a3944e4cbbc7a52b8105447e7cb5ce3b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a3944e4cbbc7a52b8105447e7cb5ce3b_JaffaCakes118
Size 344KB
Sample240613-c817rsvgmn
SHA256 7312a1a3a228cef5f0749c2dfa14f758e88bde7a3943aa6fced63e39c99fd7e7
MD5 a3944e4cbbc7a52b8105447e7cb5ce3b
SHA1 4384e16c289f389007a2293b38e1b629532fffae
SHA512 6c77b2da9a01f915661df7a0e5c4319bfbb198661579a4a8f8b053a6c221a00daf4cc7d935ac6ec7a62168c8549c8e585bc7b142d1085a6290b85e5210fc533c
SSDEEP 6144:nFJ0BPYnNpxy+ahR+rrbgqpn+zOYMmNpdKGEg822G1VQG7zYbT1:+gxDvb7B+aYMmNpdvEL22HD1
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

a3944e4cbbc7a52b8105447e7cb5ce3b_JaffaCakes118

.exe 344KB
beehdhgehc.exe

.exe 563KB

a3944e4cbbc7a52b8105447e7cb5ce3b_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 7312a1a3a228cef5f0749c2dfa14f758e88bde7a3943aa6fced63e39c99fd7e7
MD5 a3944e4cbbc7a52b8105447e7cb5ce3b
SHA1 4384e16c289f389007a2293b38e1b629532fffae
SHA512 6c77b2da9a01f915661df7a0e5c4319bfbb198661579a4a8f8b053a6c221a00daf4cc7d935ac6ec7a62168c8549c8e585bc7b142d1085a6290b85e5210fc533c
SSDEEP 6144:nFJ0BPYnNpxy+ahR+rrbgqpn+zOYMmNpdKGEg822G1VQG7zYbT1:+gxDvb7B+aYMmNpdvEL22HD1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

65:d2:48:52:f7:c3:6b:91:db:ab:53:c5:34:ec:a2:cb:1f:44:c9:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yes Apps,O=Yes Apps,L=Dublin,C=IE

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

beehdhgehc.exe

IMPHASH 46651a9985ba79d2561203c506954769
SHA256 dc239681ea4e27fbe2a678f0182b8adf47a3d0b2687d1d8b7a9e3416324ca7c1
MD5 9d01412819ca4fb532c81a5335d76854
SHA1 ff840af40527eb8a05927036af54140d07a1ba33
SHA512 d25be4cadcfc67ec5c5454a488ce03e9cce45e5f02238baca129c363d370174818822f78230155949c577ff6d240ed12af32d94700d4fe91dd4b3121664ddaff
SSDEEP 12288:NCsn5OejVsQwDgLMUB5vIXbyVxbHFoVlbOzKBztyAH40:NCyPB+D8MUB5vIXbyVxbHFKl62Bz4AHh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

12:8f:94:29:19:b2:83:6f:35:65:c4:69:25:22:0a:be:5a:b1:90:a2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yes Apps,O=Yes Apps,L=Dublin,C=IE

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

137035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpConnect WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpWriteData WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpSetTimeouts

kernel32

InterlockedDecrement RaiseException GetLastError MultiByteToWideChar LoadResource FindResourceW GetModuleFileNameW ExitProcess InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId SetLastError GetCurrentProcess FlushInstructionCache GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW LockResource DecodePointer GetCommandLineW CreateThread GlobalHandle GlobalFree CreateProcessW WaitForSingleObject GetExitCodeProcess CloseHandle IsWow64Process Sleep DeleteFileW GetVersion WideCharToMultiByte GetVolumeInformationW SetEvent HeapSize HeapReAlloc HeapFree HeapAlloc TlsAlloc LocalFree SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage WriteFile GetStdHandle GetSystemTimeAsFileTime AreFileApisANSI GetProcAddress GetModuleHandleExW EncodePointer VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent TerminateProcess TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW GetTimeZoneInformation GetFileType GetConsoleCP GetConsoleMode TlsSetValue ReadFile SetFilePointerEx FlushFileBuffers QueryPerformanceCounter GetCurrentProcessId TlsGetValue GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW SetEnvironmentVariableA SetStdHandle WriteConsoleW CreateFileW SetEndOfFile GetProcessHeap CreateDirectoryW

user32

GetFocus GetWindow IsWindow GetClassNameW GetSysColor IsChild GetClassInfoExW CreateWindowExW DestroyWindow CreateAcceleratorTableW ClientToScreen GetParent EndPaint BeginPaint RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW RegisterWindowMessageW SendDlgItemMessageW GetWindowRect GetSystemMetrics EndDialog CreateDialogIndirectParamW SetWindowContextHelpId MapDialogRect GetMessageW TranslateMessage DispatchMessageW ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect GetClientRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable GetWindowLongW SetWindowLongW DefWindowProcW LoadCursorW RegisterClassExW UnregisterClassW MessageBoxW GetDlgItem SendMessageW ShowWindow SetWindowPos UpdateWindow MessageBoxA CharNextW PostMessageW PostThreadMessageW KillTimer SetTimer SetFocus

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt DeleteDC GetStockObject CreateSolidBrush GetDeviceCaps GetObjectW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

shell32

ShellExecuteW Shell_NotifyIconW SHGetFolderPathW

ole32

CoTaskMemFree OleUninitialize StringFromGUID2 OleLockRunning CreateStreamOnHGlobal CoCreateInstance CoGetClassObject CLSIDFromProgID CLSIDFromString OleInitialize CoInitialize CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoTaskMemAlloc

oleaut32

LoadRegTypeLi SysFreeString SysStringLen VariantInit SysStringByteLen SysAllocStringByteLen DispCallFunc SysAllocStringLen LoadTypeLi VariantClear OleCreateFontIndirect SysAllocString

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

a3944e4cbbc7a52b8105447e7cb5ce3b_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

beehdhgehc.exe

PE Signature issue

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

iphlpapi

generic