40372e9a37465e5e01b8ebfbd88f45ac_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
40372e9a37465e5e01b8ebfbd88f45ac_JaffaCakes118
Size 453KB
Sample240513-s6e5hsdd66
SHA256 fae1b57d8cd9b0cb380e5d78938652e04007c4d78ea7f8a29da9c32570859f02
MD5 40372e9a37465e5e01b8ebfbd88f45ac
SHA1 792c62fb53f1e9dc167fe4f79a1241254ea848d6
SHA512 9f75db86a9f7a738f86b95682a95082512da7e1b75644b41b4ed6896d2502b9cfc57782ecf4d297762cea87d54d6499cdf0fbaaa3e388438cf6866fde06f8217
SSDEEP 6144:+GYgXWlQwIixl+QNIOyoHkjaB0n9hB3kt/65EbZ53abQ6teSUttZaSCFs02A4:zDG8if9GjGZsblteVEFslT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
40372e9a37465e5e01b8ebfbd88f45ac_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TvGetVersion.dll

File Explorer

40372e9a37465e5e01b8ebfbd88f45ac_JaffaCakes118

.exe 453KB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/TvGetVersion.dll

.dll 153KB
$PLUGINSDIR/wincheck.ini

185B
$_3_/tvqsfiles.7z

.7z 55KB

40372e9a37465e5e01b8ebfbd88f45ac_JaffaCakes118

IMPHASH 7192d3773f389d45ebac3cc67d054a8a
SHA256 fae1b57d8cd9b0cb380e5d78938652e04007c4d78ea7f8a29da9c32570859f02
MD5 40372e9a37465e5e01b8ebfbd88f45ac
SHA1 792c62fb53f1e9dc167fe4f79a1241254ea848d6
SHA512 9f75db86a9f7a738f86b95682a95082512da7e1b75644b41b4ed6896d2502b9cfc57782ecf4d297762cea87d54d6499cdf0fbaaa3e388438cf6866fde06f8217
SSDEEP 6144:+GYgXWlQwIixl+QNIOyoHkjaB0n9hB3kt/65EbZ53abQ6teSUttZaSCFs02A4:zDG8if9GjGZsblteVEFslT
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW LoadLibraryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle GlobalFree lstrcmpW GlobalAlloc WaitForSingleObject GetDiskFreeSpaceW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW GetDC SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow LoadImageW SetWindowLongW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint SetTimer FindWindowExW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 d239e6ca779f822e2f28ef9a86bdbbd7a5ea9c7641b7a62a37c9b45b15dc5c8a
MD5 44a147533d1439c7b6ef37e2153e3c00
SHA1 1f7c3bce46180b1e791b8fc27f576c8c39881e18
SHA512 85380b45fcc3803c38b9092ed5f310c80390bb40502f2d09599922f0db03b4ea44c7a8c9ddb5ce9d0b6a95c54ae3d79cb58609b197f64f383dacb931c38fd482
SSDEEP 384:ECC43tPegZ3eBaRwCPOYY7nNYXCm/Yosa:ELTgZ3eBTCmrnNAC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
MD5 ee260c45e97b62a5e42f17460d406068
SHA1 df35f6300a03c4d3d3bd69752574426296b78695
SHA512 a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
SSDEEP 192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TvGetVersion.dll

IMPHASH b4c79c4c6d966b4c5d11eda2d0cc1190
SHA256 01abf435f6dcc89560a068a9af0c2e6f067d7d4b1a6a0b848b40ecb907885d11
MD5 d2c761a29981f8469a4c3071db73cd02
SHA1 7e3fa24665b4ddd615dbc2e9b07dd73595836930
SHA512 420e33d24da8392037a3afd413df96cc650b5c5a25de1e10d0859cf926b149a77197bbcd59313b0a96e115add4c7ad7fe712a6d14bb072cb46eb6bd62a1d369c
SSDEEP 3072:Tyht+x43dp/t1/kZfj1SvXTmj0OslQaG5Ewyi:eExEXt1Cb1SEslQavw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrChrW StrRChrW

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

msi

ord45 ord141 ord16 ord70

kernel32

lstrlenA lstrcpyW lstrcpynW Sleep GetVersionExW LocalFree FreeLibrary LoadLibraryW WaitForSingleObject OpenProcess TerminateProcess DeleteFileW GetWindowsDirectoryW GetTempPathW InterlockedDecrement WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar RtlUnwind CreateDirectoryW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExW MoveFileW GetCurrentThreadId DecodePointer GetCommandLineA EncodePointer HeapAlloc RaiseException HeapFree IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetCPInfo InterlockedIncrement lstrlenW GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError lstrcpynA GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetFileType GetCurrentDirectoryW ExitProcess SetHandleCount GetStdHandle GetStartupInfoW lstrcatW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize WriteFile SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap GetTimeZoneInformation HeapReAlloc WriteConsoleW CompareStringW SetEnvironmentVariableA GetDriveTypeW CreateFileW GetFileSize GlobalAlloc ReadFile lstrcmpiA lstrcpyA CloseHandle GlobalFree GetLastError GetCurrentProcessId GetModuleHandleW GetProcAddress VerSetConditionMask VerifyVersionInfoW lstrcmpiW GetACP DeleteCriticalSection

user32

SendMessageW wsprintfW PostMessageW GetSystemMetrics

gdi32

AddFontResourceExW RemoveFontResourceExW

winspool.drv

EnumPrintProcessorsW EnumPrinterDriversW

advapi32

RegCreateKeyExW RegEnumValueW RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegDeleteKeyW GetUserNameW LookupAccountNameW RegOpenKeyExA ControlService StartServiceW OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatus RegOpenKeyExW RegFlushKey ChangeServiceConfig2W RegDeleteValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegQueryValueExA ConvertSidToStringSidW DeleteService

shell32

SHFileOperationW ShellExecuteExW

ole32

CoInitialize CoUninitialize CLSIDFromString CLSIDFromProgID OleRun CoCreateInstance

oleaut32

SysAllocString SysFreeString GetErrorInfo

40372e9a37465e5e01b8ebfbd88f45ac_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/TvGetVersion.dll

shlwapi

wtsapi32

msi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/wincheck.ini

$_3_/tvqsfiles.7z