3e0cf80ff6b94ff711170a208796a3e1_JaffaCakes118
- SHA256 f51f3c1fb71a3301e0716e9025bc063e8f1aeb7c3b1bb5570f9e159f86eb67be
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ScanDoc_pdf.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScanDoc_pdf.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
6xvjduoucppa.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
6xvjduoucppa.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3e0cf80ff6b94ff711170a208796a3e1_JaffaCakes118
- Size 224KB
- Sample240712-tldxdstalc
- SHA256 f51f3c1fb71a3301e0716e9025bc063e8f1aeb7c3b1bb5570f9e159f86eb67be
- MD5 3e0cf80ff6b94ff711170a208796a3e1
- SHA1 2e271640cb07be65a0804e95e5c915c6156bdea5
- SHA512 0735ae53edace8b69f1ae16524bfe875b9536e9f44e603fe5158a8f5f221a2ee66767645f3a33d165d9b528a404fa7421e4f8bfaa67f79da9a97f4ad8bf38c0c
- SSDEEP 3072:8jAs3HPxNZvUOGr178ueCl6H7jr0rdGXYyPX6n8H8k3sp4Qxg+VS2till3oUkt0g:80cnRe11ea83DXlPq8ck8ev+seioHP5
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/ScanDoc_pdf.exe unpack002/$PLUGINSDIR/System.dll unpack002/6xvjduoucppa.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/ScanDoc_pdf.exe nsis_installer_1 static1/unpack001/ScanDoc_pdf.exe nsis_installer_2
File Explorer
-
3e0cf80ff6b94ff711170a208796a3e1_JaffaCakes118.zip 224KB
-
ScanDoc_pdf.exe.exe 296KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
6xvjduoucppa.dll.dll 11KB
-
iwokkkl.tkl161KB
ScanDoc_pdf.exe
- IMPHASH ced282d9b261d1462772017fe2f6972b
- SHA256 b1999a87350ef2b15e663c809ac16f2f0832ba3dcd868aefe0d36392af04da29
- MD5 de0a385641f08128deab9ec88a298d28
- SHA1 5f51c8ce26b59ebed00f23ccc4fe696272a0bf07
- SHA512 8d93ba4cb7c68426b4441f2950128646fb136285ef6863f0d0c2e08c368c1174d467937a423946e95b1f5fec6213cf6127c666c143c6d5d77d932e64dd1958b2
- SSDEEP 6144:Wx/MriVFI8E0P9Qsa8vJXlPqC8A8e1+uaisJPM:qFo8E0lE8h1CJA8Wai6M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
13093
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersion
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=12, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
6xvjduoucppa.dll
- IMPHASH 90edeabb616f994f459c3a2e4ca1b6fc
- SHA256 b574aefc953483b2e57dca1653bfec41d14d0c0d460a0e7e778e943d4a1ce364
- MD5 5c05b7632a19f8b04717a76aae9e2659
- SHA1 a4b1062e88f9170917ec5a9b251bd739f995c3c8
- SHA512 eaef74792c64f675add11a6392e32e2eed47701add80ac9945301324057aa8778e9afbd3588109a578f3da1ff09000b1c80756ab9b7f6c5f5ef27dde7fb531ce
- SSDEEP 192:OOM8EnrUm2cHjpMTl+p2/mpnTsaqIT9PzRbRit:7EV2cHjpcT/cnNNbRG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
shlwapi
StrStrIW
StrRStrIA
UrlIsA
PathFindExtensionW
UrlCanonicalizeA
StrCmpNIW
msacm32
acmFormatSuggest
acmDriverClose
acmDriverAddW
acmFormatEnumA
acmFilterEnumA
acmDriverOpen
acmDriverAddA
acmStreamMessage
acmFormatEnumW
ole32
StgSetTimes
CreateDataCache
ReadClassStm
GetHGlobalFromStream
OleConvertOLESTREAMToIStorageEx
HPALETTE_UserFree
shell32
SHFileOperationA
SHGetSettings
FindExecutableW
ExtractAssociatedIconExA
winspool.drv
DeleteMonitorW
GetPrinterDataExA
EnumJobsW
ord209
EnumPrinterDataW
avifil32
AVISaveA
AVIMakeStreamFromClipboard
AVIFileOpen
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
msvfw32
DrawDibOpen
oleaut32
VarI1FromUI2
DispInvoke
OleIconToCursor
VarPow
CreateDispTypeInfo
CreateStdDispatch
VarCyFromR8
VarFormatDateTime
winmm
PlaySound
midiStreamClose
mixerGetLineInfoA
Fdsffxs
Name
.text
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=47, id=1, productName=Unmarked objects,
count=21, id=185, version=30716,
count=1, id=210, version=50727,
count=1, id=202, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
iwokkkl.tkl
- SHA256 3758c7ded7ed7a66faf307fa5e5c5a3720aa195293db64868c305039d2adc9c5
- MD5 72c3ec0049fe71e16dee253d51b6db86
- SHA1 8f38c5648dbc3a7836a5f707e81ca8d4233f2364
- SHA512 9b103d446c062a70e9b904b164cc6ed29993551350622dcebfab983b34a6ef28e60db243a006fc6f292e528c376176524172f32d0e717fa5c410fee49a2da644
- SSDEEP 3072:HusCl6H7jb0rv6XYyPX6hEHcA3sp4Qxo+rS2zill3oykt0QHvR:Osa8vJXlPqC8A8e1+uaisJPR
- MD5 SHA1 SHA512 SSDEEP