a5128806337539052b58dad45598c471_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a5128806337539052b58dad45598c471_JaffaCakes118
Size 562KB
Sample240613-mf993svcnf
SHA256 22db4c7f2eabb9b879e01eac077322c09319f55a47388fed07bba8b5fd7cccea
MD5 a5128806337539052b58dad45598c471
SHA1 6ae2fef2ddb327e7d17257a5a098c9c011ae07e9
SHA512 7e2c341cc17d19b403a1927073eb12f844e83298594099bf55585403832fc28aaf2a8ccc9b3b1abab8b86d75c250acf030e8cec87585f4f8dc4e33edcd342919
SSDEEP 12288:oPwMDD1dxDx5SCbpK2h6Ieu96aUT7dxIfLbdi8R+3z2f:kt9jF5JU2h6IlLUTUvdRRaz2f
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
a5128806337539052b58dad45598c471_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/pwgen.dll
unpack001/$_2_/DownloadManager.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

a5128806337539052b58dad45598c471_JaffaCakes118

.exe 562KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/inetc.dll

.dll 21KB
$PLUGINSDIR/pwgen.dll

.dll 16KB
$_2_/DownloadManager.exe

.exe 864KB

a5128806337539052b58dad45598c471_JaffaCakes118

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 22db4c7f2eabb9b879e01eac077322c09319f55a47388fed07bba8b5fd7cccea
MD5 a5128806337539052b58dad45598c471
SHA1 6ae2fef2ddb327e7d17257a5a098c9c011ae07e9
SHA512 7e2c341cc17d19b403a1927073eb12f844e83298594099bf55585403832fc28aaf2a8ccc9b3b1abab8b86d75c250acf030e8cec87585f4f8dc4e33edcd342919
SSDEEP 12288:oPwMDD1dxDx5SCbpK2h6Ieu96aUT7dxIfLbdi8R+3z2f:kt9jF5JU2h6IlLUTUvdRRaz2f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 2dc320488b636b9dce9581a95e5a833a07500622c1a64fc05023ba6482d2a6e1
MD5 031ec9b12afb1fafc9fc397f3b90f29c
SHA1 de26ddfe3ef452f8205bfbd5520a8eff6328619f
SHA512 cbebded4e3a87234899e2b67121f898c9060671d25088b7de29bbcbda90a5410dd3afd110417caa6c46ba656e1a863da39127e15c2122fedaa5054f4d43b90a6
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 2e4d94706c699d2da474aa823430b9a5
SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
MD5 d7a3fa6a6c738b4a3c40d5602af20b08
SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12287

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree GlobalAlloc WideCharToMultiByte LoadLibraryA lstrlenA lstrcatA lstrcpyA lstrcmpiA MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetTickCount TerminateThread CreateThread SleepEx lstrcmpA lstrcpynA CreateFileA DeleteFileA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SendDlgItemMessageA SetTimer KillTimer EnableWindow UpdateWindow RedrawWindow SetWindowTextA GetWindowTextA GetClientRect GetWindowRect MessageBoxA GetWindowLongA SetWindowLongA GetParent FindWindowExA LoadIconA IsDialogMessageA SystemParametersInfoA SetDlgItemTextA wsprintfA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA IsWindow DestroyWindow ShowWindow SetWindowPos IsWindowVisible CreateDialogParamA GetDlgItem

$PLUGINSDIR/pwgen.dll

IMPHASH ff5d1f24996d7518c448de0ef89caf7f
SHA256 82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e
MD5 a555472395178ac8c733d90928e05017
SHA1 f44b192d66473f01a6540aaec4b6c9ac4c611d35
SHA512 e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a
SSDEEP 96:Rb32p/4mp563gfdaDf2GEFd69qI214YgU+dXXDtFCOdd7KPcC+pyTY62l2z252NJ:YCQAED61dpEEN5VifUbw2mDG0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

77B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

700B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_2_/DownloadManager.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e5f6ecac207287ea1c955497315de6c7622a06d4f8c63f44a838615f62acbb44
MD5 54fff123842d60d5e57d04c4cf7fbf93
SHA1 8b7c9ee4dfb31d76d6cdf0a4c1c9b1d974e1ddcb
SHA512 b415d13a53d9cbae34d6e1badec0db06be522a3233440947b2351027d671e02c99b64a8f121bf14a0d9539ef988d07d03dae6c4d90644333c54ad5574518f2d1
SSDEEP 12288:kgr0bU0isywMDDhwMDDekA8eFKpgVtt7xcHh+JPc:kgr0atptFAPFKpgVjuAc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

890426

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

a5128806337539052b58dad45598c471_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/inetc.dll

wininet

comctl32

kernel32

user32

generic

$PLUGINSDIR/pwgen.dll

msvcrt

advapi32

kernel32

user32

generic

$_2_/DownloadManager.exe

mscoree

dotnet