jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]22e2e9fdc83d20810828831d5b14e452

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.22e2e9fdc83d20810828831d5b14e452
Size 740KB
Sample261014-aewdbady7l
SHA256 8e370217d3730cfe26ef2f0e56f517900fe847d7e3f4bfd9b0a7ea5f1dfd77b1
MD5 22e2e9fdc83d20810828831d5b14e452
SHA1 94fe583759b386ebb50639ade91e333a900241ba
SHA512 1b07a8e8f343b03ef623af4892651fca0dc3e27a4a1c5986f7dc7aa96efc6fe7f5cf628f2435a3b333bb8ed506f9fde7afcd190ebe3b175758fc20ffc3bc810b
SSDEEP 12288:5TGelbyJq69WRYD4kwltqOJ74QWq3nVn25pSh2gZ/kNUCprdzSZ:Yelbhdk4lcO94KuNUCRhSZ
TLSH
T105F423EB87A1A6EBE1025470376A4FB72331ED3027196007A7353DEFB9165CC6962327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.22e2e9fdc83d20810828831d5b14e452
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/WebMediaPlayer.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.22e2e9fdc83d20810828831d5b14e452

.exe 740KB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-header.bmp

9KB
$PLUGINSDIR/modern-wizard.bmp

51KB
WebMediaPlayer.exe

.exe 622KB

jaffacakes118_HEUR.Trojan.Win32.Generic.22e2e9fdc83d20810828831d5b14e452

IMPHASH 7ccfa9ee03e8c33359f63fc6f53b93b0
SHA256 8e370217d3730cfe26ef2f0e56f517900fe847d7e3f4bfd9b0a7ea5f1dfd77b1
MD5 22e2e9fdc83d20810828831d5b14e452
SHA1 94fe583759b386ebb50639ade91e333a900241ba
SHA512 1b07a8e8f343b03ef623af4892651fca0dc3e27a4a1c5986f7dc7aa96efc6fe7f5cf628f2435a3b333bb8ed506f9fde7afcd190ebe3b175758fc20ffc3bc810b
SSDEEP 12288:5TGelbyJq69WRYD4kwltqOJ74QWq3nVn25pSh2gZ/kNUCprdzSZ:Yelbhdk4lcO94KuNUCRhSZ
TLSH
T105F423EB87A1A6EBE1025470376A4FB72331ED3027196007A7353DEFB9165CC6962327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

13385

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize MapViewOfFile OpenFileMappingA GetCurrentProcessId GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock SearchPathA CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion lstrcpyA CreateProcessW lstrcatW lstrcpyW lstrlenW GetVersionExA CreateFileW GetSystemDirectoryW ReleaseMutex GlobalFindAtomA CreateMutexA UnmapViewOfFile CreateFileMappingA GetModuleFileNameW GlobalAddAtomA GlobalDeleteAtom SetLastError WideCharToMultiByte FindFirstFileW TerminateThread GetExitCodeThread CompareFileTime SetFileTime CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CreateThread MulDiv

user32

SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA CloseClipboard CharLowerA CharLowerW FindWindowA SetCursor GetWindowLongA GetSysColor SetWindowPos IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem GetWindowRect IsWindowVisible CallWindowProcA LoadBitmapA GetMessagePos CheckDlgButton PeekMessageA LoadCursorA ScreenToClient EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA EndPaint DrawTextA FillRect GetClientRect BeginPaint DefWindowProcA SendMessageA InvalidateRect EnableWindow GetDC LoadImageA SetWindowLongA GetDlgItem IsWindow FindWindowExA CharNextA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegDeleteKeyA RegOpenKeyExA RegQueryValueExW RegOpenKeyExW RegEnumKeyA RegQueryValueExA RegSetValueExA RegEnumValueA RegCreateKeyExA RegDeleteValueA RegCloseKey

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoInitializeEx CoSetProxyBlanket CoUninitialize CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance CoInitializeSecurity

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

wininet

HttpQueryInfoA InternetReadFile DeleteUrlCacheEntry InternetOpenA InternetOpenUrlA InternetCloseHandle

msvcrt

memcpy memset free rand srand time strncmp malloc strchr strncat realloc _except_handler3 strstr

oleaut32

VariantClear

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2
MD5 32aa6334fc543e70ef0f792bb9a0c45a
SHA1 54be1f5004f7e5afe7c9ba160495076ea2a4d60c
SHA512 ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae
SSDEEP 192:V6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTwK72dwF7dBdcQOz:V6JaVh4I5rpPbTw+BdhO
TLSH
T1E5523951378888F3E792053EB45237079F9D5226B8929ED1CA331FC62D2B19E2FB1302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 946eb0a1e85c9ade4acaf634eb5a64f1
SHA256 1a56dfe0bdae779b40d11b9caee5c96e81b9d69b0d45be7c7b11717e1db8c5a5
MD5 51e7fd0885b7d7bf6edc030e17145950
SHA1 be7a62d254f897789cde5b9a77a8b3b0add6d141
SHA512 a57c57a3d01839df10ab669bead1d757ef85e4a35cac65a3a147c5e1adaccaae52bb355ed8d4d460a6698cbda3ee8fba395875739670c8cf57884f66306d011a
SSDEEP 48:SnJQ/z+vUML8eYXICmlmGYKHz0JSpXSxwo6mpwzcR3RqG8aEJ4ABofgMGKO:Vz+MM4eqmvz0JScx56mpwzAhWIGV
TLSH
T1CAB160B2F38045B5D5A44977146BA7D33763DD302B9A021F9B67051B7810D93AC7DB83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5545

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WebMediaPlayer.exe

SHA256 c7ca4e6e48f0bebfbf3fea6dceaaae57314ad16a21a034a242ffa7c300990570
MD5 1dde270de4d855d2d3910bb63168bb47
SHA1 351158743cd8a1122256c199cdcef53ce3b4dcf5
SHA512 977461415e3f7578263fd0bed927751986f32e008927f39c2125640259a52a780ffd1bd6e4b8873b724f568aee561fe3a828ce5bff00086fec56c576722b98e0
SSDEEP 12288:LTZ3tLc8eilLdW+B3ByqdTcf/zG4878iis1vUgQHrQS/3MHcwj5E:LlfBG+B3BBdTc3q4U8iXgLQQc83
TLSH
T19FD42394CBB66539E1823872488058D31D4632F3B8E38BBEB478DDD94E87D538B74B46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

jaffacakes118_HEUR.Trojan.Win32.Generic.22e2e9fdc83d20810828831d5b14e452

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

wininet

msvcrt

oleaut32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

WebMediaPlayer.exe

generic