a585bd9c116693ad5500f0fa510589a7_JaffaCakes118
- SHA256 9a21a0e3ceed3cbc51c4ec96bc28ce52d7323c2a0eac8be900680ea1bba590ef
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Newsoftwares.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Newsoftwares.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
befedhejed.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
befedhejed.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target a585bd9c116693ad5500f0fa510589a7_JaffaCakes118
- Size 276KB
- Sample240613-plndlssfkr
- SHA256 9a21a0e3ceed3cbc51c4ec96bc28ce52d7323c2a0eac8be900680ea1bba590ef
- MD5 a585bd9c116693ad5500f0fa510589a7
- SHA1 e147b12e37f1926ae727f69db638d360670c1427
- SHA512 e655a4f4561f582a36bc2f539a4a9f64ef7d346aad587837417da360b4c70bb507ffa984bb219a9873343c806cec011313fb7d1731cba9cccb8c6850e725bc09
- SSDEEP 6144:wASS1f2z2FSth1dyrqS43rxxbG7KaLcDTuh1UWhSS50MI:ljf2YSttyrZ43rxW7ID6hqqSu0MI
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/Newsoftwares.exe unpack003/befedhejed.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack002/Newsoftwares.exe nsis_installer_1 static1/unpack002/Newsoftwares.exe nsis_installer_2
File Explorer
-
a585bd9c116693ad5500f0fa510589a7_JaffaCakes118.zip 276KB
-
Newsoftwares.zip.zip 275KB
-
Newsoftwares.exe.exe 288KB
-
befedhejed.exe.exe 568KB
Newsoftwares.zip
- SHA256 8b16479824479da00264fe31d5bc678f35d28e102b4b9e52d828338a69fe4e22
- MD5 f59d37d4b7e128bfa8a04ca6d4091648
- SHA1 1078afc3da4c5be66c36bef1370c50f2a6335b04
- SHA512 669eb9ad77d259198dcd47563fef1ea9c2abf44fa5af6d1a5493f3727e31037a69c762474ddf9d57a1f550f4acf2bcbb1eb778bc770989d1189eb1072834d5b2
- SSDEEP 6144:MASS1f2z2FSth1dyrqS43rxxbG7KaLcDTuh1UWhSS50Ma:Jjf2YSttyrZ43rxW7ID6hqqSu0Ma
- MD5 SHA1 SHA512 SSDEEP
Newsoftwares.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 79fc888057252b71f3181b41e0a3b63ca49e3fa57f9c28f1ce1f9e66b0cb1510
- MD5 44a78c4eacb6b83793409995101af1a2
- SHA1 f218eea53f04fa247eb23634b5626a0b627b1a31
- SHA512 ec74f5ea567386b100625afe6efea5bd3485c4da37a9a0a43b674abe7777a1585641e5a8de9e98e49f37c664164daf6d84946bcf56e47e71b561dad7ff7ddf8c
- SSDEEP 6144:FFJ0Pk44oymXxitr1dyrOS4VrxhbG78aLcDdsbdIuUw6+tS50MA:wz4oy+it/yrd4VrxmtID2JIZdwu0MA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
304KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
befedhejed.exe
- IMPHASH f53680fcb218606fb91bea46d53ac736
- SHA256 ebafb52bd5689ff5176b80c423abc2076918e06589b4c5fb8327c850a2a851e8
- MD5 295e9084e0f91303c28c727a7cbf2b9d
- SHA1 bf61203e6bca3c0a6deca501068d236c74cf6030
- SHA512 08335f4316f0a094770374857a973b8e6bf2dc33b1b716e461110fbbe75d3f1172e07fcf6904a8b78c73df67ea2d0fb0422579453e726ae64f2f82b35eb505bc
- SSDEEP 12288:smabdv9sphzAl614AarLsaJLeqR0Vmfr/dJu3+wvo5F5NWFSR+:stsnosaJCqR0Vmfr/wv+W
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
309346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
winhttp
WinHttpCrackUrl
WinHttpOpen
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
kernel32
GlobalLock
GlobalUnlock
FlushInstructionCache
GetCurrentProcess
ExitProcess
RaiseException
GetCurrentThreadId
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadResource
MulDiv
lstrcmpW
GetModuleFileNameW
FindResourceW
MultiByteToWideChar
GetCommandLineW
GlobalHandle
GlobalFree
CreateThread
GetVersion
GetExitCodeProcess
WaitForSingleObject
Sleep
FindClose
CloseHandle
CreateProcessW
DeleteFileW
FindFirstFileW
FindNextFileW
IsWow64Process
WideCharToMultiByte
SetEvent
GlobalAlloc
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LocalFree
FormatMessageW
DecodePointer
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
WriteFile
GetStdHandle
GetSystemTimeAsFileTime
AreFileApisANSI
GetProcAddress
GetModuleHandleExW
RtlUnwind
EncodePointer
OutputDebugStringW
IsDebuggerPresent
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
LockResource
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
TlsSetValue
GetFileType
ReadFile
SetFilePointerEx
GetTimeZoneInformation
QueryPerformanceCounter
GetCurrentProcessId
InterlockedDecrement
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
ReadConsoleW
CreateFileW
SetEndOfFile
TlsGetValue
CreateDirectoryW
user32
GetDesktopWindow
SetWindowLongW
FillRect
GetSysColor
LoadCursorW
ClientToScreen
GetParent
MessageBoxA
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetClassNameW
GetWindow
MessageBoxW
CreateDialogIndirectParamW
EndDialog
GetSystemMetrics
GetWindowRect
SetWindowContextHelpId
MapDialogRect
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageA
PostThreadMessageW
SetTimer
KillTimer
ScreenToClient
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
DestroyAcceleratorTable
CreateAcceleratorTableW
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextW
SendDlgItemMessageW
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
SendMessageW
RegisterWindowMessageW
PostMessageW
GetWindowLongW
gdi32
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectW
DeleteDC
CreateSolidBrush
advapi32
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
oleaut32
DispCallFunc
VariantCopy
SysAllocStringByteLen
SysStringByteLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString
urlmon
URLDownloadToFileW
iphlpapi
GetAdaptersInfo
Name
.text
Size
426KB
Virtual Size
426KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=199, version=41118,
count=83, id=225, productName=VS2013 build 21005, version=21005,
count=29, id=223, productName=VS2013 build 21005, version=21005,
count=221, id=224, productName=VS2013 build 21005, version=21005,
count=6, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=244, id=1, productName=Unmarked objects,
count=8, id=225, version=20806,
count=1, id=224, productName=VS2013 UPD4 build 31101, version=31101,
count=438, id=225, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,