jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]4c73b756dbb708b8f2d8ff7c144d77d8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8
Size 437KB
Sample261014-dcppjaex3w
SHA256 b027fdc658589d3f193d2a0896fd9c9c064a1f62ddeef9a90479b93c2cd8ecb9
MD5 4c73b756dbb708b8f2d8ff7c144d77d8
SHA1 482158aff860750b0250f2b9835cea797d417985
SHA512 acf7d39dd13cd6570b1e7a1ec46e96707b7607fff82caef17ed30ca149db4c8a8eea953a6054fc4534fd9ba6caf7f95aa2e1d10e24f90415fa9fc5bf7d0ba7d8
SSDEEP 12288:m1v2GaczrO+SxFvxKtqabcjhnNZH8k0uWIv:mgGDvOpjAQabcFH8k05Iv
TLSH
T1B594234950B51DFFD8CE0634447BBA3CD6F6DBA821DD6B834B286F797AF40468D24A01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8
unpack001/$PLUGINSDIR/System.dll
unpack001/$SYSDIR/$_1_.exe
unpack002/$PLUGINSDIR/System.dll
unpack001/$_5_

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$SYSDIR/$_1_.exe	nsis_installer_1
static1/unpack001/$SYSDIR/$_1_.exe	nsis_installer_2

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8

.exe 437KB
$PLUGINSDIR/System.dll

.dll 11KB
$SYSDIR/$_1_.exe

.exe 40KB
$PLUGINSDIR/System.dll

.dll 11KB
$_5_

.dll 731KB

jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 b027fdc658589d3f193d2a0896fd9c9c064a1f62ddeef9a90479b93c2cd8ecb9
MD5 4c73b756dbb708b8f2d8ff7c144d77d8
SHA1 482158aff860750b0250f2b9835cea797d417985
SHA512 acf7d39dd13cd6570b1e7a1ec46e96707b7607fff82caef17ed30ca149db4c8a8eea953a6054fc4534fd9ba6caf7f95aa2e1d10e24f90415fa9fc5bf7d0ba7d8
SSDEEP 12288:m1v2GaczrO+SxFvxKtqabcjhnNZH8k0uWIv:mgGDvOpjAQabcFH8k05Iv
TLSH
T1B594234950B51DFFD8CE0634447BBA3CD6F6DBA821DD6B834B286F797AF40468D24A01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/$_1_.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 22baf1c02ef343b1c018acb3dfa805fa08ddc87f8a7c78596b497e5ec08c134a
MD5 ab142fb749e826146382097ff4380cab
SHA1 940404539991c6e90dd6fe55697af31517a12999
SHA512 414ecd9b2579ddceddf6304d024f66ca9670317a161b355ce5199dcefffd043382d915cc2bf0e4156d39d661875d0a9c25e26438c8ffbd4f623811110d6996d0
SSDEEP 768:kHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ5JRnm55pfRxB0a:kpgpHzb9dZVX9fHMvG0D3XJM55lf2a
TLSH
T18B03BF0765C089BBD5D2067106B7B77DEBFAC3DD01911B574BA82FBB3E111838909296
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_5_

IMPHASH 69bd76baaa94216c08ef26606752de71
SHA256 0c7f38a9380b65dd2f6cd641be934906736064369657d419d6edc96d7c79295e
MD5 2f0ccc90307825591e493db45c8be8d3
SHA1 e895134e57545a8b959d1102d716922112d9ed2a
SHA512 0528a0c00a17b6e51885aad8c739b10df0275a5c4f0f54d2f8b1522381a05a4e47d9795cbdf51d6146627b5e8d5362b80306bf623b7edcf85db58ca0cb4be777
SSDEEP 12288:uPjVuvC7NEeEMOysYIJeRE3dn2m52+uGk2DgZjTV571c3Z8Fj0vH:u8ahtbOyXRENnZ2+TkIgRuZ8FCH
TLSH
T1EFF48D1931D0D4F5C76005791D08E33A973E9C724BFA006ABBE953A82BE688057DEDB7
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

59037

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress lstrcpynA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetLastError HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetModuleHandleA SetStdHandle WriteConsoleA

advapi32

CryptCreateHash CryptReleaseContext CryptDestroyHash CryptGetHashParam CryptAcquireContextW CryptHashData

oleaut32

VariantClear VariantInit SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString

jaffacakes118_HEUR.Trojan.Win32.Generic.4c73b756dbb708b8f2d8ff7c144d77d8

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$SYSDIR/$_1_.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$_5_

kernel32

advapi32

oleaut32

generic