47a07ebff730989778f2a11ac9781d9c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

47a07ebff730989778f2a11ac9781d9c_JaffaCakes118
Size

6.3MB
MD5

47a07ebff730989778f2a11ac9781d9c
SHA1

2d57fb0157df25c8aafed9652bdaad61118e0a58
SHA256

86822a7118732aab60e0b6e7d350e18a7ecf21fbedf490291059ddcbada4ceba
SHA512

de0c8bd7a264b425f0d1a4a34b4fc31e374872203fe9df4549f0a7d3ef66e5ccbaaecc04722e3564d435eedcdb5b0b50f79b40d0995711944e2800bc4dd6e507
SSDEEP

196608:grTC1KPcttRHFrCQEY7lROFBJ954OtFVyK4+RBII4:gCEPctTVsYmlqOtuaB/4

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

47a07ebff730989778f2a11ac9781d9c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9d548587322094d0e87b2c91202a14ff

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:b3:dd:99:26:ca:1c:40:82:3e:38:31:cf:65:94:4d
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

31/07/2015, 00:00

Not After

30/07/2016, 23:59

Subject

CN=sirwilfridlauriertechnology.com,O=sirwilfridlauriertechnology.com,L=Montreal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

74:f1:2c:30:08:d3:f6:21:ca:21:c8:54:cf:0a:0b:ae:d9:90:fe:bc
Signer

Actual PE Digest

74:f1:2c:30:08:d3:f6:21:ca:21:c8:54:cf:0a:0b:ae:d9:90:fe:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

MultiByteToWideChar
GetShortPathNameA
CreateDirectoryA
SetCurrentDirectoryA
FindFirstFileA
GetLastError
lstrcmpiA
GetProcAddress
SearchPathA
SetFileAttributesA
GlobalFree
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
MoveFileA
FindNextFileA
GetModuleHandleA
LoadLibraryExA
CloseHandle
DeleteFileA
GetFileSize
GetTickCount
GetModuleFileNameA
ExitProcess
SetErrorMode
GetCurrentProcess
GetWindowsDirectoryA
GetCommandLineA
CopyFileA
GetTempPathA
lstrcpynA
GlobalLock
GlobalUnlock
LoadLibraryA
GetDiskFreeSpaceA
CreateThread
CreateFileA
lstrlenA
CreateProcessA
GetSystemDirectoryA
lstrcatA
RemoveDirectoryA
GetTempFileNameA
GetVersion
SetStdHandle
WaitForSingleObject
IsProcessorFeaturePresent
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
ReadFile
LCMapStringW
HeapSize
RtlUnwind
HeapFree
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
EncodePointer
HeapCreate
GetModuleFileNameW
GetStdHandle
DecodePointer
GetModuleHandleW
GetStartupInfoW
HeapSetInformation
HeapAlloc
CompareFileTime
FreeLibrary
SetFilePointer
lstrcmpA
GetFullPathNameA
CreateFileW
MulDiv
GetExitCodeProcess
GetFileAttributesA
Sleep
GlobalAlloc
WriteFile
SetFileTime
GetStringTypeW
ExpandEnvironmentStringsA
WriteConsoleW

user32

SetCursor
DispatchMessageA
wvsprintfA
PeekMessageA
CharPrevA
MessageBoxIndirectA
SetDlgItemTextA
GetDlgItemTextA
DefWindowProcA
BeginPaint
GetClientRect
DrawTextA
FillRect
CloseClipboard
GetSystemMenu
ScreenToClient
GetWindowRect
TrackPopupMenu
LoadBitmapA
IsWindowEnabled
GetAsyncKeyState
GetWindowLongA
CreateWindowExA
EnableMenuItem
EmptyClipboard
SetClassLongA
EndDialog
SetWindowPos
CheckDlgButton
CreatePopupMenu
IsDlgButtonChecked
GetClassInfoA
AppendMenuA
OpenClipboard
SystemParametersInfoA
GetSystemMetrics
IsWindowVisible
SetClipboardData
CallWindowProcA
LoadCursorA
DialogBoxParamA
GetMessagePos
RegisterClassA
CharNextA
ExitWindowsEx
DestroyWindow
SetTimer
CreateDialogParamA
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
FindWindowExA
SendMessageA
GetDC
SetWindowLongA
InvalidateRect
GetDlgItem
SendMessageTimeoutA
ShowWindow
IsWindow
LoadImageA
EnableWindow
EndPaint
GetSysColor

gdi32

GetDeviceCaps
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
SelectObject
CreateBrushIndirect
SetBkColor

advapi32

RegSetValueExA
RegCloseKey
RegEnumKeyA
RegEnumValueA
RegDeleteValueA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
SHGetSpecialFolderLocation

ole32

OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
wie.dat

Sharing

General

Malware Config

Signatures

Files

9d548587322094d0e87b2c91202a14ff

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

01:b3:dd:99:26:ca:1c:40:82:3e:38:31:cf:65:94:4dCertificate

Extended Key Usages

Key Usages

74:f1:2c:30:08:d3:f6:21:ca:21:c8:54:cf:0a:0b:ae:d9:90:fe:bcSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 49KB - Virtual size: 49KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 162KB

.ndata Size: - Virtual size: 1.2MB

.rsrc Size: 16KB - Virtual size: 15KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

01:b3:dd:99:26:ca:1c:40:82:3e:38:31:cf:65:94:4d
Certificate

74:f1:2c:30:08:d3:f6:21:ca:21:c8:54:cf:0a:0b:ae:d9:90:fe:bc
Signer

.text
Size: 49KB - Virtual size: 49KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 162KB

.ndata
Size: - Virtual size: 1.2MB

.rsrc
Size: 16KB - Virtual size: 15KB