JaffaCakes118_4e94655c7c0870f82b0c339638abc3e0
- SHA256 215996b99ee60717a892b741501bcde2420f961b3c17dbc67bfc8bc003a61138
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
order list.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
order list.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/bpibxkjlns.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/bpibxkjlns.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target JaffaCakes118_4e94655c7c0870f82b0c339638abc3e0
- Size 329KB
- Sample250101-knbqdaspgn
- SHA256 215996b99ee60717a892b741501bcde2420f961b3c17dbc67bfc8bc003a61138
- MD5 4e94655c7c0870f82b0c339638abc3e0
- SHA1 cf56cf4de4820b4bd89c70f8174a7b3e972ab91a
- SHA512 4f1cb37d4d9179606a99c4fe059aa71fce5ca1fb9e80f005a58dc49470ca1f841dd90a2e53a10affcfb633f83dd39b8982ef4a3d52f62a255d77272fc02979ea
- SSDEEP 6144:+0KU5GpM8F/cPshw/pw74VRiTouojB/zJa6EjFtz0s/3:+0KU5qM8NcPsO/pA4pusIFtzN/3
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/order list.com unpack003/$PLUGINSDIR/bpibxkjlns.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack002/order list.com nsis_installer_1 static1/unpack002/order list.com nsis_installer_2
File Explorer
-
JaffaCakes118_4e94655c7c0870f82b0c339638abc3e0.eml 329KB
-
RFQ.rar.rar 240KB
-
order list.com.exe 252KB
-
$PLUGINSDIR/bpibxkjlns.dll.dll 31KB
-
f6z7rqmyz32cfbh7bz4213KB
-
email-plain-1.txt12B
RFQ.rar
- SHA256 fae321473a66cacb6fad2c491a5ea25cdce7c85dd9ec63a56281b39606e7df99
- MD5 035dd5a6b1599414f8fa33a258d4b07f
- SHA1 93472b7a51e31992f95408eff014171d478866f3
- SHA512 2caf92ef5874b56d4bc95e28650ac7c464d70b24ba74ba34cba52210f0cfd351b146215c19fb999d7bfddaa91a451c4e8405cbe40c2de1a29fcd16e5a7cde5d1
- SSDEEP 6144:HYR2/OPYAVx+xyymPHvoJIEoLeZzy4vsHU9GNBFB:Q2/OP+x232Ix+y4vR9GNBb
- MD5 SHA1 SHA512 SSDEEP
order list.com
- IMPHASH b76363e9cb88bf9390860da8e50999d2
- SHA256 1f7edeff96ea1955ea6642e4d739f6a98cb1315d9f78fe23ae3419fb24878103
- MD5 8e07e5bfcdfb06fe00332798af731c1b
- SHA1 f937ba7129daff91a011aaa5ce767db5763c359c
- SHA512 c2ec48656985a8190f10305fc8d11162453457322fceb11c95cd87e0a18099697e3d815db42e0f82166edcf02170c2bf85b4c034d1daeeb285a8466ddaef9318
- SSDEEP 6144:wBlL/cdXKcGiepdi1NxLY4kMa/ETi3d09+cy5x7Yq:CedzkEr0x/ETYsjyX8q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12539
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
SetFileAttributesA
CompareFileTime
SearchPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
GetTempPathA
Sleep
lstrcmpiA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
SetFileTime
CloseHandle
GlobalFree
lstrcmpA
ExpandEnvironmentStringsA
GetExitCodeProcess
GlobalAlloc
lstrlenA
GetCommandLineA
GetProcAddress
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
ReadFile
FindClose
GetPrivateProfileStringA
WritePrivateProfileStringA
WriteFile
MulDiv
MultiByteToWideChar
LoadLibraryExA
GetModuleHandleA
FreeLibrary
user32
SetCursor
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
EndDialog
ScreenToClient
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetForegroundWindow
GetWindowLongA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
SetTimer
PostQuitMessage
SetWindowLongA
SendMessageTimeoutA
LoadImageA
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
CreateDialogParamA
DestroyWindow
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
ShellExecuteA
advapi32
RegDeleteValueA
SetFileSecurityA
RegOpenKeyExA
RegDeleteKeyA
RegEnumValueA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=152, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/bpibxkjlns.dll
- IMPHASH 94b0e8d046f44dd0f56d278d421e43fa
- SHA256 de5e7a9b204e8cdeaf9c002a81732d8487c4547c0c98d353cab896f92b8c851d
- MD5 baf456a0f50b4a00dd3a624bb46b5950
- SHA1 1d896ed35f724cd6e5168ebc7e5e670f85eb36f9
- SHA512 e883bfaed10a560ac83b8466e524032148873b3c70411da25124db486863413749cec9e5b80cf593a2f81bca23b139172d8c8e49eb0a2b744b497c5f3a3b13ae
- SSDEEP 768:BODooxdJWQvv5RaMcJEJ8f88dHamWlYQodqFuO0oRy:BOFJWK5fIaZlYbil0Cy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
22803
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
imm32
ImmGetDescriptionA
ImmGetGuideLineW
ImmLockIMCC
ImmSetCompositionFontW
ImmSetConversionStatus
kernel32
CreateThread
DeleteCriticalSection
EnterCriticalSection
FindAtomW
FindResourceA
GetLastError
GetProcessHeap
GetTempFileNameW
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryExW
ReadConsoleOutputA
ReadFileEx
SetConsoleCP
SetLocaleInfoW
lstrcatW
lstrcmpW
lstrlenW
gdi32
CreateMetaFileA
FloodFill
GetCharABCWidthsFloatA
GetEnhMetaFilePixelFormat
SelectObject
SetBitmapDimensionEx
user32
CreateDialogParamW
PeekMessageA
wsprintfW
mscms
AssociateColorProfileWithDeviceW
CloseColorProfile
DisassociateColorProfileFromDeviceW
GetPS2ColorRenderingDictionary
RegisterCMMW
SpoolerCopyFileEvent
UnregisterCMMW
msacm32
acmDriverDetailsW
acmDriverRemove
acmFilterDetailsA
acmFormatChooseW
acmMetrics
acmStreamConvert
acmStreamSize
acmStreamUnprepareHeader
msi
ord55
ord99
loadperf
LoadPerfCounterTextStringsA
UnloadPerfCounterTextStringsA
UnloadPerfCounterTextStringsW
winspool.drv
DocumentPropertiesA
EnumPrinterDataW
SeekPrinter
SetJobW
advapi32
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegEnumValueW
RegGetValueW
RegNotifyChangeKeyValue
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
ole32
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
StringFromGUID2
msvcrt
_adjust_fdiv
_initterm
free
malloc
memcpy
memset
wcstol
zaktltdnl
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
f6z7rqmyz32cfbh7bz4
- SHA256 f5b2f45a8de2e8116d2f932c1f7031bcce1329aa398427846d28f84956ead6fc
- MD5 efe3baeb81b30fb630be282b4cd54838
- SHA1 04bcd6a7383710fb3c05fe474f6ac348ca6e67d6
- SHA512 d8f66aa737d7352d8503ea383a6cf58ff5d88d33d7427d04f374ecdd8753a14dcfd27b396b4b2afdcbb22c0493b4f92e7fe4ba0668f0d0294c3d489f85e3c90d
- SSDEEP 6144:iG899k2GQEuCjyhHoxnmmNR/Q1V66x+nPl868Jk8q:u6mCWRgnjNR/wZY8veb
- MD5 SHA1 SHA512 SSDEEP
email-plain-1.txt
- SHA256 20bb424e7694faac24c799333cf830c8e008a2bd2ff15bce232093188be85298
- MD5 f85c73a8ac3fef4f7794e0c0464c6498
- SHA1 ae43eeefc337d003e80516c15f7ef2c3e4e15cd7
- SHA512 d997a86d42c9055ad56e2479c3396cab13853259d9bb73b867b83dceef020b5641f42415b9718734ca63395266916387126a00adf832d5770783007055d46d46
- MD5 SHA1 SHA512