a164eb4b41ac5a169c6d0c96b7f5bdd2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a164eb4b41ac5a169c6d0c96b7f5bdd2_JaffaCakes118
Size 712KB
Sample240817-gfalkazeme
SHA256 b35e69000c97097d1f710510049a4d3ebc8f31db782d4e1eefd79580705bbc47
MD5 a164eb4b41ac5a169c6d0c96b7f5bdd2
SHA1 49fe2b04aadd7fb70b8f2b1f1de07b1ff49071a1
SHA512 fdc881d41fde922fd68985d1ec697121c43323dae9148b04a4942194c46f293a199edb45f82019e74a9101f51395fb3c768ea04a8cda1124be5fd7b40bd0a5fa
SSDEEP 12288:pCQNAPylrL9iQ4XkNlPPqvlDaxM12JKdLu3iMz1HiMZFeRUI/fCc+sNrrf:pCQNKyqQ+k/PPKNaxM8JxPiNmACcvNrL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a164eb4b41ac5a169c6d0c96b7f5bdd2_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

File Explorer

a164eb4b41ac5a169c6d0c96b7f5bdd2_JaffaCakes118

.exe 712KB
$0/basicscan.dll

650KB
$PLUGINSDIR/InstallOptions.dll

.dll 13KB
$PLUGINSDIR/ioSpecial.ini

193B
$PLUGINSDIR/modern-wizard.bmp

150KB

a164eb4b41ac5a169c6d0c96b7f5bdd2_JaffaCakes118

IMPHASH 4a9446e5cc2412c6405cea69dddb93be
SHA256 b35e69000c97097d1f710510049a4d3ebc8f31db782d4e1eefd79580705bbc47
MD5 a164eb4b41ac5a169c6d0c96b7f5bdd2
SHA1 49fe2b04aadd7fb70b8f2b1f1de07b1ff49071a1
SHA512 fdc881d41fde922fd68985d1ec697121c43323dae9148b04a4942194c46f293a199edb45f82019e74a9101f51395fb3c768ea04a8cda1124be5fd7b40bd0a5fa
SSDEEP 12288:pCQNAPylrL9iQ4XkNlPPqvlDaxM12JKdLu3iMz1HiMZFeRUI/fCc+sNrrf:pCQNKyqQ+k/PPKNaxM8JxPiNmACcvNrL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess lstrcmpiA CopyFileA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b3d296ff6f7abb1319ee006fcc6c4d98
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints GetClientRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA PtInRect LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA OpenClipboard

gdi32

SetTextColor GetObjectA SelectObject GetDIBits CreateRectRgn CombineRgn DeleteObject CreateCompatibleDC

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder SHGetMalloc ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

a164eb4b41ac5a169c6d0c96b7f5bdd2_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$0/basicscan.dll

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp