d2ecf4ae19990601e56e92329b3b95a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
d2ecf4ae19990601e56e92329b3b95a2_JaffaCakes118
Size 116KB
Sample240907-1xefmazeqb
SHA256 1d4497b7449d3d2166b18b01c79812929a57168477088dbaad9ab4893d4d32a3
MD5 d2ecf4ae19990601e56e92329b3b95a2
SHA1 b9e3a4de527dcf6bd71788cd728c04f9ea52e355
SHA512 c6d97bf1761c77843f7e032e0a7ab6031d47663d40c11da07f8772e895520a3a1386453d028a1b27c5726d9a2286bf37ea1e5073db1df1c146a234737d5fcc4d
SSDEEP 3072:sOPlfJJJpVjea8QoGCbhx7svtO1tVa6/wUEJy1:39f9Q3G8jNb5/wUKU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
d2ecf4ae19990601e56e92329b3b95a2_JaffaCakes118
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/SelfDel.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/time.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

d2ecf4ae19990601e56e92329b3b95a2_JaffaCakes118

.exe 116KB
$PLUGINSDIR/Math.dll

.dll 66KB
$PLUGINSDIR/SelfDel.dll

.dll 4KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/inetc.dll

.dll 20KB
$PLUGINSDIR/time.dll

.dll 10KB

d2ecf4ae19990601e56e92329b3b95a2_JaffaCakes118

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 1d4497b7449d3d2166b18b01c79812929a57168477088dbaad9ab4893d4d32a3
MD5 d2ecf4ae19990601e56e92329b3b95a2
SHA1 b9e3a4de527dcf6bd71788cd728c04f9ea52e355
SHA512 c6d97bf1761c77843f7e032e0a7ab6031d47663d40c11da07f8772e895520a3a1386453d028a1b27c5726d9a2286bf37ea1e5073db1df1c146a234737d5fcc4d
SSDEEP 3072:sOPlfJJJpVjea8QoGCbhx7svtO1tVa6/wUEJy1:39f9Q3G8jNb5/wUKU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Math.dll

IMPHASH c1eddc2d743572429fa0b1a79b7ac0fe
SHA256 54cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560
MD5 9eb6cecdd0df9fe32027fcdb51c625af
SHA1 52b5b054ff6e7325c3087822901ea2f2c4f9572a
SHA512 864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a
SSDEEP 1536:LP43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:LwU609VMH0T/t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SelfDel.dll

IMPHASH 7b20d7ddf67d32ef46980776247198a1
SHA256 7cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9
MD5 5e14f6774c43bdff6ffe0afb0d51c47f
SHA1 fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27
SHA512 6ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

14255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/time.dll

IMPHASH 2e3a4d1f132aea64d421c1e936bcc407
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d2ecf4ae19990601e56e92329b3b95a2_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Math.dll

kernel32

generic

$PLUGINSDIR/SelfDel.dll

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/time.dll

kernel32

user32

generic