a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118
Size 165KB
Sample240612-2db2tswhnk
SHA256 05b3347fcddf440da243f5fc417202d7eb2ac56f66c69f77d8385a33be55c595
MD5 a2b1755bb08cb3b78e8fd58822e8efd8
SHA1 c8be1879a917e22bfd033c8413d7a6030f7db19e
SHA512 22aca352cedfae9366e5f7bd17fc0ae7f910ac11121024c84bed05fd1ed12360733a82f62126c6c83a8ed5a7f09725a9ba8b4b129e558b5cf6f3161317269eda
SSDEEP 3072:o5BuYAVrgUCPnNl5WMixBBJUtgHggM0BoEAQsDRP600F+219V7gO:o50gUCRWM4BUWuZhDRPRG+a9V/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/extra.dll	acprotect
static1/unpack001/$PLUGINSDIR/nsJSON.dll	acprotect
static1/unpack001/$PLUGINSDIR/sign.dll	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/extra.dll	upx
static1/unpack001/$PLUGINSDIR/nsJSON.dll	upx
static1/unpack001/$PLUGINSDIR/sign.dll	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118
unpack001/$PLUGINSDIR/extra.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack003/out.upx
unpack001/$PLUGINSDIR/sign.dll
unpack004/out.upx

File Explorer

a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118

.exe 165KB
$PLUGINSDIR/extra.dll

.dll 32KB
out.upx

.dll 71KB
$PLUGINSDIR/inetc.dll

.dll 55KB
$PLUGINSDIR/nsJSON.dll

.dll 7KB
out.upx

.dll 11KB
$PLUGINSDIR/sign.dll

.dll 32KB
out.upx

.dll 65KB

a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 05b3347fcddf440da243f5fc417202d7eb2ac56f66c69f77d8385a33be55c595
MD5 a2b1755bb08cb3b78e8fd58822e8efd8
SHA1 c8be1879a917e22bfd033c8413d7a6030f7db19e
SHA512 22aca352cedfae9366e5f7bd17fc0ae7f910ac11121024c84bed05fd1ed12360733a82f62126c6c83a8ed5a7f09725a9ba8b4b129e558b5cf6f3161317269eda
SSDEEP 3072:o5BuYAVrgUCPnNl5WMixBBJUtgHggM0BoEAQsDRP600F+219V7gO:o50gUCRWM4BUWuZhDRPRG+a9V/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

804KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/extra.dll

SHA256 cb6be9cbec2d166d3625ed511408ae0264581e03a9c8e0d1e895002025f6a9f3
MD5 ab83fde15027576dd5cdcf98e51e16a4
SHA1 7ff782eac9ef49875e7b922f5aedcbaf796b808f
SHA512 74317a5149b3f81e5e592a9bb4633a1ddeea49340c4996dda5d3487b1317b8e4623b0421215b02992b0e775c0f39b5f63a4c36602c3deb0155f80a7bd0282420
SSDEEP 768:SBVqOWmlI4xwVr7ukQCl2JU/0O4ohdiNpfIJfcN2Bh:SBqmlEJu4y402hdivfIJf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 e9b0ab3d14877d91c551169e82f17a39a813b253343854a6ed4cc70d790faecd
MD5 9a932233779885ff56e7ef9096f3394b
SHA1 fb433bb2de147a2f7aec30b24cc6d86b9f381750
SHA512 5b441be5b35d7d681f7634ce4758a5defc79b22a1dabadf8476fc9e14de9926ad1781f1757082b1bfa3f95b110a5c69753b6fcf5464b8ffa185967021373b5cb
SSDEEP 768:N2T8ovGWIfu9RjHG4AmYB30ZvLfpf18xzSpK2iid2gB8rr2o3h6D83wfxGbn2EEZ:SZIfu94RqvLxfc0dkr16sQST9QL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25479

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH e7e83b46cee8b40341749729cad26b36
SHA256 2ee5f911ba4d1aac8af16f7eef7dc69b7382e7c1998d06f1d5590785a42e5a93
MD5 44c61e6da6cc91ca3435010640fd4e04
SHA1 2165fb1209a9ee7d8f11a416e08d78e022962d3c
SHA512 18e838d7f095eb5d8dc62f5d75486926dd4b254d03afef05e1e3bce6808fae73b7a46afbf1a1dd14dcf52f1883db6c4c7a9b5d5dbafdfa3c12dd9562b3ef5bcb
SSDEEP 768:JrL63Ru4/rnNHQTkX11Rky6CAnezyhrajgYQnTED4zlkOvXvM/xy0+r7bEW:JrMjgkXMrYOrNV/pJvMLC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17989

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetOpenW InternetCrackUrlW InternetConnectW HttpEndRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetErrorDlg InternetCloseHandle HttpAddRequestHeadersA InternetQueryOptionW InternetSetOptionW InternetSetFilePointer InternetGetLastResponseInfoW FtpOpenFileW FtpCreateDirectoryW HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetWriteFile InternetReadFile

comctl32

ord17

kernel32

LCMapStringW RtlUnwind GetModuleFileNameW HeapReAlloc HeapAlloc MultiByteToWideChar GetOEMCP GetACP GetCPInfo EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsValidCodePage HeapSize GlobalFree lstrcpyW lstrcpynW GlobalAlloc lstrlenW WriteFile ReadFile lstrcmpW GetLastError DeleteFileW CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize CreateFileW lstrcmpiW GetProcAddress LoadLibraryW MulDiv GetModuleHandleW TerminateThread WaitForSingleObject CreateThread CreateFileA WideCharToMultiByte HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA DeleteCriticalSection GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount HeapDestroy GetStdHandle SetHandleCount ExitProcess Sleep HeapFree InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer GetStringTypeW IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCommandLineA DecodePointer GetCurrentThreadId

user32

wsprintfA FindWindowExW CreateDialogParamW EnableWindow IsWindowVisible IsDialogMessageW GetMessageW TranslateMessage DispatchMessageW RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconW SetTimer GetWindowRect GetClientRect SystemParametersInfoW SetWindowPos SetDlgItemTextW SendMessageW GetWindowTextW PostMessageW GetDlgItem SetWindowTextW GetWindowLongW SetWindowLongW ShowWindow GetParent MessageBoxW IsWindow wsprintfW SendDlgItemMessageW

$PLUGINSDIR/nsJSON.dll

SHA256 e3ce60666bb88c2412615ef9f432ec24e219532dee5cc1c7aebc65ed9ec94d59
MD5 78b913fcd04259634a5e901c616e6074
SHA1 ad5e1c651851a1125bcad79b01ccdcfa45df4799
SHA512 cbe07179dd93011f3d9a8f83541961ff34fb83d96658ac82a433ef0aa3399b183eaec3e6a49ec1c1e478d1eada2d3ebc78ffb1ae0574984ae66a7a9cab5d59e5
SSDEEP 192:QTIBadVjvTMEE7bZATR4N65bhztNDcrGu:QkkV/JE7IR865bhTcau
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 e2890c196c7f2746da19aee87984b30a0a31019e34f95517f8a34b929451ef99
MD5 44ba57bfbda7ae8d7ebd7b3386c29722
SHA1 2ee636ec6bde1d21ecb26980b91172eff6887cd6
SHA512 69eb0308ad4b509173be85e18999435d16464c0b9f1f8c7301b06daea7d8f2c3fdb1a08e46fe12963d7498555bcfc45cd489e78bfa50c666420b2e731154e44c
SSDEEP 192:SdszDFl1jXOHwUMXVHWUf99hqZWmQBuM4+Oav6HIXDcr:SdIDpOeXVHdFWZWLuR9av5c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/sign.dll

SHA256 1f2b4549129c1b98c5674fe363a0267376dfd623323c5815216043dfa7fe1f2a
MD5 d30b6c8d2f38e6abbb2f39bac0808bc0
SHA1 f1bca6416ae0f4c52e5b076381c72b18472954d8
SHA512 3bf03d839ffa04c1d5eeb89a6405820ab2eea3548050e730255df7e84dfc729157c0d5c7eceeead5e8e1f4aa23777fe78a5582f0772c85bf0f793dd245a887e8
SSDEEP 768:ciIqw3a6iG3SvsvUccH/ixF5cGIv5pXi:ci23avGCvycH/ifXuc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 5b79997fb38ea4d353f2e75d8a1510661b6aacd6b898422364099df1824aa6f0
MD5 0d066ebc8e5829ecd5d6d7053c3ae973
SHA1 ccc816a7b852d685ff7b09eb86a45788581aecd4
SHA512 f5c7726dc3d9f231e692a19745a42f68656aadc47a5bafc3646af2c54ac942a6a413dc39edfd44299a6f13673dcde59c020d6d2917f6361c1cbbaabf9aa98715
SSDEEP 768:iyCLXJuYhhJ5cgibREMBr5hDwdmNB7SFoS/hhBH0+EnugTNkePkM2K0EDPynHdXt:SlThjtiF/D7SXBHknTTNkHm8HFX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

a2b1755bb08cb3b78e8fd58822e8efd8_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/extra.dll

generic

out.upx

generic

$PLUGINSDIR/inetc.dll

wininet

comctl32

kernel32

user32

generic

$PLUGINSDIR/nsJSON.dll

generic

out.upx

generic

$PLUGINSDIR/sign.dll

generic

out.upx

generic