jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]Somato[.]r[.]926a992db7e6503c933e9b8f75b4daec

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.926a992db7e6503c933e9b8f75b4daec
Size 420KB
Sample261014-ejnlgsfy6m
SHA256 0c11a163aa50f0e7813c80fc8848db96a6f416a50922c7ca3e55b66b1fb3b9e7
MD5 926a992db7e6503c933e9b8f75b4daec
SHA1 aa9c60d4cbb2f8c8ac7dc8b4b154234c80678601
SHA512 2223c3b2e05a0881c504b5999ef8bc451ad74d9450137a56fa981610e9246c6b69b87edd9f51fccd86e2503c5621d16ae2586ef90cbcdf0b0d7d6300aaf64fa9
SSDEEP 6144:2sxFk9cvBdVJ/QOul+SOl6FfLRGrMYtu6cFIzvasGveY7Cx+ra+2OAzefb:bF97T/QTjVhLbH3FIzv+ugO+DA4b
TLSH
T1FF941267B6C7C40BF61B19B0C0624EF2D7BAAF2BC155B4D7AB343E59BA302904207053
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/7za.exe
unpack001/$PLUGINSDIR/[RANDOM_STRING].7z
unpack001/$PLUGINSDIR/nsExec.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.926a992db7e6503c933e9b8f75b4daec

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.926a992db7e6503c933e9b8f75b4daec

.exe 420KB
$PLUGINSDIR/7za.exe

.exe 574KB
$PLUGINSDIR/[RANDOM_STRING].7z

.exe 225KB
$PLUGINSDIR/nsExec.dll

.dll 6KB

jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.926a992db7e6503c933e9b8f75b4daec

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 0c11a163aa50f0e7813c80fc8848db96a6f416a50922c7ca3e55b66b1fb3b9e7
MD5 926a992db7e6503c933e9b8f75b4daec
SHA1 aa9c60d4cbb2f8c8ac7dc8b4b154234c80678601
SHA512 2223c3b2e05a0881c504b5999ef8bc451ad74d9450137a56fa981610e9246c6b69b87edd9f51fccd86e2503c5621d16ae2586ef90cbcdf0b0d7d6300aaf64fa9
SSDEEP 6144:2sxFk9cvBdVJ/QOul+SOl6FfLRGrMYtu6cFIzvasGveY7Cx+ra+2OAzefb:bF97T/QTjVhLbH3FIzv+ugO+DA4b
TLSH
T1FF941267B6C7C40BF61B19B0C0624EF2D7BAAF2BC155B4D7AB343E59BA302904207053
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

e6:f6:18:f0:46:c2:77:e7:3d:82:26:bb:07:dc:ed:13:b9:34:68:54

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Somoto Ltd,O=Somoto Ltd,L=Tel Aviv,ST=Israel,C=IL

Chains

Oct 7, 2026

CN=Somoto Ltd,O=Somoto Ltd,L=Tel Aviv,ST=Israel,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

CN=Somoto Ltd,O=Somoto Ltd,L=Tel Aviv,ST=Israel,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/7za.exe

IMPHASH 15847eb10d7d06dcd5980e8a9b786fd6
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
TLSH
T15FC47C2A3AE5C079D65215308B6E5BF5D0F693680F2308C72794DF2C1E359D6CA3AE39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

446284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocString SysAllocStringByteLen VariantClear VariantCopy SysFreeString

user32

CharLowerA CharUpperA CharLowerW CharPrevExA CharNextA CharUpperW

kernel32

SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetConsoleCtrlHandler FileTimeToLocalFileTime GetCommandLineW SetFileApisToOEM GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetConsoleMode SetConsoleMode GetStdHandle MultiByteToWideChar WideCharToMultiByte GetLastError FreeLibrary LoadLibraryA AreFileApisANSI GetModuleFileNameA LocalFree FormatMessageA FormatMessageW GetWindowsDirectoryA GetWindowsDirectoryW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW lstrlenA GetFullPathNameA GetFullPathNameW GetCurrentDirectoryA SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SearchPathA SearchPathW GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW CreateFileA GetFileSize SetFilePointer DeviceIoControl ReadFile WriteFile GetCurrentProcess GetProcAddress CompareFileTime FileTimeToSystemTime GetSystemInfo GlobalMemoryStatus GetModuleHandleA DosDateTimeToFileTime FileTimeToDosDateTime SystemTimeToFileTime GetSystemTime WaitForMultipleObjects OpenEventA UnmapViewOfFile MapViewOfFile OpenFileMappingA GetTickCount GetProcessTimes LocalFileTimeToFileTime QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId VirtualAlloc VirtualFree WaitForSingleObject CreateEventA SetEvent ResetEvent CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc CreateThread TlsSetValue TlsGetValue ExitThread GetCommandLineA GetVersion ExitProcess TlsAlloc SetUnhandledExceptionFilter TerminateProcess HeapSize GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA FlushFileBuffers UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW InterlockedDecrement InterlockedIncrement IsBadReadPtr IsBadCodePtr SetStdHandle GetCPInfo GetACP GetOEMCP

$PLUGINSDIR/[RANDOM_STRING].7z

IMPHASH b1cc42ed0fd679fe2cb573579ca5ab58
SHA256 73b6b52b3d9a2669a1c3ebde1ad756443ebcd4795cc191c208c13fdb0eaa129a
MD5 403490e33d6076ab338f607416257243
SHA1 600638b397b7b193c41bfe65c127ab8a2f40b41b
SHA512 93a4723498eec83a6d024b0bfbb3d47f9309c6eeecbbab5954ae021fe40e1e00496307ac1fcd461cc4a13aaf96ab929676d70c13d7936d2d494b9cfa2acd6f0d
SSDEEP 6144:3Lbii5bkgVuN+xSKV7Wkrsf7Ls6Z+l2nwLfbRV0LJr:3XikbkgaISKVZl2nadV09r
TLSH
T17734BE113AF5C57BE2420531DEC9BBF6F0E6D7680F21486323D84F2D6E79989C136A1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

115186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocString VariantClear SysFreeString

user32

CharUpperA CharNextA CharUpperW

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs __p___initenv exit _XcptFilter _exit _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memset memcpy fputc fputs fflush fgetc fclose _iob free malloc memmove _purecall memcmp _CxxThrowException __CxxFrameHandler

kernel32

GetModuleFileNameA InitializeCriticalSection ResetEvent SetEvent CreateEventA WaitForSingleObject VirtualFree VirtualAlloc DeleteCriticalSection WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection FileTimeToSystemTime SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize CreateFileA FindFirstFileW FindFirstFileA FindClose GetFullPathNameW GetFullPathNameA lstrlenA DeleteFileW DeleteFileA CreateDirectoryW CreateDirectoryA MoveFileW GetCommandLineW SetFileApisToOEM SetConsoleCtrlHandler FileTimeToLocalFileTime GetVersionExA GetConsoleMode SetConsoleMode GetStdHandle MultiByteToWideChar WideCharToMultiByte GetLastError AreFileApisANSI GetModuleFileNameW LocalFree FormatMessageA FormatMessageW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
TLSH
T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.926a992db7e6503c933e9b8f75b4daec

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/7za.exe

oleaut32

user32

kernel32

generic

$PLUGINSDIR/[RANDOM_STRING].7z

oleaut32

user32

msvcrt

kernel32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic