e9912575612e446d76b299d39acd3c8f_JaffaCakes118
- SHA256 c3bd3dae120bc0c003a84ad1e7923676d39560729a5c760d30a3c1439992acfc
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
uxacd.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
uxacd.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target e9912575612e446d76b299d39acd3c8f_JaffaCakes118
- Size 244KB
- Sample240918-vd7eeasajg
- SHA256 c3bd3dae120bc0c003a84ad1e7923676d39560729a5c760d30a3c1439992acfc
- MD5 e9912575612e446d76b299d39acd3c8f
- SHA1 9ea6757010040dd6d202159c3947467e2235770c
- SHA512 def67120dd7ee9af72f5d15f5a382e62c56ed476ace37469d94351e5cee1cba463beae66c8c330d5e433d95466e9305d3587c90241e9a0717ab14654000f9017
- SSDEEP 6144:OM5Hvpr2M5Gpq8Bkzqs598lD8lmCo0+WbFn14L6bqdTiXXS0HX5JCb:7J8M5Gpq8BkzRvEDKpoaN123+735JW
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe unpack002/$PLUGINSDIR/System.dll unpack002/uxacd.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe nsis_installer_1 static1/unpack001/NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe nsis_installer_2
File Explorer
-
e9912575612e446d76b299d39acd3c8f_JaffaCakes118.zip 244KB
-
NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe.exe 387KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
uxacd.dll.dll 11KB
-
vunvhvrgf.po161KB
NEW ORDER - VOLVO HK HKPO2102-13561,pdf.exe
- IMPHASH ced282d9b261d1462772017fe2f6972b
- SHA256 67bf85e54212cc6dd8e3f3bdfe292d7440ae7f7ad5f131f9c8b5ea51a86c1e96
- MD5 a9b1aca1a6619fcc416ad9d7bc475d9b
- SHA1 5228f4e1ff236c973003bf0d5ceaec0d0ad5d826
- SHA512 9f9c28025bf0748f135f619e4f4462de12887d62e1a9be69e28fb4b1d9cb1d6852eeff364b4ec9e92cd43785ed4584280e9297540ad40f1a4b60ea8bccb30965
- SSDEEP 6144:UqjIjtEJTIbSxwcBvBNBBdBBBBBBBNBBBBBBBBBBBBB5IFkzqs5Lalr8lmOo0+6T:B+EJkgBeFkzRpurKHomNl2F+Nl5JX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
13074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA
shell32
SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA
ole32
IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
GetSysColor
SetCursor
GetWindowLongA
SetClassLongA
SetWindowPos
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersion
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=160, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10529
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
636B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
uxacd.dll
- IMPHASH 1206f0b01570e2a6b0b68776ab6ece4c
- SHA256 0ded6f0baf2f7a0a4b865b548716916f1fe18ddc982fc45de882719959a5a8dc
- MD5 a60eed3804d3020a35819cdc825745c9
- SHA1 47bafe1c0690c870886835e53d036f00efd5ea98
- SHA512 7eb438928a2fb3ec7adb748729ca15d017324196874b1533e097b8f55ff94ffeef115b9f7561ee0332931deb9714f8a17b1ede596850cace6447f5ec11358e91
- SSDEEP 192:WwLR4E4WP7OCk1jDwQn12aPJivtdjEE2yKELXqqxnw8BYmv0G3v0:WYbBzOCk1jDt12iOSyKELRxnwslv0G3M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
rtutils
MprSetupProtocolFree
RouterLogEventA
crypt32
CertIsRDNAttrsInCertificateName
CertVerifySubjectCertificateContext
CertSaveStore
mscms
CreateColorTransformA
GetColorDirectoryA
UninstallColorProfileA
CreateColorTransformW
wsnmp32
ord105
ord200
ord502
pdh
PdhVbGetDoubleCounterValue
PdhVbOpenQuery
PdhGetDefaultPerfObjectA
Gxkeoxkzs
Name
.text
Size
1024B
Virtual Size
656B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
714B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
86B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=15, id=1, productName=Unmarked objects,
count=11, id=185, version=30716,
count=1, id=206, productName=VS2012 build 50727, version=50727,
count=1, id=202, productName=VS2012 build 50727, version=50727,
count=1, id=201, productName=VS2012 build 50727, version=50727,
count=1, id=204, productName=VS2012 build 50727, version=50727,
vunvhvrgf.po
- SHA256 b006a3f1fe3e1f5a1918fb1ceba108ac0fd0ee6a552c420dcaf9288564b862e2
- MD5 86afd3933bb5a535d6b5029c2a70a818
- SHA1 4099d3a4531c862fefc2665f04e4fe857a78f970
- SHA512 f661237a8512389ead3f4e3b3588e3165f2847cc78f7aed0a3fcf375f804a3918b53f2358e78cf18cd7bc49d6d16239c2c22f981714529c5bf71fa986cf4b279
- SSDEEP 3072:lkzBVo2UsjVLin9ebLerQ1uUFEOaP0+coyoQFn519PMpL6d9EU8VRimyFFvZMFEd:lkzqs5Lalr8lmOo0+6bFnl4L6d21Tipn
- MD5 SHA1 SHA512 SSDEEP