21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118
Size 2.8MB
Sample240703-gefq7azelg
SHA256 aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
MD5 21434ba1af9e80e0bb9d4e49e643d269
SHA1 c460ce1a3fd7c3c5af78ab01a18bc62bcf3a8c8b
SHA512 012a96b51ee1cefa86c0bfca56f0fe2a0e3d7ec061fa6868184234338dd5f2329bc0de2298d4a782c3e2bdb4bd665fd373adad6f28f26c2c6439972280d9d7b8
SSDEEP 49152:AS4o6fCn0IO2N7Sb/h0vQV2vMHZYd6GZC+8qBBVRlEt73LfsL6kVOSo3dAf2doBn:AG0aw/8HWZY/A+8qvfli7fsLHgSw7G5P
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118
unpack001/LIXVoWXPPCyc5Jy.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118

.exe 2.8MB
AmazonGamesSetup.exe

.exe 1.8MB
LIXVoWXPPCyc5Jy.exe

.exe 2.5MB

21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118

IMPHASH 29b61e5a552b3a9bc00953de1c93be41
SHA256 aa79d46aa459af0d46da380af6481f51369da4c4080a009028e83857dcd844f2
MD5 21434ba1af9e80e0bb9d4e49e643d269
SHA1 c460ce1a3fd7c3c5af78ab01a18bc62bcf3a8c8b
SHA512 012a96b51ee1cefa86c0bfca56f0fe2a0e3d7ec061fa6868184234338dd5f2329bc0de2298d4a782c3e2bdb4bd665fd373adad6f28f26c2c6439972280d9d7b8
SSDEEP 49152:AS4o6fCn0IO2N7Sb/h0vQV2vMHZYd6GZC+8qBBVRlEt73LfsL6kVOSo3dAf2doBn:AG0aw/8HWZY/A+8qvfli7fsLHgSw7G5P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess CreateDirectoryA lstrcmpiA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject GetWindowsDirectoryA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

AmazonGamesSetup.exe

IMPHASH 3302113802c12275640ee5769b28cde4
SHA256 1a99f1054e51fe86416c59e5c526d69776fdabd7bb9831dbaab8582322121c7a
MD5 02be3726c0a90958a3c30577d3b3a131
SHA1 bedbab8bd74a9d7313ba32ca033c81ec32c04706
SHA512 662eaa8d3b112ef981d27832a2a46b0ecb55e2d1dcf49fe1fbd134e3c4e02758bc9ad3db2e25f53fc174e2083dd278967f405a768fdd814612c9a43bc6d1c713
SSDEEP 49152:G/mvl+01HHWra6IjgKDlUzIzsBKLxYqJKevCnuueO+0D17gM8s:bvUAnWrBq1ABzH
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

NSIS installer

installer

Digest

c5:16:39:ab:2a:66:18:1e:9b:42:e8:1b:c5:2b:01:dc:3d:da:64:66:91:73:cf:79:52:d6:7e:8a:6a:ed:91:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=3482342,CN=Amazon.com Services LLC,OU=Amazon Game Studios,O=Amazon.com Services LLC,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Aug 10, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

04:70:07:33:bd:f5:29:7c:12:2e:93:a1:a8:28:47:8f

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 6, 2020 - Aug 11, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

906084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\2d8069f083912ec0\installer\bin\Win32\Release\Amazon Games Setup.pdb

kernel32

GetCurrentThread SetFilePointerEx MoveFileExW CreateMutexA GetExitCodeThread SystemTimeToFileTime SetFileAttributesW LoadLibraryExA FreeLibrary InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetLastError GetThreadTimes OutputDebugStringW GetDynamicTimeZoneInformation QueryPerformanceCounter GetDiskFreeSpaceExA SetThreadPriority WideCharToMultiByte GlobalMemoryStatusEx GetProcessHeap GetCurrentProcessId DeleteCriticalSection HeapDestroy DecodePointer GetOverlappedResult GetCurrentDirectoryW HeapAlloc CreateThread RaiseException HeapReAlloc Process32FirstW QueryPerformanceFrequency LoadLibraryA GetDiskFreeSpaceExW Process32NextW FormatMessageW MultiByteToWideChar CreateEventW CreateToolhelp32Snapshot HeapSize OpenProcess GetModuleHandleA ReleaseMutex GetVersionExW GetLocaleInfoW InitializeCriticalSectionEx CreateMutexW GetTempPathW SetFilePointer GetUserDefaultUILanguage GetModuleFileNameW RemoveDirectoryW TerminateProcess GetSystemDefaultUILanguage GetStdHandle HeapFree GetFileSizeEx ReadFile CreateDirectoryW GetExitCodeProcess GetModuleHandleW CreateProcessW GetProcAddress GetWindowsDirectoryW LoadLibraryW CloseHandle DeleteFileW GetLastError Sleep GetCurrentThreadId CreateFileW WaitForSingleObject WriteFile GetCurrentProcess GetSystemTime SetEndOfFile SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA ReadConsoleW GetTimeZoneInformation FlushFileBuffers GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID GetCommandLineW IsValidLocale GetTimeFormatW GetDateFormatW GetACP ExitProcess ExitThread SetStdHandle FileTimeToSystemTime EncodePointer IsProcessorFeaturePresent QueueUserWorkItem GetModuleHandleExW TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx SwitchToThread FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetStringTypeW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetCPInfo SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateTimerQueue FreeLibraryAndExitThread LoadLibraryExW SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind GetFileType GetModuleFileNameA WriteConsoleW GetSystemInfo VirtualQuery GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime

user32

IsIconic GetWindowTextW GetWindowThreadProcessId GetWindowRect MessageBoxW FindWindowW EnumWindows EndPaint BeginPaint GetCursorPos ReleaseDC InvalidateRect ReleaseCapture UpdateWindow ShowWindow PostQuitMessage DrawIconEx DrawTextW UpdateLayeredWindow SetCapture LoadCursorW TranslateMessage TrackMouseEvent PeekMessageW SetTimer DispatchMessageW RegisterClassExW GetSystemMetrics GetIconInfo CreateWindowExW SetWindowPos GetDC DefWindowProcW SystemParametersInfoW SetForegroundWindow PostMessageW

comdlg32

GetSaveFileNameW

advapi32

GetSecurityDescriptorDacl GetSecurityDescriptorOwner GetFileSecurityW DuplicateToken MapGenericMask GetTokenInformation RegQueryValueExW LookupAccountSidW GetUserNameW GetLengthSid RegOpenKeyExW CheckTokenMembership FreeSid OpenProcessToken IsValidSid RegCreateKeyExW RegSetValueExW RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegCloseKey EqualSid GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid AccessCheck

shell32

ShellExecuteExW SHParseDisplayName ShellExecuteA SHGetFolderPathW SHCreateShellItem CommandLineToArgvW

ole32

CoCreateGuid StringFromCLSID CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

SHStrDupW

userenv

UnloadUserProfile

rpcrt4

UuidCreate

msimg32

AlphaBlend

gdi32

GetTextExtentPoint32W DeleteDC SetBkMode CreatePen Rectangle SetTextColor TextOutW CreateFontW GdiFlush StretchBlt CreateCompatibleDC CreateDIBSection SelectObject CreateCompatibleBitmap BitBlt GetObjectW SetStretchBltMode DeleteObject CreateSolidBrush CreateDIBitmap RoundRect

LIXVoWXPPCyc5Jy.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d9aa21479a1a55d57839aee6310cd6853b2bc5215337aa72316a96f7be7ff3e5
MD5 cef6d09b553a93f81942da9838b1ac57
SHA1 c32fbf54b54dadabbae600645c417c163234daf5
SHA512 05ed612b7d2e14b034a391d45b578e0eda2b52be3b8eeccb3534872de61d05d95b4b3e7f10bfa01ef6913d29a24404c8cf635c804f9fbe2820321078d1007928
SSDEEP 49152:SoSto6fCl0KeaNs68/bXvlM28MTVTc6hhCkJNV8VicCFiO1:S9+0P9/rBRVTpIkJN+YcLO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

2557550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

21434ba1af9e80e0bb9d4e49e643d269_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

AmazonGamesSetup.exe

kernel32

user32

comdlg32

advapi32

shell32

ole32

winhttp

version

shlwapi

userenv

rpcrt4

msimg32

gdi32

generic

LIXVoWXPPCyc5Jy.exe

mscoree

dotnet