SetFileTime SetFileAttributesW GetFileAttributesW GetFileTime GetCurrentDirectoryW FindResourceExW HeapFree HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue RtlUnwind VirtualAlloc GetSystemInfo VirtualQuery GetSystemTimeAsFileTime HeapReAlloc ExitProcess ExitThread CreateThread HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter FatalAppExitA GetCPInfo GetTimeFormatA GetDateFormatA GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode SetConsoleCtrlHandler GetTimeZoneInformation SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA LocalAlloc VirtualProtect SuspendThread SetThreadPriority GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW ReleaseMutex CreateMutexW ReleaseSemaphore CreateSemaphoreW CreateFileW GetShortPathNameW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile lstrcmpiW GetStringTypeExW GetCurrentProcessId FreeResource GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW lstrcmpW GetVersionExA GetModuleHandleA GetModuleHandleW WideCharToMultiByte SystemTimeToFileTime FileTimeToSystemTime GetThreadLocale SetLastError GlobalFree CopyFileW GlobalSize GlobalAlloc GlobalLock GlobalUnlock MulDiv LoadLibraryA ExpandEnvironmentStringsA lstrlenW WinExec GetWindowsDirectoryW lstrcpyW FormatMessageW GetSystemDirectoryW LocalFree WaitForMultipleObjects ResetEvent SetEvent GetLocalTime GetCurrentThreadId MoveFileW CreateDirectoryW lstrlenA GetProcAddress GetVersionExW FreeLibrary GetCurrentProcess DuplicateHandle ResumeThread WaitForSingleObject CreateEventW GetLastError CloseHandle LoadLibraryW GetModuleFileNameW MultiByteToWideChar LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetTempPathW GetTickCount Sleep DeleteFileW InterlockedDecrement FindResourceW LoadResource LockResource SizeofResource InterlockedIncrement RaiseException

user32

WaitMessage DestroyIcon GetDialogBaseUnits TranslateAcceleratorW SetMenu BringWindowToTop SetRectEmpty CreatePopupMenu InsertMenuItemW LoadAcceleratorsW LoadMenuW ReuseDDElParam UnpackDDElParam IsRectEmpty GetSystemMenu SetParent UnionRect SetRect GetDCEx LockWindowUpdate GetAsyncKeyState ShowOwnedPopups GetMessageW TranslateMessage GetActiveWindow ValidateRect PostQuitMessage MapVirtualKeyW GetKeyNameTextW MsgWaitForMultipleObjects CharUpperW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetWindowThreadProcessId InflateRect RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW BeginDeferWindowPos EndDeferWindowPos GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints ScrollWindow TrackPopupMenuEx TrackPopupMenu GetKeyState SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar IsWindowVisible UpdateWindow GetMenu MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW ReleaseCapture EqualRect UnregisterClassA GetScrollInfo SetScrollInfo CopyRect SetWindowPlacement DefWindowProcW CallWindowProcW IntersectRect SystemParametersInfoA GetWindowPlacement GetFocus SetWindowPos ScrollWindowEx SetFocus ShowWindow MoveWindow GetDlgCtrlID SetWindowTextW GetWindowLongW IsDialogMessageW IsDlgButtonChecked SetDlgItemTextW SetDlgItemInt SendDlgItemMessageW GetDlgItemTextW GetDlgItemInt GetDlgItem CheckRadioButton CheckDlgButton GetWindow WindowFromPoint SetCapture EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect UnhookWindowsHookEx GetWindowTextLengthW GetWindowTextW GetMenuState GetMenuStringW AppendMenuW GetMenuItemID InsertMenuW GetMenuItemCount DeleteMenu SystemParametersInfoW DestroyMenu GetMenuItemInfoW UnregisterClassW GetSysColorBrush GetDesktopWindow GetSubMenu RemoveMenu LoadCursorW CopyIcon DestroyCursor GetCursorPos SetCursor SetWindowLongW DrawEdge PtInRect LoadIconW IsIconic DrawIcon RedrawWindow GetClipboardData CloseClipboard OpenClipboard PostMessageW SendMessageW EnableWindow SetTimer GetSystemMetrics GetSysColor IsWindow KillTimer GetParent InvalidateRect GetClientRect GetWindowRect OffsetRect CreateDialogIndirectParamW GetNextDlgTabItem EndDialog AdjustWindowRectEx MapDialogRect IsWindowEnabled DeferWindowPos

gdi32

SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetCurrentPositionEx ArcTo PolyDraw PolylineTo PolyBezierTo RectVisible DeleteDC CreateDIBPatternBrushPt CreatePatternBrush SelectPalette PlayMetaFileRecord GetObjectType PtVisible PlayMetaFile CreatePen ExtCreatePen OffsetViewportOrgEx CreateSolidBrush CreateHatchBrush GetDCOrgEx CreateRectRgnIndirect SetRectRgn CombineRgn GetMapMode DPtoLP EnumFontFamiliesExW GetCharWidthW CreateFontW StretchDIBits GetBkColor SetViewportOrgEx SelectObject GetClipRgn SelectClipRgn CreateFontIndirectW PatBlt StartDocW GetPixel GetObjectW GetWindowExtEx GetViewportExtEx Escape CreateRectRgn TextOutW GetStockObject GetTextMetricsW EnumMetaFile MaskBlt BitBlt CreateCompatibleDC CreateCompatibleBitmap ExtSelectClipRgn CreateBitmap DeleteObject SetColorAdjustment SetArcDirection SetMapperFlags SetTextCharacterExtra SetTextAlign MoveToEx LineTo OffsetClipRgn IntersectClipRect ExcludeClipRect GetClipBox SetMapMode ModifyWorldTransform SetWorldTransform SetGraphicsMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CreateDCW CopyMetaFileW GetDeviceCaps GetTextExtentPoint32W SetTextJustification ExtTextOutW SelectClipPath

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegSetValueW RegOpenKeyExA RegQueryValueExA RegQueryValueW RegEnumValueW RegEnumKeyExW RegFlushKey GetLengthSid RegDeleteValueW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegCreateKeyW

shell32

DragQueryFileW ShellExecuteW SHGetFileInfoW ExtractIconW SHGetSpecialFolderPathW DragFinish

ole32

ReadClassStg ReadFmtUserTypeStg OleRegGetUserType WriteClassStg WriteFmtUserTypeStg CreateBindCtx CoTaskMemFree StringFromGUID2 CLSIDFromString CoInitialize CoCreateGuid CoCreateInstance ReleaseStgMedium CoTaskMemAlloc CoTreatAsClass StringFromCLSID OleDuplicateData CoDisconnectObject SetConvertStg

oleaut32

VarBstrFromDec VarBstrFromCy VarCyFromStr SysAllocStringByteLen SysReAllocStringLen VarDateFromStr SysAllocStringLen SysStringLen SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayDestroy SafeArrayUnlock SafeArrayLock VarDecFromStr SafeArrayPtrOfIndex SafeArrayGetElement SafeArrayCopy VariantInit VariantClear SafeArrayGetDim SysAllocString SysFreeString SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayCreate SafeArrayRedim VarBstrFromDate SafeArrayPutElement SafeArrayAllocData VariantChangeType SysStringByteLen VariantCopy SafeArrayAllocDescriptor

WpsWin.exe

IMPHASH 79a6d0a2f3147943a651e965147d60ee
SHA256 93229a919e830257dc87bfd9ec11e5e1ddfbf18425484e4450db7329e6d0c1d8
MD5 d474eaeb9542d2be2ac1853936bb774b
SHA1 fe3f8f6e062f2459d850bd830e5912e28521dfa6
SHA512 aa0e33c63c300d12d40b16e12a604fcd9cf20f6e224200b4e23e22892385a8b1f25047ad3749fbd1109109cc07e8fd13a961a552d643c5b627d75c90f524b366
SSDEEP 1536:2HfAdWzJ21mXEE0HPJYCXquUicQWaTl5uodcrTyon335+JgiMxcWbS:2HYWzJ+3E0ZhUrQWQXLcln5+JgiM0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28817

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\SkyVirtual\Desktop\WCN Sample (Mod)\Release\WpsWin.pdb

wlanapi

WlanOpenHandle WlanCloseHandle WlanEnumInterfaces WlanSetProfile WlanFreeMemory

kernel32

SetUnhandledExceptionFilter LoadLibraryW SetStdHandle WriteConsoleW RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement WideCharToMultiByte GetCurrentThreadId SetEvent GetVersion CreateEventW ResetEvent CloseHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapReAlloc GetStringTypeW SetFilePointer ReadFile GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW EncodePointer DecodePointer Sleep InitializeCriticalSection EnterCriticalSection LeaveCriticalSection RtlUnwind HeapFree GetCommandLineW HeapSetInformation LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter CreateFileW IsDebuggerPresent TerminateProcess GetCurrentProcess WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount GetStdHandle GetFileType GetStartupInfoW GetProcAddress GetModuleHandleW ExitProcess GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate HeapSize GetModuleFileNameW GetLocaleInfoW FreeEnvironmentStringsW

user32

PostThreadMessageW

ole32

CoCreateInstance CoReleaseServerProcess CoUninitialize CoInitializeEx CoWaitForMultipleHandles StringFromGUID2 PropVariantClear CoAddRefServerProcess

3f300257c2e1cd134e5701aba4244c36_JaffaCakes118

Dumpper.exe

mscoree

dotnet

JumpLittle.exe

version

avifil32

msvfw32

shlwapi

crypt32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

ole32

oleaut32

generic

PinList.txt

SoftDroids.url

WpsWin.exe

wlanapi

kernel32

user32

ole32

generic

readme.txt