JaffaCakes118_03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8
Size 483KB
Sample241230-e1nyksxrey
SHA256 03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8
MD5 4b4854047f9b2db6a29b864ee788fa84
SHA1 c4dca9fb4a542030f83315f662fefabd335e633e
SHA512 cdc05e23860043fc292f2702dd6a04755a5b9d8f38431ed04f918036e102bdfb733670a28d6c92b06b260b74b13e2a40fc627ccb11dd887b4c9a6be6b17d8f56
SSDEEP 12288:7wQsdh8Dke/334Ha2agAyqeXb4uJhY3RwZRJEnL2:70dh96334HauAlePE3MRJGL2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Payment Copy.exe
unpack002/$PLUGINSDIR/sydrnwxz.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/Payment Copy.exe	nsis_installer_1
static1/unpack001/Payment Copy.exe	nsis_installer_2

File Explorer

JaffaCakes118_03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8

.zip 483KB
Payment Copy.exe

.exe 556KB
$PLUGINSDIR/sydrnwxz.dll

.dll 138KB
oxnv2vx56kmic2z

211KB

JaffaCakes118_03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8

SHA256 03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8
MD5 4b4854047f9b2db6a29b864ee788fa84
SHA1 c4dca9fb4a542030f83315f662fefabd335e633e
SHA512 cdc05e23860043fc292f2702dd6a04755a5b9d8f38431ed04f918036e102bdfb733670a28d6c92b06b260b74b13e2a40fc627ccb11dd887b4c9a6be6b17d8f56
SSDEEP 12288:7wQsdh8Dke/334Ha2agAyqeXb4uJhY3RwZRJEnL2:70dh96334HauAlePE3MRJGL2
MD5 SHA1 SHA512 SSDEEP

Payment Copy.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 55d2e2a1b94feedfc083326d9096acec664eb4fa66a752650caa62cb9b6c9914
MD5 8084dc1e74d897de6ff79693f1def3bd
SHA1 4f1537c3f3eada685e439ccc11b7bcf1c1d67188
SHA512 e31c533c05d187028625f53aed3f50de22f704472e68725735876b79dec2a55251361ac2c3606d8796feeb9320f69a259a93222602c354d2e066248c0e4dbebf
SSDEEP 12288:qdz83kC/aIIAuyO0KEB0gKkuxzYjlwZRJCnhs:qdzVWsV2KEBriyjIRJA2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/sydrnwxz.dll

IMPHASH a37209bbbe1e3c18a72b0e27c426599f
SHA256 f2635ca10d2ad2503eefbbfd4673e9c8ad66f363d0117fc4fbd79554ca482f20
MD5 f50d919a09c776df2c4fa63e3dcd4526
SHA1 917c24b146a6a17ec1cfaebde50199256b4126da
SHA512 5b578e7197b7b584185ea83b91938d4b9f152703c6039f98c096423cf94111e2f7146789dea548a2f317d1abf623356d36b4e047ff1d37835572b84020c89bf2
SSDEEP 1536:ZacgjVPeGl4bEnfuObM4rzzeZ0oBdpXeIfVMwrc3sYcobUfs55dSKoyrxNURR:gN5a4SYintBZkrFxyR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

104973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

PathCreateFromUrlA PathUnquoteSpacesA StrFormatByteSizeA StrRChrA UrlCanonicalizeA

urlmon

CoInternetGetSecurityUrl FindMimeFromData RegisterFormatEnumerator SetSoftwareUpdateAdvertisementState URLOpenPullStreamA URLOpenStreamW

oleaut32

LoadRegTypeLi VarCyAdd VarCyFromR4 VarCyFromR8 VarDecFix VarDecFromCy VarUI1FromCy

mswsock

GetServiceA NPLoadNameSpaces WSARecvEx rresvport

wsock32

WSAAsyncGetProtoByNumber getpeername inet_addr recvfrom

rtm

RtmBlockDeleteRoutes RtmCreateEnumerationHandle RtmDeleteRoute RtmDeregisterClient RtmIsRoute RtmLookupIPDestination RtmRegisterClient

msi

ord20 ord34 ord64 ord76 ord108 ord125 ord166

winmm

midiStreamRestart mmioAdvance

rtutils

MprSetupProtocolEnum RouterLogDeregisterW

advapi32

CloseServiceHandle OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW StartServiceW

kernel32

CloseHandle CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesW GetFileTime GetFileType GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetPrivateProfileStringW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OutputDebugStringW QueryPerformanceCounter RtlUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile lstrcatW lstrcmpiW lstrcpyW lstrcpynW lstrlenW

_CM_Get_DevNode_Property_ExW@28 _CM_Get_Device_IDA@16 _CM_Get_Device_IDW@16 _CM_Get_Device_ID_Size@12 _SetupDiBuildClassInfoList@16 _SetupDiBuildClassInfoListExA@24 _SetupDiBuildClassInfoListExW@24 _SetupDiBuildDriverInfoList@12 _SetupDiCallClassInstaller@12 _SetupDiClassGuidsFromNameA@16 _SetupDiClassGuidsFromNameExA@24 _SetupDiClassGuidsFromNameExW@24 _SetupDiClassGuidsFromNameW@16 _SetupDiClassNameFromGuidA@16 _SetupDiClassNameFromGuidExA@24 _SetupDiClassNameFromGuidExW@24 _SetupDiClassNameFromGuidW@16 _SetupDiCreateDevRegKeyA@28 _SetupDiCreateDevRegKeyW@28 _SetupDiCreateDeviceInfoA@28 _SetupDiCreateDeviceInfoList@8 _SetupDiCreateDeviceInfoListExA@16 _SetupDiCreateDeviceInfoListExW@16 _SetupDiCreateDeviceInfoW@28 _SetupDiCreateDeviceInterfaceA@24 _SetupDiCreateDeviceInterfaceRegKeyA@24 _SetupDiCreateDeviceInterfaceRegKeyW@24 _SetupDiCreateDeviceInterfaceW@24 _SetupDiDeleteDevRegKey@20 _SetupDiDeleteDeviceInfo@8 _SetupDiDeleteDeviceInterfaceData@8 _SetupDiDeleteDeviceInterfaceRegKey@12 _SetupDiDestroyDeviceInfoList@4 _SetupDiEnumDeviceInfo@12 _SetupDiEnumDeviceInterfaces@20 _SetupDiEnumDriverInfoA@20 _SetupDiEnumDriverInfoW@20 _SetupDiGetActualSectionToInstallA@24 _SetupDiGetActualSectionToInstallExA@32 _SetupDiGetActualSectionToInstallExW@32 _SetupDiGetActualSectionToInstallW@24 _SetupDiGetClassDescriptionA@16 _SetupDiGetClassDescriptionExA@24 _SetupDiGetClassDescriptionExW@24 _SetupDiGetClassDescriptionW@16 _SetupDiGetClassDevsA@16 _SetupDiGetClassDevsExA@28 _SetupDiGetClassDevsExW@28 _SetupDiGetClassDevsW@16 _SetupDiGetDeviceInfoListDetailA@8 _SetupDiGetDeviceInfoListDetailW@8 _SetupDiGetDeviceInstallParamsA@12 _SetupDiGetDeviceInstallParamsW@12 _SetupDiGetDeviceInstanceIdA@20 _SetupDiGetDeviceInstanceIdW@20 _SetupDiGetDeviceInterfaceDetailA@24 _SetupDiGetDeviceInterfaceDetailW@24 _SetupDiGetDevicePropertyW@32 _SetupDiGetDeviceRegistryPropertyA@28 _SetupDiGetDeviceRegistryPropertyW@28 _SetupDiGetDriverInfoDetailA@24 _SetupDiGetDriverInfoDetailW@24 _SetupDiGetINFClassA@20 _SetupDiGetINFClassW@20 _SetupDiGetSelectedDriverA@12 _SetupDiGetSelectedDriverW@12 _SetupDiInstallClassA@16 _SetupDiInstallClassW@16 _SetupDiInstallDevice@8 _SetupDiInstallDeviceInterfaces@8 _SetupDiInstallDriverFiles@8 _SetupDiOpenClassRegKey@8 _SetupDiOpenClassRegKeyExA@20 _SetupDiOpenClassRegKeyExW@20 _SetupDiOpenDevRegKey@24 _SetupDiOpenDeviceInfoA@20 _SetupDiOpenDeviceInfoW@20 _SetupDiOpenDeviceInterfaceA@16 _SetupDiOpenDeviceInterfaceRegKey@16 _SetupDiOpenDeviceInterfaceW@16 _SetupDiRegisterCoDeviceInstallers@8 _SetupDiRegisterDeviceInfo@24 _SetupDiRemoveDevice@8 _SetupDiRemoveDeviceInterface@8 _SetupDiSelectBestCompatDrv@8 _SetupDiSetClassInstallParamsA@16 _SetupDiSetClassInstallParamsW@16 _SetupDiSetDeviceInstallParamsA@12 _SetupDiSetDeviceInstallParamsW@12 _SetupDiSetDeviceRegistryPropertyA@20 _SetupDiSetDeviceRegistryPropertyW@20 ohlhjvrr

JaffaCakes118_03d6fa79b7d5bbe9e643da58bb6319f2f2532c7ae616d79d1701ad0e5dc232f8

Payment Copy.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/sydrnwxz.dll

shlwapi

urlmon

oleaut32

mswsock

wsock32

rtm

msi

winmm

rtutils

advapi32

kernel32

generic

oxnv2vx56kmic2z