a3b5e85b60a2ed7a07de241f3e5598be_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a3b5e85b60a2ed7a07de241f3e5598be_JaffaCakes118
Size 319KB
Sample240613-d9215atale
SHA256 e5212e7889f46d6413a86886a4b0ec70b156237d51f5a891d03807347ca2d6cd
MD5 a3b5e85b60a2ed7a07de241f3e5598be
SHA1 b5d08e79b5468f7bda06d075559194e73b0d4988
SHA512 00203b3938c86d4f7d0e6c892bbbdf837c2b12d0e37e799ecbc1fd870344053ebe950bf61999ed461666c3e1a05b7f7a213914455b7342758a5798bd72a3dedf
SSDEEP 6144:nFJ0PpxsKMbkKLLbWyxPx5bg/xQT/EUni/gEfmf9/2z0IYFBDI1iaDmIFui:+IyKCyZfbZ/EUsROF/F5BQiasi
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

a3b5e85b60a2ed7a07de241f3e5598be_JaffaCakes118

.exe 319KB
befbabgbdg.exe

.exe 632KB

a3b5e85b60a2ed7a07de241f3e5598be_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 e5212e7889f46d6413a86886a4b0ec70b156237d51f5a891d03807347ca2d6cd
MD5 a3b5e85b60a2ed7a07de241f3e5598be
SHA1 b5d08e79b5468f7bda06d075559194e73b0d4988
SHA512 00203b3938c86d4f7d0e6c892bbbdf837c2b12d0e37e799ecbc1fd870344053ebe950bf61999ed461666c3e1a05b7f7a213914455b7342758a5798bd72a3dedf
SSDEEP 6144:nFJ0PpxsKMbkKLLbWyxPx5bg/xQT/EUni/gEfmf9/2z0IYFBDI1iaDmIFui:+IyKCyZfbZ/EUsROF/F5BQiasi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

af:53:6e:db:25:0e:84:fd:e5:cb:86:2a:84:2c:ec:ab:a1:41:e7:1c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Safe InstaLl Opt,O=Safe InstaLl Opt,L=Dublin,ST=Dublin,C=IE

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

befbabgbdg.exe

IMPHASH c05fac514d2de0d0185754c6da620c10
SHA256 b5cf845a5471a08d28466ad3c94353305afdef370228166817a9992e357372c8
MD5 a91c4d47949aa92bd2627a90db72d6a7
SHA1 59a192864aa7f6b67544a938a5987b1015dd7e72
SHA512 60731d930a920baf95b0ad565c4aee7a37b95c61d7adeb13b2b906b1de0b34cb5c98a83462547eb622fe6208c5496d4fc1a32aefdfb8fa0b3299f12781c0c8ff
SSDEEP 12288:9xQLpLmzBwT4RNwC4SG+JWB1ynNkx8cF2ul0sA5t77hKlYyHa5J2bOIhhRWaDbHv:9xem14SG+Ju1yNkx8cF2ul0sA5t77hKH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:e1:e6:46:9f:f9:39:56:8f:20:9d:43:d1:c8:01:2c:9c:b3:86:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Safe InstaLl Opt,O=Safe InstaLl Opt,L=Dublin,ST=Dublin,C=IE

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

377919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

kernel32

GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess ExitProcess RaiseException GetCurrentThreadId GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource MulDiv lstrcmpW GetModuleFileNameW FindResourceW MultiByteToWideChar GetCommandLineW GlobalHandle GlobalFree CreateThread GetVersion GetExitCodeProcess WaitForSingleObject Sleep FindClose CloseHandle CreateProcessW DeleteFileW FindFirstFileW FindNextFileW IsWow64Process WideCharToMultiByte SetEvent GlobalAlloc HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LocalFree FormatMessageW DecodePointer TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage WriteFile GetStdHandle GetSystemTimeAsFileTime AreFileApisANSI GetProcAddress GetModuleHandleExW RtlUnwind EncodePointer OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead LockResource TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW FlushFileBuffers GetConsoleCP GetConsoleMode GetFileType TlsSetValue ReadFile SetFilePointerEx GetTimeZoneInformation QueryPerformanceCounter GetCurrentProcessId InterlockedDecrement GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW CreateFileW SetEndOfFile TlsGetValue CreateDirectoryW

user32

GetDesktopWindow GetWindowLongW FillRect GetSysColor GetParent GetClassNameW MessageBoxW MessageBoxA GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW GetWindow LoadCursorW ClientToScreen CreateDialogIndirectParamW EndDialog GetSystemMetrics GetWindowRect SetWindowContextHelpId MapDialogRect LoadStringW GetMessageW TranslateMessage DispatchMessageA PostThreadMessageW SetTimer KillTimer ScreenToClient RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW SendDlgItemMessageW GetDlgItem SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW RegisterWindowMessageW PostMessageW SetWindowLongW

gdi32

SelectObject GetStockObject GetDeviceCaps DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC GetObjectW DeleteDC CreateSolidBrush

advapi32

RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW Shell_NotifyIconW ShellExecuteW

ole32

CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize OleLockRunning CreateStreamOnHGlobal CoInitialize CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance

oleaut32

OleCreateFontIndirect VariantCopy SysAllocStringByteLen SysStringByteLen DispCallFunc LoadRegTypeLi LoadTypeLi VariantClear VariantInit SysStringLen SysAllocStringLen SysFreeString SysAllocString

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

a3b5e85b60a2ed7a07de241f3e5598be_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

befbabgbdg.exe

PE Signature issue

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

iphlpapi

generic