jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]Somato[.]r[.]954ace45bf16e9b1ff9696a9437c3088

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.954ace45bf16e9b1ff9696a9437c3088
Size 406KB
Sample261014-ejqe3sed39
SHA256 ddea02f4997db8ce6c64c924f370f49301a25fa5ac3b9258c5590f4363f58a50
MD5 954ace45bf16e9b1ff9696a9437c3088
SHA1 3fa01676ecdcdee32672ba7a1fc7999c66e26533
SHA512 0c4140340c29e0eb7ff99eec0d50852bdea752df7a409b5faef19cb0aa0eefb351bd1d9fcc8fb9aeefb57b417a493b27f4891602c285d8c85d58021e9f21a409
SSDEEP 12288:+A0i50GRsxHfbMoafwIkxzflYB7sl2QntQmlLfVF:+AfyGWHf2wJ1OMVBF
TLSH
T15594121359608072EA67023010FE9FD1EBF4AC2363D44A5B33B5795B9DB3B67E32125A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/7za.exe
unpack001/$PLUGINSDIR/nsExec.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.954ace45bf16e9b1ff9696a9437c3088

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.954ace45bf16e9b1ff9696a9437c3088

.exe 406KB
$PLUGINSDIR/7za.exe

.exe 574KB
$PLUGINSDIR/[RANDOM_STRING].7z

.7z 80KB
$PLUGINSDIR/nsExec.dll

.dll 8KB

jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.954ace45bf16e9b1ff9696a9437c3088

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 ddea02f4997db8ce6c64c924f370f49301a25fa5ac3b9258c5590f4363f58a50
MD5 954ace45bf16e9b1ff9696a9437c3088
SHA1 3fa01676ecdcdee32672ba7a1fc7999c66e26533
SHA512 0c4140340c29e0eb7ff99eec0d50852bdea752df7a409b5faef19cb0aa0eefb351bd1d9fcc8fb9aeefb57b417a493b27f4891602c285d8c85d58021e9f21a409
SSDEEP 12288:+A0i50GRsxHfbMoafwIkxzflYB7sl2QntQmlLfVF:+AfyGWHf2wJ1OMVBF
TLSH
T15594121359608072EA67023010FE9FD1EBF4AC2363D44A5B33B5795B9DB3B67E32125A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

78:ca:4c:0d:26:84:67:07:04:9e:4f:3e:8a:77:27:14:07:24:31:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Somoto Ltd,O=Somoto Ltd,L=Tel Aviv,ST=Israel,C=IL

Chains

Oct 7, 2026

CN=Somoto Ltd,O=Somoto Ltd,L=Tel Aviv,ST=Israel,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

CN=Somoto Ltd,O=Somoto Ltd,L=Tel Aviv,ST=Israel,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

Major OS version

Entry point

14764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/7za.exe

IMPHASH 15847eb10d7d06dcd5980e8a9b786fd6
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
TLSH
T15FC47C2A3AE5C079D65215308B6E5BF5D0F693680F2308C72794DF2C1E359D6CA3AE39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

446284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocString SysAllocStringByteLen VariantClear VariantCopy SysFreeString

user32

CharLowerA CharUpperA CharLowerW CharPrevExA CharNextA CharUpperW

kernel32

SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetConsoleCtrlHandler FileTimeToLocalFileTime GetCommandLineW SetFileApisToOEM GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetConsoleMode SetConsoleMode GetStdHandle MultiByteToWideChar WideCharToMultiByte GetLastError FreeLibrary LoadLibraryA AreFileApisANSI GetModuleFileNameA LocalFree FormatMessageA FormatMessageW GetWindowsDirectoryA GetWindowsDirectoryW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW lstrlenA GetFullPathNameA GetFullPathNameW GetCurrentDirectoryA SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SearchPathA SearchPathW GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW CreateFileA GetFileSize SetFilePointer DeviceIoControl ReadFile WriteFile GetCurrentProcess GetProcAddress CompareFileTime FileTimeToSystemTime GetSystemInfo GlobalMemoryStatus GetModuleHandleA DosDateTimeToFileTime FileTimeToDosDateTime SystemTimeToFileTime GetSystemTime WaitForMultipleObjects OpenEventA UnmapViewOfFile MapViewOfFile OpenFileMappingA GetTickCount GetProcessTimes LocalFileTimeToFileTime QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId VirtualAlloc VirtualFree WaitForSingleObject CreateEventA SetEvent ResetEvent CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc CreateThread TlsSetValue TlsGetValue ExitThread GetCommandLineA GetVersion ExitProcess TlsAlloc SetUnhandledExceptionFilter TerminateProcess HeapSize GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA FlushFileBuffers UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW InterlockedDecrement InterlockedIncrement IsBadReadPtr IsBadCodePtr SetStdHandle GetCPInfo GetACP GetOEMCP

$PLUGINSDIR/nsExec.dll

IMPHASH 06e07a9e2c8ec78ec44f1a538a1bd2a2
SHA256 289786fe13801467653eb2712f47f162d6fd3fc2d844be342282f75fc2b2a085
MD5 b8be6632a7dc8136ff01338be40fe701
SHA1 043fa16929b2af5ed5c1c59b4035a10cf765fb43
SHA512 403474154ff8500e5aae2b4466c652e5d066af2c55d8f158e6f007492ceb1f3abcc6cca80842b90900db02db4258ddcda75dec1d1799af24969c35811891e5b8
SSDEEP 96:ovkNRhdXhG0CzpC6dsiFam4C026ebZT4MJlWD+RfEqL5Q4hTUVKJx3/:9Nnd9Cz86GVSmua+2qL5Q4h4VSp
TLSH
T19702D8525A1174F1D34AA87F3CEBCB6B4EB5E07516D41259E3B40E071CF01B9AB7220A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.954ace45bf16e9b1ff9696a9437c3088

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$PLUGINSDIR/7za.exe

oleaut32

user32

kernel32

generic

$PLUGINSDIR/[RANDOM_STRING].7z

$PLUGINSDIR/nsExec.dll

advapi32

kernel32

user32

generic