a4808bd11faac1cf6166b1b824f6d23c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a4808bd11faac1cf6166b1b824f6d23c_JaffaCakes118
Size 371KB
Sample240613-jpyqvstfll
SHA256 c1aed824a234d1d65676c4c4274073eabe58c20f0dfd7613293c9178962c2179
MD5 a4808bd11faac1cf6166b1b824f6d23c
SHA1 abb97f37b20861592ee5b54ba7bd05149746d3cb
SHA512 56eb65c5a9f76becc33e86172adc889829cef7abbc0f69e9e4b65bebb4ae81045dfb5a6f1e1e8b344bf88e8839764c71626321facb5e6d0d136a40c78fd561b2
SSDEEP 6144:BFJ05S+gt9cEQtLM+S50pe4vMVwW0PNU+sdzWZwzMxyGPR0MI5pKSYi/0ThYP/aB:oSxrcE7X4EwW0PdEWSoVSRgePCB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

a4808bd11faac1cf6166b1b824f6d23c_JaffaCakes118

.exe 371KB
beejheijdj.exe

.exe 631KB

a4808bd11faac1cf6166b1b824f6d23c_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 c1aed824a234d1d65676c4c4274073eabe58c20f0dfd7613293c9178962c2179
MD5 a4808bd11faac1cf6166b1b824f6d23c
SHA1 abb97f37b20861592ee5b54ba7bd05149746d3cb
SHA512 56eb65c5a9f76becc33e86172adc889829cef7abbc0f69e9e4b65bebb4ae81045dfb5a6f1e1e8b344bf88e8839764c71626321facb5e6d0d136a40c78fd561b2
SSDEEP 6144:BFJ05S+gt9cEQtLM+S50pe4vMVwW0PNU+sdzWZwzMxyGPR0MI5pKSYi/0ThYP/aB:oSxrcE7X4EwW0PdEWSoVSRgePCB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3c:92:bf:23:78:2c:45:ae:2c:73:b1:63:92:78:03:9f:12:48:eb:0c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=RuN APps FOrEver lld,O=RuN APps FOrEver lld,L=Dublin,ST=Dublin,C=IE

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

beejheijdj.exe

IMPHASH c05fac514d2de0d0185754c6da620c10
SHA256 6e8ca330ea3eda3742aeced01248aa645e1f93ee23732512b9bb26dfb5009ef8
MD5 015bb7953acd60ca049320c4abeae2b5
SHA1 450cc3464aaa126e6d8bdad2802093e1b31370d7
SHA512 33ec30d87abbf5738fae104fbc2951cd7acee9a45e9299db0bba28b84eb869d5be3b43f7ec93ef1e1577d1a15560649e9aefa7dc48bf124b5a81e7af7b2a2268
SSDEEP 12288:+e1E1VbmA0JLoRI/5+bitik5Vk97TYd8GNtnH9bgOlJe73VHd+aKHzlOPhDuM/Va:+e+sh+biIk5y9PYd8GNtnH9bgOlJe73m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b3:e0:a6:1e:5c:55:a0:be:10:b6:ec:ba:76:85:db:14:74:a8:39:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=RuN APps FOrEver lld,O=RuN APps FOrEver lld,L=Dublin,ST=Dublin,C=IE

Chains

Jun 12, 2024

Minor OS version

Major OS version

Entry point

376879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

kernel32

GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess ExitProcess RaiseException GetCurrentThreadId GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource MulDiv lstrcmpW GetModuleFileNameW FindResourceW MultiByteToWideChar GetCommandLineW GlobalHandle GlobalFree CreateThread GetVersion GetExitCodeProcess WaitForSingleObject Sleep FindClose CloseHandle CreateProcessW DeleteFileW FindFirstFileW FindNextFileW IsWow64Process WideCharToMultiByte SetEvent GlobalAlloc HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LocalFree FormatMessageW DecodePointer TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage WriteFile GetStdHandle GetSystemTimeAsFileTime AreFileApisANSI GetProcAddress GetModuleHandleExW RtlUnwind EncodePointer OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead LockResource TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW FlushFileBuffers GetConsoleCP GetConsoleMode GetFileType TlsSetValue ReadFile SetFilePointerEx GetTimeZoneInformation QueryPerformanceCounter GetCurrentProcessId InterlockedDecrement GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW CreateFileW SetEndOfFile TlsGetValue CreateDirectoryW

user32

GetDesktopWindow GetWindowLongW FillRect GetSysColor GetParent GetClassNameW MessageBoxW MessageBoxA GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW GetWindow LoadCursorW ClientToScreen CreateDialogIndirectParamW EndDialog GetSystemMetrics GetWindowRect SetWindowContextHelpId MapDialogRect LoadStringW GetMessageW TranslateMessage DispatchMessageA PostThreadMessageW SetTimer KillTimer ScreenToClient RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW SendDlgItemMessageW GetDlgItem SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW RegisterWindowMessageW PostMessageW SetWindowLongW

gdi32

SelectObject GetStockObject GetDeviceCaps DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC GetObjectW DeleteDC CreateSolidBrush

advapi32

RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW Shell_NotifyIconW ShellExecuteW

ole32

CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize OleLockRunning CreateStreamOnHGlobal CoInitialize CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance

oleaut32

OleCreateFontIndirect VariantCopy SysAllocStringByteLen SysStringByteLen DispCallFunc LoadRegTypeLi LoadTypeLi VariantClear VariantInit SysStringLen SysAllocStringLen SysFreeString SysAllocString

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

a4808bd11faac1cf6166b1b824f6d23c_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

beejheijdj.exe

PE Signature issue

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

iphlpapi

generic