3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118
Size 682KB
Sample240713-c83qlascrn
SHA256 14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65
MD5 3fe2596f06b31058fb5614b5d9f7bc0f
SHA1 6940ec12152682a3c89a305b3ec8fdb3fbcccd20
SHA512 b04a6f6127c93487df80485adc65af14060e8c931dc3cd500b0ef5fe0f5e45a33dc6e02a308c160485612ce30bef4a4d369e9c15d3eb0a52ae5041201dce1716
SSDEEP 12288:JDs0V8RmEVoxYZuCTLWIZZBNt43NEemWZmqj:dnyRmEZuCHLNt43Nkw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/lz0xkoqy.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118

.exe 682KB
$PLUGINSDIR/System.dll

.dll 11KB
lz0xkoqy.dll

.dll 11KB
ttxrrnsav.h

464KB

3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65
MD5 3fe2596f06b31058fb5614b5d9f7bc0f
SHA1 6940ec12152682a3c89a305b3ec8fdb3fbcccd20
SHA512 b04a6f6127c93487df80485adc65af14060e8c931dc3cd500b0ef5fe0f5e45a33dc6e02a308c160485612ce30bef4a4d369e9c15d3eb0a52ae5041201dce1716
SSDEEP 12288:JDs0V8RmEVoxYZuCTLWIZZBNt43NEemWZmqj:dnyRmEZuCHLNt43Nkw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

lz0xkoqy.dll

IMPHASH 96053748149d2524fa1cbf7cbbb0e8ac
SHA256 de757495d61e622adffed7588acdb5eba2f18734c13eaf9e25949779f2cb75fe
MD5 1dc8118acd04962a04f537c7dabe17be
SHA1 c04648b207433324803c595b22efaafc2423bfd3
SHA512 54107302bff8bfe9179f969f13045f83281ae9aef8ab2e723f0aa540fc46dc86d2a23b79ecfd6700b2fedbf3cf729a0693887bbad772fa993a5a7ee8bb9c0475
SSDEEP 192:IRkq0eddH2mOTFM6tlPFfYamGaGQITKzWAg8CRuDqxz6:QkS8FMOl9g0aZITQ6R5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

3fe2596f06b31058fb5614b5d9f7bc0f_JaffaCakes118

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

lz0xkoqy.dll

winspool.drv

wsock32

loadperf

resutils

imm32

comdlg32

rtm

generic

ttxrrnsav.h