a6306c79f2996f893dec6bc8fa94eb84_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a6306c79f2996f893dec6bc8fa94eb84_JaffaCakes118
Size 1.1MB
Sample240613-sknvjayanq
SHA256 9fac22e098a25975b035b01c42f1412d4daa60ffe0cffc51b71c2c8d65bec9a6
MD5 a6306c79f2996f893dec6bc8fa94eb84
SHA1 f214638c62f123ad40cf093f97f14a174962c593
SHA512 4ae7666471127ad3fb956b62637d0878e1b584fed625f9cc3b29e19910b31c59e4cf4bd22100f8413fae44d99f9028124071f2228eb565c0ed80c3b2de0080f1
SSDEEP 24576:Wo6cLUSoUBJGnp7cxLy8ombKwS0DdHQWEeFB8bJ6otCZ:WhAOUGnp7HKd5fkFsZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$TEMP/R2RJUCE.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$TEMP/R2RJUCE.dll	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
a6306c79f2996f893dec6bc8fa94eb84_JaffaCakes118
unpack001/$TEMP/BASSMOD.dll
unpack001/$TEMP/R2RJUCE.dll
unpack002/out.upx
unpack001/$TEMP/keygen.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

a6306c79f2996f893dec6bc8fa94eb84_JaffaCakes118

.exe 1.1MB
$TEMP/BASSMOD.dll

.dll 33KB
$TEMP/R2RJUCE.dll

.dll 113KB
out.upx

.dll 238KB
$TEMP/bgm.xm

821KB
$TEMP/keygen.exe

.exe 842KB

a6306c79f2996f893dec6bc8fa94eb84_JaffaCakes118

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 9fac22e098a25975b035b01c42f1412d4daa60ffe0cffc51b71c2c8d65bec9a6
MD5 a6306c79f2996f893dec6bc8fa94eb84
SHA1 f214638c62f123ad40cf093f97f14a174962c593
SHA512 4ae7666471127ad3fb956b62637d0878e1b584fed625f9cc3b29e19910b31c59e4cf4bd22100f8413fae44d99f9028124071f2228eb565c0ed80c3b2de0080f1
SSDEEP 24576:Wo6cLUSoUBJGnp7cxLy8ombKwS0DdHQWEeFB8bJ6otCZ:WhAOUGnp7HKd5fkFsZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$TEMP/BASSMOD.dll

SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

73795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/R2RJUCE.dll

SHA256 7142f93fa14137d57971611435c0faac9a1eb9e2b628df26242eeb095558c968
MD5 c4b4991d621f406e49d86757ee01dd40
SHA1 0570fb52e33f2434373ad74851c5811e8fb158d5
SHA512 b38baa568ea77e77ff34c894f892bc868b321f6a7c481091c7d48e986fe078482b0ecf6123066bbe2f4d6d60aeb4e4c498cb2add2dd60dd876200b18d80b69f8
SSDEEP 3072:O+Es84qJJG9KXO6Z/7tt1jKlmELcUYd4ahCMUoNSj40NAH8u3+w3:O+mkk9jtfWYvWahZUooUYo8u3+A
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

280912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 c7810d69568ce7b3f7b64f49a7f877b8a0201c9a72887ad653c5adb55a6084bc
MD5 83f62927766ad53aa8064f86f31c12d0
SHA1 ed75c1bdeb1afe01fecfad4379ff3533710af6d4
SHA512 a11c2d05cca65739d9cdc2a72e3c02b3c65b0c34694ec94468e6034059904d6d8f09af64b7f8a55a9bbdf556b4bacf404aa393163926ac5e779d8797b393adf1
SSDEEP 3072:a00M1sumJ6ndD5CyRiYmDpMN6UrVHNs+1S7HP47TBfWmHnNv:a3cm8ndlCQmD+A+VtsySE7TBek
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

62560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/keygen.exe

IMPHASH f4d2c3a6b35dbab397d4043b06f995b7
SHA256 dffb8c5f3b46e41e1a1815f12b8df5f10b05ff71b94bc7d243cab33d13eaa625
MD5 1c662492180514144db462edca9f9d20
SHA1 aa0c2cc7365c514ab75f5be46b0e73f07417c87d
SHA512 3a049cf4c9cadc7af1b4c1443c5f05f878a77ee07a9292faa9c49763ebfcb528370c35b97b7062ab3eb02d49a2df8a23f16a868230d36bcf6308183a663d411e
SSDEEP 24576:7umonR5f5pLT5LGWA94DxMefqDLr8J5pAua7ywd:7c5pLT5LPA9IxMKqDLr8J5pAzmwd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

143246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

_TrackMouseEvent ord17

msimg32

GradientFill

kernel32

VirtualProtect GetCPInfo GetOEMCP GetACP HeapSize SetUnhandledExceptionFilter WriteFile GetFileType GetStdHandle SetHandleCount IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy ReadFile CloseHandle LCMapStringW LCMapStringA SetFilePointer GetCurrentProcess TerminateProcess ExitProcess GetVersionExA GetStartupInfoA GetModuleHandleA SetCurrentDirectoryA SetEnvironmentVariableA CreateDirectoryA GetLastError GetFullPathNameA GetCurrentDirectoryA GetDriveTypeA HeapReAlloc RtlUnwind RaiseException HeapFree HeapAlloc UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetStdHandle FlushFileBuffers CreateFileA GetLocaleInfoA GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InterlockedExchange GetLocalTime FindFirstFileA FindNextFileA FindClose DeleteFileA GetShortPathNameA GlobalLock GlobalUnlock MulDiv GlobalAlloc GlobalFree GetCommandLineA GetSystemInfo GlobalMemoryStatus GetVersion GetComputerNameA GetWindowsDirectoryA GetSystemDirectoryA WinExec FreeLibrary WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress Sleep GetTickCount GetModuleFileNameA SetEndOfFile VirtualQuery

user32

PostQuitMessage LoadIconA ReleaseDC InvalidateRect DefWindowProcA BeginPaint LoadCursorA RegisterClassA UnregisterClassA AdjustWindowRectEx EndPaint FillRect TabbedTextOutA GetSysColor MoveWindow GetActiveWindow GetClassLongA SetClassLongA SetWindowLongA IsWindowEnabled EnableWindow SetFocus GetFocus GetWindowLongA GetClientRect InflateRect DrawFocusRect DrawTextA PostMessageA SetWindowTextA GetDlgItemTextA GetDlgCtrlID IsDlgButtonChecked CallWindowProcA MsgWaitForMultipleObjects PeekMessageA GetMessageA TranslateMessage DispatchMessageA MapVirtualKeyA GetWindowRect SetActiveWindow SetWindowPos GetAsyncKeyState GetCursorPos SetCursorPos ShowCursor MessageBoxA EnumDisplaySettingsA ChangeDisplaySettingsA CreateWindowExA ShowWindow SendMessageA DestroyWindow GetDC GetSystemMetrics

gdi32

CreateDIBSection CreateCompatibleDC Rectangle DeleteDC SetStretchBltMode StretchBlt Ellipse MoveToEx LineTo SetPixel GetPixel GetTextExtentPoint32A SetDIBColorTable CreatePalette CreateSolidBrush CreatePen GetTextMetricsA SelectPalette RealizePalette BitBlt SelectObject SetBkMode SetTextColor GetStockObject CreateFontIndirectA DeleteObject GetDeviceCaps

comdlg32

GetSaveFileNameA ChooseColorA GetOpenFileNameA

advapi32

GetUserNameA

shell32

ShellExecuteExA SHGetSpecialFolderPathA ShellExecuteA

ole32

OleInitialize CoCreateInstance IIDFromString CoUninitialize CreateStreamOnHGlobal OleUninitialize CoInitializeEx CLSIDFromProgID

oleaut32

SafeArrayGetElement OleLoadPicture SafeArrayPutElement SafeArrayCopy SafeArrayGetVartype SafeArrayGetLBound SafeArrayGetUBound SysAllocString VariantCopy VariantCopyInd VariantChangeType SysAllocStringByteLen SysFreeString SafeArrayCreate SafeArrayUnaccessData VariantClear VariantInit SafeArrayAccessData SafeArrayGetDim

winmm

sndPlaySoundA mciSendStringA timeEndPeriod timeGetDevCaps timeBeginPeriod timeGetTime

a6306c79f2996f893dec6bc8fa94eb84_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$TEMP/BASSMOD.dll

generic

$TEMP/R2RJUCE.dll

generic

out.upx

generic

$TEMP/bgm.xm

$TEMP/keygen.exe

comctl32

msimg32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

winmm

generic