2e3d2302a857eb710597c6262f3c87cf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
2e3d2302a857eb710597c6262f3c87cf_JaffaCakes118
Size 209KB
Sample240708-3mx64avdrl
SHA256 6a37a2a65393b805bbe4e7e4e42b642da433e9caa7436aaeb9df8ab0fc6679b9
MD5 2e3d2302a857eb710597c6262f3c87cf
SHA1 1bf6dd9bac3cf9ae73d7108a014f5ae0e43305be
SHA512 488bbaa2d9a4b35251bfe117ff07bcd9c18c83c6fa64a15deaf41bde7fcdb22f4968704845923a90b6ec23b23dfce999c84de1040a72647696b96ca69cdec976
SSDEEP 6144:oqjIaRo4srOUXm3HL8ojJgBI97baJSUjek6o9SEmkL2ft:l1vAOqm3YoFbwD76o9AG0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
2e3d2302a857eb710597c6262f3c87cf_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/gdqvwne6bjt.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

2e3d2302a857eb710597c6262f3c87cf_JaffaCakes118

.exe 209KB
$PLUGINSDIR/System.dll

.dll 11KB
alnvlkymea.oy

161KB
gdqvwne6bjt.dll

.dll 11KB

2e3d2302a857eb710597c6262f3c87cf_JaffaCakes118

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 6a37a2a65393b805bbe4e7e4e42b642da433e9caa7436aaeb9df8ab0fc6679b9
MD5 2e3d2302a857eb710597c6262f3c87cf
SHA1 1bf6dd9bac3cf9ae73d7108a014f5ae0e43305be
SHA512 488bbaa2d9a4b35251bfe117ff07bcd9c18c83c6fa64a15deaf41bde7fcdb22f4968704845923a90b6ec23b23dfce999c84de1040a72647696b96ca69cdec976
SSDEEP 6144:oqjIaRo4srOUXm3HL8ojJgBI97baJSUjek6o9SEmkL2ft:l1vAOqm3YoFbwD76o9AG0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gdqvwne6bjt.dll

IMPHASH d31a1361712857c118d7eef1b83e7c7b
SHA256 2112c3f6c4653de2bfcb88bdb2ca510696d857de1b834c0626563396052cfa88
MD5 8ac0a9612824f494f99b434b3398b110
SHA1 474570ccd65cba044d5bb3cb00d4f04b67c53026
SHA512 f9306f0a49dd7e4d5f2f4830cdbfb070ced2f7f413f7a49de3011be92655d3d5905cdbd3e3772a6768aac2ead2f52d620df72cad6f8c1e833fe92771aa56fd5f
SSDEEP 192:io3eIUNGLew2cklTnfQZSQCtLi5IR+u/rMjbBR7qlGEsPy/:1UNGLQcYTn4ZOL0Y+2rMjfyG2
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

2e3d2302a857eb710597c6262f3c87cf_JaffaCakes118

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

alnvlkymea.oy

gdqvwne6bjt.dll

rtm

oleaut32

mapi32

rtutils

msacm32

winspool.drv

generic