JaffaCakes118_9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb
- SHA256 9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
INCENTIVE.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
INCENTIVE.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/wslelgm.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/wslelgm.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target JaffaCakes118_9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb
- Size 418KB
- Sample241230-bthlfatkfp
- SHA256 9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb
- MD5 2d04a5c36ef124c4ec550de866c27d8b
- SHA1 3446dff89dcb67133eea117b6f5fdce60a77a590
- SHA512 e63817ec810c6aad29fb92be043553d3b5a19f62536aaf74b947ea2f3cdf4bcbe885bb025ddecd9a411ea4034caf99d4e0500fab45d771a0cc8b5ab13c60f8f7
- SSDEEP 6144:syrGKXtASDELL51CbBtuuVTQEYMG7n90GGwhGmXnjYgI3FvNlnYIyeUEDnjv6DfJ:sCGAm0Yu7e9AmjYPvnQeU6nr6no8k6aK
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/INCENTIVE.exe unpack003/$PLUGINSDIR/wslelgm.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack002/INCENTIVE.exe nsis_installer_1 static1/unpack002/INCENTIVE.exe nsis_installer_2
File Explorer
-
JaffaCakes118_9d4bfc8d1d35b095e4989c7a6a9a5eae41521eb64c751f9f13cff76ec0bcf1eb.zip 418KB
-
f3c16a952c36b66fa047ec0c4175ee8cc13ead4f2d984b57beff9f15de4ef1d1.zip 418KB
-
INCENTIVE.exe.exe 435KB
-
$PLUGINSDIR/wslelgm.dll.dll 303KB
-
hs4btjm0hsg211KB
-
oritf4KB
f3c16a952c36b66fa047ec0c4175ee8cc13ead4f2d984b57beff9f15de4ef1d1
- SHA256 f3c16a952c36b66fa047ec0c4175ee8cc13ead4f2d984b57beff9f15de4ef1d1
- MD5 a596f793e852b667b21a9e834ea81897
- SHA1 7de984d199072bc505e3b7f23616256e4fc5df9a
- SHA512 1f0c2f40112cfbed46bdfd06d892198067bf3749ec99dfd5ab07b8e469e643e3016987301aba2bfb6f8415a03b310f7c4d9cf3949c18752c5d1ef62b06fc6d7c
- SSDEEP 12288:Mbl9sT1vlE8AkmpydrW0tu2qteXQu8NsCmQO/FlCpH:QPw7aAdNtu2qthlCFlCpH
- MD5 SHA1 SHA512 SSDEEP
INCENTIVE.exe
- IMPHASH 7fa974366048f9c551ef45714595665e
- SHA256 d30c25033a8cd080bc76463ad1ef591f61b66b5bf36aae6557d9664714908614
- MD5 a8dd9be8f05730b0b3da0aa0524d4041
- SHA1 585ce6f6c047ae07daf2754cdd9f011f8bb8343b
- SHA512 7a584d294a8702f03ee91f6047c08a9e1ed56742f1a1d19ff9a99778ea5b1270b44d67cf0450fd5e98b75df7d47208e6259efec3c486dfe39e1d5ccd62713dc1
- SSDEEP 12288:UbLr/1vBE8A8gJ+7rWMtE2bbOu8Nsw+Qw7n/C8c:UTNRWw77tE23Ol+n/C8c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12487
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=11, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/wslelgm.dll
- IMPHASH b03714b86b2deb48f099107779018faf
- SHA256 fcb8bd3b27beffa5255fbc8b485b038b321043eecd77fc21cf4798446c21a971
- MD5 7c38758347c69368b8bdff2f7a5ba99c
- SHA1 70c318991c2515844ecc96714f5ad777d2e7e6a7
- SHA512 5d04876c8b1dd9a2d691d832471ad650ac85b95503c02aacde848f3b4f6f9f99c861b5a5f8e3e401145e6bbd78f59b8dddc8f24207a52d57afa3efe8940ecdac
- SSDEEP 6144:w7avUpJXmVeuuxx2eiXm1C2kNWfHZKKzeXxNAYlkhAV4D:SpJ2Auu72eGEC2FvZK4UbdOhbD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
247197
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteProfileStringA
CreateRemoteThread
GetConsoleOutputCP
CreateFileW
ReadFile
GetTempPathW
VirtualProtect
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
OutputDebugStringW
GetStringTypeW
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryExW
GetModuleFileNameW
WriteFile
IsProcessorFeaturePresent
IsDebuggerPresent
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
GetCommandLineA
GetCurrentThreadId
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
CloseHandle
shell32
ExtractAssociatedIconW
SHGetFileInfoW
ShellAboutW
DoEnvironmentSubstA
SHAddToRecentDocs
DragQueryFile
rtm
RtmGetFirstRoute
RtmGetNetworkCount
MgmReleaseInterfaceOwnership
RtmGetRouteAge
RtmBlockConvertRoutesToStatic
odbc32
ord43
ord24
ord232
ord250
ord86
ord44
ord257
ord165
ord134
ord139
ord42
winspool.drv
AddJobW
ord205
SetPortW
DeletePortA
AddFormA
mscms
GetColorDirectoryA
DisassociateColorProfileFromDeviceA
GetPS2ColorRenderingIntent
SpoolerCopyFileEvent
ord1
CreateProfileFromLogColorSpaceA
IsColorProfileValid
EnumColorProfilesA
ctatfnv
emfvimkh
fddfgbk
gbsoipy
guxubrlhvy
nkhki
ntjty
orqipkspno
ovviln
wtobrtd
xejzgmz
zymaexlto
Name
.text
Size
277KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
504B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=24, id=225, productName=VS2013 build 21005, version=21005,
count=15, id=223, productName=VS2013 build 21005, version=21005,
count=101, id=224, productName=VS2013 build 21005, version=21005,
count=13, id=257, version=27412,
count=116, id=1, productName=Unmarked objects,
count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
hs4btjm0hsg
- SHA256 e88dfba1f49e97ebb2f419a36df0be59ffa122e6df0a2873f34f8dd2f83d10e6
- MD5 4b91a5f66b7c71afa47b3d098cb536b7
- SHA1 35345dff4683c4fefa7db13bf596edc49fc4503b
- SHA512 1b801cb92d4b8c3c598a8011420c00fe70e09fdf7ab96e68b1500dbf1bee177699f2e1b9b6ca5ead53f0910de0638df9d5f08b5dce7c53347d23cca546367430
- SSDEEP 3072:k9VyWlZFjBvbkS1f/acas+fO9Oj5RHTeGDfnSdpKzfeo0n++H2Vp9ZDXGcqu:kvyWLFNv4kfisKbRHTBnVeobVp9xXHqu
- MD5 SHA1 SHA512 SSDEEP
oritf
- SHA256 1919a141b1d285adf13e55ea1a95179536699fbf3496971543c66ffe01dbb07d
- MD5 6bea9bae369fd201ba0cedbe32724298
- SHA1 203329f2f4a29ed1646e18fc5a57a87c9380beb9
- SHA512 7bf83cfe2267bbc4e9e5b993ae6bae6c0aa2d2b30c2b66c661226349394362a463ebe1096112be5b72a065b5774f6f06b7a83b9c709597588680d434bf86a515
- SSDEEP 96:2u46VAjsdmkXtt/UDRROmRD+rwg6lUfj/PBtrm:TKodmk9tIROmRCrCUfj/Xi
- MD5 SHA1 SHA512 SSDEEP