JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd
Size 1.3MB
Sample250910-ypfydaap4x
SHA256 2eb0bae173c8d79bc9180db259f08700ace9992e23c8560c89d28e0080c4bcba
MD5 2c5b777d32eb0ab76804e42db1318dbd
SHA1 f753f0e94ca4eaf10560285b67f44b23ae909dee
SHA512 ce21df1d4b5ea30ed9a66a3b25d87589c8642650f3bef116d563251a848964a2e5ebe249525311ed609ac285f29d51321eec9572b025d9fbf4e8e2fdb6631ff6
SSDEEP 24576:0yltNAMKAv9qTXUTh39YSLgAvS7rJhM09qUsj3QHnjgiRjf0bg1tDvhTe0E/dJZl:0G+E93S667NhM5gRRjf/1llElJZAIZg4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd
unpack001/$1/1337/NetFramework.exe
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd

.exe 1.3MB
$1/1337/NetFramework.exe

.exe 1.3MB
$1/1337/NetFrameworkUpdate.bat

171B
$PLUGINSDIR/System.dll

.dll 11KB

JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 2eb0bae173c8d79bc9180db259f08700ace9992e23c8560c89d28e0080c4bcba
MD5 2c5b777d32eb0ab76804e42db1318dbd
SHA1 f753f0e94ca4eaf10560285b67f44b23ae909dee
SHA512 ce21df1d4b5ea30ed9a66a3b25d87589c8642650f3bef116d563251a848964a2e5ebe249525311ed609ac285f29d51321eec9572b025d9fbf4e8e2fdb6631ff6
SSDEEP 24576:0yltNAMKAv9qTXUTh39YSLgAvS7rJhM09qUsj3QHnjgiRjf0bg1tDvhTe0E/dJZl:0G+E93S667NhM5gRRjf/1llElJZAIZg4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$1/1337/NetFramework.exe

IMPHASH baa93d47220682c04d92f7797d9224ce
SHA256 0cc41dcf71bae5911647af1d05b61c118f4acb6d3aec8113a311c02c3ddf1082
MD5 6c986a80c8bbb19a08ead0758f23ccf7
SHA1 10b3fd235f0b55db3cb6f8c77c2fc846c24f8c4c
SHA512 29d0a01a194c10e423df0f53cdcf2273d9b22d2ffeb1d553efc1e8587d86666175d4ebee1310c711757e2fab554850def9944809c9e5d932f059492efd70df08
SSDEEP 24576:E/HBQ5M9JOfpZ3eNS/mLB/+WXCbpYc3/Ze781ZlJb8vAS5utIQrvi:E/Bd6Z3PcG04pjV1jJLS5uZrv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

3678208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

40KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ziogrzry

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mamgfmjw

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$1/1337/NetFramework.exe

kernel32

comctl32

generic

$1/1337/NetFrameworkUpdate.bat

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic