6430c48fdab05ad207fd34d63fa010d6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
6430c48fdab05ad207fd34d63fa010d6_JaffaCakes118
Size 148KB
Sample240722-whfb6azbja
SHA256 d4504d345e8c032190242933fd3b24184ebbb66d670668f24e74b2c699486d21
MD5 6430c48fdab05ad207fd34d63fa010d6
SHA1 ed8b0fea0a4ef044eadc9d419de17cc4b3b771c0
SHA512 b961a2b5912c8f37fd56273224fbd3a96af16e961a8d7ddea8948f8af0250e07efcf078c007e7cfbf2b88bc779adb83e65d5cf3c16238f46539f0e5dbb9e4866
SSDEEP 3072:+vnBaaWH8bb2dYwKkqZP98WjngUJwpY9MEidcLF3iQ:+vncXcbyd5KkqZ18LKwWIdk37
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
6430c48fdab05ad207fd34d63fa010d6_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$TEMP/gtalkwmp1.dll
unpack001/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_1

File Explorer

6430c48fdab05ad207fd34d63fa010d6_JaffaCakes118

.exe 148KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$TEMP/gtalkwmp1.dll

.dll 68KB
out.upx

.exe 56KB

6430c48fdab05ad207fd34d63fa010d6_JaffaCakes118

SHA256 d4504d345e8c032190242933fd3b24184ebbb66d670668f24e74b2c699486d21
MD5 6430c48fdab05ad207fd34d63fa010d6
SHA1 ed8b0fea0a4ef044eadc9d419de17cc4b3b771c0
SHA512 b961a2b5912c8f37fd56273224fbd3a96af16e961a8d7ddea8948f8af0250e07efcf078c007e7cfbf2b88bc779adb83e65d5cf3c16238f46539f0e5dbb9e4866
SSDEEP 3072:+vnBaaWH8bb2dYwKkqZP98WjngUJwpY9MEidcLF3iQ:+vncXcbyd5KkqZ18LKwWIdk37
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

230448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 af15ef6479e5ac5752d139d1c477ec02def9077df897dadc8297005b3fc4999d
MD5 61151aff8c92ca17b3fab51ce1ca7156
SHA1 68a02015863c2877a20c27da45704028dbaa7eff
SHA512 4f5c943b7058910dc635bdcfadfea1d369c3d645239d1a52b030c21f43aac8e76549e52fd28e38ba5341d32aefe3c090dd8377d9e105ad77f71ab8870d8e326e
SSDEEP 192:2OShJI/rmOAIPkWpUybQ9WhP4t5Rwc89XbubZaX5:n6OAOkWWycGP4XRwc2qFaX5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 48cfa0ea7e353e4a7dd23572da8374ef
SHA256 9e4440baf56d47ca4cc1f29e7a62d407d1f9524986160b30de5f825a3fedee88
MD5 2b006bbf7c9295683eddfad40008be85
SHA1 b3f42a8e2ff172d51418c72811586b11ed589909
SHA512 e1cfd739b7f8de442e2fb49c83569e8051492180780d92a4bfaa9c90b1444fd0020f9f596c12820642dd33cbee2c81ec793acb1c8dab1d1bebbe25b33c51efe8
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/gtalkwmp1.dll

IMPHASH 09b4009ab39e5a5e4279f4e16a986352
SHA256 fd23273a36db53e1da88e2b4ec84ffb720e54f9c6ab8820bf8937e870d64e44b
MD5 f341a096bbc785dc39e0170ff725a7d5
SHA1 75b233a2fc20ff4a748c65b80c17188f63b9cd53
SHA512 fe4a237a9b7b100e0b4ae5a2daf30989b3d6744ee7e7ba0a8a3c6322cf390a93fde3cfed79e4593e06f7ff072e1c207b9182623ccdb1b9da02cb412c8096b77a
SSDEEP 1536:tEAx/fgfg9yE7qnuhyP27auArvBMJlFf:tDxBZqV2evBMJlF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\src-branches\104\googleclient\talk\build\ext_opt\obj\clio\gtalkwmp\gtalkwmp1_dll.pdb

kernel32

HeapAlloc GetProcessHeap GetCurrentProcess GetCurrentThread WideCharToMultiByte GetLongPathNameW MultiByteToWideChar lstrcpyW GetModuleFileNameW lstrcatW InterlockedIncrement InterlockedDecrement lstrcmpiW lstrcpynW GlobalUnlock GlobalLock FreeLibrary SizeofResource LoadResource CloseHandle LoadLibraryExW GetModuleHandleW GetCurrentThreadId FlushInstructionCache LCMapStringA GetStringTypeW GetStringTypeA LoadLibraryA GetCPInfo GetOEMCP GetSystemTimeAsFileTime GetCurrentProcessId HeapFree GetLastError DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW GetVersionExW GetThreadLocale GetLocaleInfoA GetACP FindResourceW InterlockedExchange GetTickCount GetSystemInfo VirtualProtect QueryPerformanceCounter WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetVersionExA HeapReAlloc GetCommandLineA ExitProcess HeapDestroy HeapCreate VirtualFree VirtualAlloc RtlUnwind VirtualQuery GetProcAddress GetModuleHandleA TerminateProcess HeapSize TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue SetHandleCount GetStdHandle LCMapStringW

user32

RegisterClassExW LoadCursorW wsprintfW CreateWindowExW DestroyWindow SendMessageW CallWindowProcW GetWindowLongW SetWindowLongW DefWindowProcW UnregisterClassW CharNextW GetClassInfoExW

advapi32

RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryInfoKeyW OpenThreadToken OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegOpenKeyExW RegCloseKey RegDeleteKeyW RegEnumKeyExW

ole32

CreateStreamOnHGlobal GetHGlobalFromStream CoTaskMemFree CoTaskMemAlloc StringFromGUID2 CoCreateInstance CoTaskMemRealloc

oleaut32

SysAllocString SysStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysFreeString

shlwapi

PathFindExtensionW

out.upx

SHA256 520f3efa241298b680e637c5a9646373efed99c45f9efdc962f27472a901bc74
MD5 8424283d342681ee74590d3634c311ad
SHA1 421a3d53a8083beba4e580e0ac3907c166cb11c3
SHA512 32f5b42e807503cd7068b465b6b4f9b40f80239993dc2734a2f988edce083bb0cff6dc2477d28b1d8744058378455bd381e2e30f52c6ef6df77d193f20172dad
SSDEEP 768:+ebbuV4LlKWVJd9dxVh1qAOYwXzBx2JX6HDA2C8BPioNS1vJ/4:lbSqZVJdThUxmuRBqof
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

6430c48fdab05ad207fd34d63fa010d6_JaffaCakes118

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$TEMP/gtalkwmp1.dll

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

generic

out.upx

generic