jaffacakes118_01198_FMCG02102024[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_01198_FMCG02102024.rar
Size 974KB
Sample260916-wddyjatcnd
SHA256 346fce8f372c76bc8218015e3fad4e39f5b4777b901ab8f7c25a89f367253b60
MD5 9bb511b1e0e23b5566284141c24c4c46
SHA1 e3980c4d47f8abd65467b18c4417aa7e4843160e
SHA512 0e696119ef1a95f85d366c517bad39f130f1e6d7c0f66dcb5883702e99b2475f5c7a07583db66fc8df5fd717d449307b3e48937e307f4daf1270ed4b78cd5f5b
SSDEEP 24576:tXk0FilGDo54iIdXQMFdSbEw9graY3FE3VmYpRDMowtIEU:tXFS6aUibHWVWv3RMU
TLSH
T11A2533AF5A7900C11B8B1D4FEE260648E3CF148B9F2772E69C7B50550C09AE17DA6FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/01198_FMCG02102024.exe	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/01198_FMCG02102024.exe

File Explorer

jaffacakes118_01198_FMCG02102024.rar

.rar 974KB
01198_FMCG02102024.exe

.exe 1.3MB

jaffacakes118_01198_FMCG02102024.rar

SHA256 346fce8f372c76bc8218015e3fad4e39f5b4777b901ab8f7c25a89f367253b60
MD5 9bb511b1e0e23b5566284141c24c4c46
SHA1 e3980c4d47f8abd65467b18c4417aa7e4843160e
SHA512 0e696119ef1a95f85d366c517bad39f130f1e6d7c0f66dcb5883702e99b2475f5c7a07583db66fc8df5fd717d449307b3e48937e307f4daf1270ed4b78cd5f5b
SSDEEP 24576:tXk0FilGDo54iIdXQMFdSbEw9graY3FE3VmYpRDMowtIEU:tXFS6aUibHWVWv3RMU
TLSH
T11A2533AF5A7900C11B8B1D4FEE260648E3CF148B9F2772E69C7B50550C09AE17DA6FA1
MD5 SHA1 SHA512 SSDEEP TLSH

01198_FMCG02102024.exe

IMPHASH 870b8e75c7190e202e9c6c81dff1040c
SHA256 ace6b3e775206b5e6a6b7e10c7b93fdfcd670100cbe952bd6beb9b9de02249f2
MD5 0a82a315dfb9180f6b14c4d6771d0c7e
SHA1 87babc11d74b0dcdfd42f756e535bcfa7cf17f3d
SHA512 fb11eb9a6c680bbdb41e52cd3aa03538aae633686024141c4591ca368294b760e3c8bfc4490865784a12fbb731f335a4355ed66c022290d5b17602fdddc2175b
SSDEEP 24576:ffmMv6Ckr7Mny5QLi1eljrk6O7ZYFMRzPkpjf9Y:f3v+7/5QLielj6CFMID9Y
TLSH
T14655F112B3D680B6DDA339711A7BE31BDB3575194323C48BA7E02E779F211409B3A762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet setsockopt ntohs recvfrom sendto htons select listen WSAStartup bind closesocket connect socket send WSACleanup ioctlsocket accept WSAGetLastError inet_addr gethostbyname gethostname recv

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

mpr

WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W WNetUseConnectionW

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetConnectW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetQueryOptionW InternetQueryDataAvailable

psapi

EnumProcesses GetModuleBaseNameW GetProcessMemoryInfo EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW

kernel32

HeapAlloc Sleep GetCurrentThreadId RaiseException MulDiv GetVersionExW GetSystemInfo MultiByteToWideChar WideCharToMultiByte GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW lstrcmpiW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource GetProcessHeap OutputDebugStringW GetLocalTime CompareStringW CompareStringA InterlockedIncrement InterlockedDecrement DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle CreatePipe InterlockedExchange TerminateThread GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW DeviceIoControl SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetComputerNameW GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcessId GetCurrentThread GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc LoadLibraryExW HeapFree WaitForSingleObject CreateThread DuplicateHandle GetLastError CloseHandle GetCurrentProcess GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameW GetFullPathNameW ExitProcess ExitThread GetSystemTimeAsFileTime SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW ResumeThread GetStartupInfoW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameA HeapReAlloc HeapCreate SetHandleCount GetFileType GetStartupInfoA SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW LCMapStringA RtlUnwind SetFilePointer GetTimeZoneInformation GetTimeFormatA GetDateFormatA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetTickCount GetStringTypeA GetStringTypeW GetLocaleInfoA GetModuleHandleA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile EnumResourceNamesW SetEnvironmentVariableA

user32

SetWindowPos GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW ReleaseCapture SetCapture WindowFromPoint CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem CopyImage GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW PeekMessageW SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity GetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW MessageBoxW DefWindowProcW MoveWindow AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate DispatchMessageW GetMenuItemID TranslateMessage SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon UnregisterHotKey CharLowerBuffW MonitorFromRect keybd_event LoadImageW GetWindowLongW

gdi32

DeleteObject GetObjectW GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits LineTo AngleArc MoveToEx Ellipse PolyDraw BeginPath Rectangle GetDeviceCaps SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC SetViewportOrgEx

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW RegEnumKeyExW CloseServiceHandle UnlockServiceDatabase LockServiceDatabase OpenSCManagerW InitiateSystemShutdownExW AdjustTokenPrivileges RegCloseKey RegQueryValueExW RegOpenKeyExW OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW InitializeSecurityDescriptor InitializeAcl GetLengthSid SetSecurityDescriptorDacl CopySid LogonUserW GetTokenInformation GetAclInformation GetAce AddAce GetSecurityDescriptorDacl

shell32

DragQueryPoint ShellExecuteExW SHGetFolderPathW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree CLSIDFromString StringFromCLSID IIDFromString StringFromIID OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket OleUninitialize

oleaut32

SafeArrayAllocData SafeArrayAllocDescriptorEx SysAllocString OleLoadPicture SafeArrayGetVartype SafeArrayDestroyData SafeArrayAccessData VarR8FromDec VariantTimeToSystemTime VariantClear VariantCopy VariantInit SafeArrayDestroyDescriptor LoadRegTypeLi GetActiveObject SafeArrayUnaccessData