jaffacakes118_C4Loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_C4Loader.exe
Size 594KB
Sample261017-wl3a4agc39
SHA256 99fadd593d90f0c69b24e4e0edb40404cd29aecc26a953d84eb6cec2341a6e35
MD5 40bd39d1ef609aa7e8633130fdd00f78
SHA1 92e10daf736202366f30ee1ff4ab40e1e331c79e
SHA512 41c75834687c4397aba81478ad40f7bd99ee24dd31e2a959b10d51e9686f2d0f20025664f96c24cbf7323d1a235d9b74ecb893f956d2aa0d98ec9ecf845f2bfd
SSDEEP 12288:pXAYBxKMNCJ4iUC4uvtBHQTa7j/vksqzPV231OtmW4D4UvwAfBudgaWWzJO:7KMNU4iUC4uDHQTAx31OMW4qAfXKO
TLSH
T1CBD49E1239C1C076D673303247BAE6B45ABEF4701B2256EF53D81A3E5F306E16E3652A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_C4Loader.exe

File Explorer

jaffacakes118_C4Loader.exe

.exe 594KB

jaffacakes118_C4Loader.exe

IMPHASH 6a68ab56a2b032839746dde1ae68afc8
SHA256 99fadd593d90f0c69b24e4e0edb40404cd29aecc26a953d84eb6cec2341a6e35
MD5 40bd39d1ef609aa7e8633130fdd00f78
SHA1 92e10daf736202366f30ee1ff4ab40e1e331c79e
SHA512 41c75834687c4397aba81478ad40f7bd99ee24dd31e2a959b10d51e9686f2d0f20025664f96c24cbf7323d1a235d9b74ecb893f956d2aa0d98ec9ecf845f2bfd
SSDEEP 12288:pXAYBxKMNCJ4iUC4uvtBHQTa7j/vksqzPV231OtmW4D4UvwAfBudgaWWzJO:7KMNU4iUC4uDHQTAx31OMW4qAfXKO
TLSH
T1CBD49E1239C1C076D673303247BAE6B45ABEF4701B2256EF53D81A3E5F306E16E3652A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

13:9c:54:98:8f:88:7d:4f:37:51:48:16:fb:9f:5a:28:3a:1b:f3:87:e4:bc:f6:43:62:72:c2:c1:e3:3a:d0:47

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Chains

Aug 25, 2021

SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Serial Number

0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 1, 2019 - Jan 11, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

Major OS version

Entry point

146778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Администратор\Downloads\Documents\6p3zrn0hr\output.pdb

kernel32

MultiByteToWideChar FormatMessageA GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead CreateFileW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW SetConsoleCtrlHandler HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetStdHandle HeapSize WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_C4Loader.exe

PE Signature issue

kernel32

generic