0b0d8df4742469c74d327bdae0f3490f_JaffaCakes118
- SHA256 6acad13221b8e15e7d5bcd3f3705c8da7751550bc6e6bf42fc23d17d0eda1a50
-
NSIS installer
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Consignment Document PL&BL Draft.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Consignment Document PL&BL Draft.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
yrcvb.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
yrcvb.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 0b0d8df4742469c74d327bdae0f3490f_JaffaCakes118
- Size 922KB
- Sample240624-2ps5gswcqd
- SHA256 6acad13221b8e15e7d5bcd3f3705c8da7751550bc6e6bf42fc23d17d0eda1a50
- MD5 0b0d8df4742469c74d327bdae0f3490f
- SHA1 808e2879bddd5ba17b5397a25281820edceae745
- SHA512 b55198c32af5fd16d06fe024eb896df1d79d7d0edacc49834a5c0afb0c344434b3d9666acc4215d40bfe6f71bf85bee434e6f3deda7c9d67a1a69b3a05ed4305
- SSDEEP 3072:BBkfJpRXATwMdFCct+bYGTHbzgxXCXBMz8sfUKVIbzqMmLNer0ABJEREhwBCkXx1:BqjIQYGzghO3Ol68LMJQLHhTbt
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/Consignment Document PL&BL Draft.exe unpack003/$PLUGINSDIR/System.dll unpack003/yrcvb.dll - NSIS installer 3 IoCs
resource yara_rule sample nsis_installer_2 static1/unpack002/Consignment Document PL&BL Draft.exe nsis_installer_1 static1/unpack002/Consignment Document PL&BL Draft.exe nsis_installer_2
File Explorer
-
0b0d8df4742469c74d327bdae0f3490f_JaffaCakes118.iso 922KB
-
out.iso.iso 922KB
-
Consignment Document PL&BL Draft.exe.exe 330KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
50x50.jpg.jpg 990B
-
README.md1KB
-
download.png.png 6KB
-
tgnloqp.l160KB
-
yrcvb.dll.dll 11KB
out.iso
- SHA256 6acad13221b8e15e7d5bcd3f3705c8da7751550bc6e6bf42fc23d17d0eda1a50
- MD5 0b0d8df4742469c74d327bdae0f3490f
- SHA1 808e2879bddd5ba17b5397a25281820edceae745
- SHA512 b55198c32af5fd16d06fe024eb896df1d79d7d0edacc49834a5c0afb0c344434b3d9666acc4215d40bfe6f71bf85bee434e6f3deda7c9d67a1a69b3a05ed4305
- SSDEEP 3072:BBkfJpRXATwMdFCct+bYGTHbzgxXCXBMz8sfUKVIbzqMmLNer0ABJEREhwBCkXx1:BqjIQYGzghO3Ol68LMJQLHhTbt
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Consignment Document PL&BL Draft.exe
- IMPHASH ced282d9b261d1462772017fe2f6972b
- SHA256 e92125c96b4bee95fd7b70d867271510071f812699733de75dd5e64636030314
- MD5 0b1f9847d93445c91cdfe0c2dd6785c7
- SHA1 198b30e2b098300ec51e2e7029ababff142a5e09
- SHA512 1adaa0879bd697ba972fabe8c5407bbf8bf16ea6b55cfbdffd42128174d9f1d8ebe1444a927d0b2ae376563d927467599dfe4e254b096e0f55a5b810ff46fcc1
- SSDEEP 3072:NBkfJpRXATwMdFCct+bYGTHbzgxXCXBMz8sfUKVIbzqMmLNer0ABJEREhwBCkXx1:NqjIQYGzghO3Ol68LMJQLHhTbt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
13074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersion
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
50x50.jpg
- SHA256 10c7923013668a793ba279dff60675fde5077234e5b2be84dd7c297d43540ad6
- MD5 ca6477ef69993246149bd34b857651db
- SHA1 01411f9b09d58c6ea7f4068ace6207db4fb1b46f
- SHA512 02e5c2b806f58774e3f5b7d0b71c2c3ced543170ab643d211a6839ddb82676a88a321bfcccc65700272b0b9595193d8c2573bf7f477b945d1a8e798e7f7226fe
- MD5 SHA1 SHA512
-
NSIS installer
README.md
- SHA256 20d1cea77432e36ac12c16a2636344d92fab61c3f349444f3a7808ab3f57a1ac
- MD5 0b61e9b2d174d66a91074558158d061c
- SHA1 93d625d555981387466aca8018075b1195496b9c
- SHA512 6ad59fd9f375d5e2b0e92ecb60406523f9333fff8a837963fb685ed3bf40f888c2d4847d4be6cfda16e1bfc668eb21d2724d073504af1bbf82a18aca58e9577f
- MD5 SHA1 SHA512
-
NSIS installer
download.png
- SHA256 8a4bd6e4675e40248040db34c43fbf4bf7f8d0a67404efb4bed3d7a47f2c6dbd
- MD5 a7032131575edf08d718f4d3a1343e99
- SHA1 4f6fef19c9b8f75f9e962fd3c78e92cd3b836446
- SHA512 a6f47acff9d8b1bf48f9c8f3a64b75a8f3e5be071ac378eaa46252eaf27c84b075347ae052390ed892f17d820d7fda7a516298b787cda02718cd47bcf8c0a0a0
- SSDEEP 192:SthnMfuGYvaKydwNpxE3MJirxNfmL+Cni1c6T:Sf+Yvab+tE3MyjmrnczT
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
tgnloqp.l
- SHA256 8e50fd60f8a9b10e54d3540a4b35f8cfd518e8fa67f4aa0570e513cc9032027c
- MD5 5240df39ecffac79cc0e4834647f42ee
- SHA1 12f950dd900227b1b644eb439afa2f7fbb346424
- SHA512 ec126008bc28797c07572fe7637dbbbe440c360b14e2387f14a5e77c5a80f6fc00e9b34940b72e58d5c3dfc7d43940b633603c943b514ed4e7f6fa6f99cda262
- SSDEEP 3072:FzgxXCXBMz8sfUKVIbzqMmLNer0ABJEREhwBCkXxhHhTGTH:FghO3Ol68LMJQLHhTY
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
yrcvb.dll
- IMPHASH a12dcd6298557fefc3ebf9159ef666c5
- SHA256 f4163107f632e0b431c38652eb297733f4f01d37576100673a47370da9221159
- MD5 8d80a618809cc8ce5970b0839f0e2b5a
- SHA1 34af09ca5aa646debe4d2bd06fd5b3c3b7a43b09
- SHA512 21bfab7002044c7b33d99de355b49357ae5c45c8781ae080a906c091621ab55e39444e3ecfe04345022ab214dd50f38df0387a3386e0442312cc614bc8b397bf
- SSDEEP 192:s6/In3h0bUe1nJBmKESoXIIbzuStOiKazVWGUwkcU:s6ax0B1nJBbxojuStORazsV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
1
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
VirtualAlloc
mswsock
TransmitFile
GetAddressByNameW
GetAcceptExSockaddrs
GetAddressByNameA
WSARecvEx
GetServiceA
imm32
ImmGetCandidateListCountA
ImmRegisterWordA
ImmSetCompositionFontW
ImmGetRegisterWordStyleA
ImmCreateIMCC
ImmGetOpenStatus
ImmGetImeMenuItemsA
ImmLockIMCC
msacm32
acmFormatTagDetailsA
acmFormatChooseA
acmFilterChooseA
acmFilterTagEnumW
acmFormatEnumW
acmFilterDetailsA
acmFormatTagEnumA
wininet
InternetCrackUrlW
HttpQueryInfoA
InternetAutodialCallback
GopherGetAttributeA
ParseX509EncodedCertificateForListBoxEntry
pdh
PdhGetDataSourceTimeRangeA
PdhOpenQuery
PdhGetRawCounterArrayA
PdhParseInstanceNameW
PdhCollectQueryDataEx
PdhVbAddCounter
PdhValidatePathA
PdhEnumMachinesA
rpcrt4
RpcServerInqDefaultPrincNameW
NdrContextHandleSize
MesDecodeIncrementalHandleCreate
NDRCContextMarshall
I_RpcNsBindingSetEntryNameA
NdrProxyInitialize
Ydlcpzlxpe
Name
.code
Size
1024B
Virtual Size
946B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=42, id=1, productName=Unmarked objects,
count=1, id=260, version=24245,
count=1, id=256, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,