e3554810937d8b4439be8a247dcad002_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e3554810937d8b4439be8a247dcad002_JaffaCakes118
Size 330KB
Sample240406-1d2rtabe7y
SHA256 5f0eb604489fccc60a72467d3dc77a2d8bf20af82935d425f2a470fd6cb7f014
MD5 e3554810937d8b4439be8a247dcad002
SHA1 03f8302c85dcc8a5e1d5a6199995d68735eceda2
SHA512 73cbf5f3a37e8b6adca5fd349d028a1003f5fb2228c6349edc82d682d278a60279202c11a4044a2a9646be34f0ead1dea1f6cd4cc18943d89414952f28b990be
SSDEEP 6144:Je34xvY75+ZPPfnE2Qyn20UT/bylyARbhHYVJvy8M9uM75+ZPPfnE2Qyn20U9:BgF+ZPPfnEUnJykkJvyD4MF+ZPPfnEU2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsProcess.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

e3554810937d8b4439be8a247dcad002_JaffaCakes118

.exe 330KB
$PLUGINSDIR/IpConfig.dll

.dll 114KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/UAC.dll

.dll 13KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
IETab.dll

.dll 182KB
IETab.exe

.exe 126KB
IETabHelper.dll

.dll 34KB
Uninstall.exe.nsis

70KB

e3554810937d8b4439be8a247dcad002_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 5f0eb604489fccc60a72467d3dc77a2d8bf20af82935d425f2a470fd6cb7f014
MD5 e3554810937d8b4439be8a247dcad002
SHA1 03f8302c85dcc8a5e1d5a6199995d68735eceda2
SHA512 73cbf5f3a37e8b6adca5fd349d028a1003f5fb2228c6349edc82d682d278a60279202c11a4044a2a9646be34f0ead1dea1f6cd4cc18943d89414952f28b990be
SSDEEP 6144:Je34xvY75+ZPPfnE2Qyn20UT/bylyARbhHYVJvy8M9uM75+ZPPfnE2Qyn20U9:BgF+ZPPfnEUnJykkJvyD4MF+ZPPfnEU2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/IpConfig.dll

IMPHASH a9988f98d52a3c7d16228f87844f85ea
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

kernel32

lstrcpynA InterlockedIncrement InterlockedDecrement GlobalAlloc MultiByteToWideChar GlobalFree lstrcpyA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement SysAllocStringLen VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

IETab.dll

IMPHASH 7043ea7e61582578ed5d36cf1a5a9ff6
SHA256 f8e32b4fc84d1898c1a55640640c77024370525bd85cc3b0f51d3d24a55f847c
MD5 3b3cb102c05a04f24283790b048b2d28
SHA1 ea9bb1b46bf9059b881fb2bd643aad82a481010c
SHA512 8a984887f8eb4fc3e421432087f38a47488f12b8fa094851ac6bb039d0e6c0232abf86e5460e59b1ea2ae493042137719d93169fbb64bec1dac35aa7a2594cff
SSDEEP 3072:5YnNy6Al7L8xg0wIRdFFMijqfCbBzUUmDu/0nPz7+U98faEjrR:5fgJGiGfCb2bysP2LrR
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

97293

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord1997 ord5465 ord5194 ord533 ord1232 ord6197 ord3870 ord2864 ord1768 ord1176 ord1575 ord798 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord6407 ord551 ord6143 ord6467 ord1131 ord2725 ord3953 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord815 ord4274 ord541 ord6883 ord2065 ord801 ord3726 ord5829 ord2827 ord940 ord6282 ord6283 ord924 ord1228 ord926 ord6663 ord540 ord389 ord5207 ord5356 ord690 ord2393 ord5683 ord4204 ord2763 ord939 ord5572 ord5442 ord354 ord5186 ord1979 ord665 ord6877 ord4278 ord536 ord4129 ord2915 ord941 ord860 ord823 ord5710 ord2764 ord4277 ord861 ord2614 ord537 ord1601 ord539 ord535 ord825 ord3920 ord2818 ord858 ord800 ord1168 ord1116

msvcrt

memcmp memset strlen free malloc _mbscmp strcat _mbsnbcpy _mbschr strcpy atol memcpy __CxxFrameHandler _mbsnbcat _except_handler3 _local_unwind2 _mbsicmp atoi strtoul sprintf sscanf wcslen _purecall realloc _lrotl ?terminate@@YAXXZ ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv

kernel32

GetModuleHandleA GetLastError WaitForSingleObject CreateToolhelp32Snapshot Process32First Process32Next CreateThread LoadLibraryA GetProcAddress FreeLibrary CreateFileA WriteFile CloseHandle LockResource GetModuleFileNameA GetShortPathNameA lstrcpyA lstrcatA CreateDirectoryA GetFileAttributesA GetCurrentThreadId lstrlenW lstrcmpA InterlockedDecrement InterlockedIncrement GetCurrentProcess FlushInstructionCache GlobalAlloc GlobalLock GlobalUnlock lstrlenA MultiByteToWideChar EnterCriticalSection LeaveCriticalSection LoadResource SizeofResource FindResourceA GlobalFree WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte HeapDestroy GetVersionExA GetVersion GetLocalTime Sleep TerminateThread GlobalHandle GetPrivateProfileStringA LocalFree LocalAlloc

user32

CreateWindowExA wsprintfA SendMessageA InvalidateRgn SetCapture ReleaseCapture CreateAcceleratorTableA GetDesktopWindow GetParent GetClassNameA RedrawWindow BeginPaint FillRect EndPaint GetDC ReleaseDC GetFocus IsChild GetSysColor CallWindowProcA DispatchMessageA TranslateMessage PeekMessageA DestroyWindow IsWindow GetDlgItem PtInRect GetWindowRect GetMessageA GetCursorPos RegisterClassExA LoadCursorA GetClassInfoExA RegisterWindowMessageA GetWindow SetWindowTextA GetWindowTextA GetWindowTextLengthA GetWindowLongA KillTimer GetClientRect SetWindowPos SetWindowLongA CreateDialogParamA CreateDialogIndirectParamA FindWindowExA GetPropA SendMessageTimeoutA MoveWindow SetParent IsWindowVisible ShowWindow SetForegroundWindow SetPropA ScreenToClient CallNextHookEx GetClassInfoA SetWindowsHookExA SetTimer SetWindowRgn InvalidateRect AdjustWindowRectEx GetMenu TrackMouseEvent RemovePropA UnhookWindowsHookEx CharNextA SetFocus DefWindowProcA

gdi32

DeleteDC GetDeviceCaps CreateRectRgn CombineRgn BitBlt SelectObject GetStockObject GetObjectA CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC DeleteObject

advapi32

RegCreateKeyA RegOpenKeyA RegQueryValueExA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegEnumKeyExA RegCreateKeyExA RegQueryInfoKeyA RegEnumValueA RegOpenKeyExA RegCloseKey

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc ShellExecuteA

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromString CLSIDFromProgID OleUninitialize OleInitialize CreateStreamOnHGlobal OleLockRunning

olepro32

ord253

oleaut32

SysStringLen SysFreeString SysAllocString VariantClear DispCallFunc SysAllocStringLen LoadRegTypeLi VarUI4FromStr VariantInit SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData RegisterTypeLi LoadTypeLi

msvcp60

??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

wininet

InternetOpenA InternetOpenUrlA HttpQueryInfoA InternetQueryDataAvailable InternetReadFile InternetCloseHandle InternetCanonicalizeUrlA InternetCrackUrlA

shlwapi

PathCombineA SHDeleteKeyA

shfolder

SHGetFolderPathA

Name

.text

Size

100KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

IETab_DA

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

IETab.exe

IMPHASH a1db3b1327fabb3c9c1a1b5c72dac5c0
SHA256 e99d960ce333b2d0d8675b9eddf788f1c5d9b630afa38c12566ffbd067c5d1cc
MD5 0e32aac391e0c398e3d190cba5a78b76
SHA1 87a55a05bfff84454fa4d616686d92c0fcae2bda
SHA512 c24ff351f7681915db3ad658b5b5161ed2848dde487cde1cbc1e8d337a715557bb6d06fd0ff84e5b77e5ac728737f0f21c5f5a6989b2f5b294248e2b730dea4e
SSDEEP 1536:WidDeqtj00TZEW6ro5dA0IN/HxLklbUEyX/ALJIUVKM9pWrMnnPz7XGPs:WiEqr6c50N/HwbUZX/Yjf9pFnPz7XGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

70920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord858 ord860 ord540 ord5829 ord3726 ord6883 ord6143 ord2818 ord941 ord1113 ord1114 ord3237 ord465 ord665 ord1979 ord5442 ord5186 ord354 ord2614 ord4277 ord4129 ord2764 ord4278 ord6663 ord924 ord926 ord6877 ord3920 ord1799 ord4226 ord551 ord6407 ord798 ord1997 ord5465 ord5194 ord533 ord614 ord290 ord1601 ord2645 ord6283 ord6282 ord2086 ord2864 ord1228 ord6197 ord4284 ord861 ord2763 ord5710 ord5683 ord5572 ord537 ord536 ord1768 ord4204 ord2393 ord690 ord5356 ord5207 ord389 ord940 ord2827 ord2065 ord6055 ord1776 ord5290 ord3402 ord567 ord2135 ord818 ord2688 ord6320 ord6242 ord3138 ord2863 ord3797 ord1949 ord4034 ord939 ord4299 ord6453 ord6215 ord470 ord755 ord2379 ord4710 ord548 ord2820 ord2486 ord4234 ord324 ord2623 ord3597 ord4425 ord4627 ord5277 ord2124 ord2446 ord1576 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4998 ord4853 ord4376 ord5265 ord539 ord535 ord800 ord801 ord541 ord2107 ord6394 ord5450 ord823 ord6383 ord5440 ord1134 ord2621 ord1168 ord1232 ord2514 ord2841 ord641 ord3663 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord2915 ord4673

msvcrt

__p__fmode __p__commode _adjust_fdiv __setusermatherr __set_app_type __getmainargs _acmdln exit _XcptFilter _setmbcp _initterm _controlfp __CxxFrameHandler free malloc _mbscmp _mbsicmp atoi _mbsnbcat _mbsnbcpy _mbschr atol _except_handler3 _local_unwind2 strtoul sprintf sscanf wcslen __dllonexit _onexit ??1type_info@@UAE@XZ _exit

kernel32

MultiByteToWideChar CreateDirectoryA WinExec GetPrivateProfileStringA GetTickCount LoadLibraryA GetProcAddress FreeLibrary WaitForSingleObject TerminateThread lstrlenA CreateThread GetModuleFileNameA Sleep DeleteFileA GetFileAttributesA GetLocalTime GetVersion GetVersionExA CreateMutexA GetLastError CloseHandle WideCharToMultiByte GetCurrentThreadId GetStartupInfoA GetTempPathA CreateProcessA WriteFile CreateFileA Process32Next Process32First CreateToolhelp32Snapshot GetModuleHandleA lstrcmpA

user32

TranslateMessage DispatchMessageA wsprintfA RegisterWindowMessageA SetWindowTextA EqualRect GetWindowTextA FindWindowExA SetParent PostMessageA IsWindowVisible ShowWindow SetForegroundWindow PeekMessageA GetDlgItem GetCursorPos GetWindowRect PtInRect IsWindow EnableWindow GetClassNameA KillTimer IsIconic SendMessageA GetSystemMetrics GetMenu AdjustWindowRectEx SetWindowRgn InvalidateRect GetPropA DefWindowProcA CallWindowProcW SetPropA GetClassInfoA SetWindowLongA TrackMouseEvent UnhookWindowsHookEx SetWindowsHookExA IsChild CallNextHookEx GetFocus SetWindowLongW RemovePropA GetWindowLongA GetWindow GetClientRect DrawIcon SetTimer GetMessageA GetParent

gdi32

CombineRgn DeleteObject CreateRectRgn

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyA RegCreateKeyA RegCloseKey

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetMalloc ShellExecuteA

ole32

CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData VariantClear

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

wininet

InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetCanonicalizeUrlA InternetCrackUrlA InternetCloseHandle

shlwapi

PathFindFileNameA PathCombineA SHDeleteKeyA

shfolder

SHGetFolderPathA

IETabHelper.dll

IMPHASH efbdeb0a47ae99c5004f8d046057dd1b
SHA256 7873b2030ffbca9c48ecbf6c573b4269f33a6a0226cfbad09e520000ed6a7956
MD5 86ca2be124b855b48001321ec396c73b
SHA1 462dad233a23b67e1260b9f28155fd93b54a036d
SHA512 18262a161287b46915c1c40afbb9b4c763a342234a29e41743965537ae9beaf17d4175c7b9168c4ddf46ac4e14dcc5e4ee6894d21fe3c3c2602e32c3c739ee9a
SSDEEP 192:xg0uTOXGvjODYzYitAM8A5rKTRnTun8o8vAw0Fcou7+wse+PjPgROv:YT3vjODMrxB5renan8OdfuSPL5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

6212

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ADCDATA

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e3554810937d8b4439be8a247dcad002_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

IETab.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

msvcp60

wininet

shlwapi

shfolder

generic

IETab.exe

PE Signature issue

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp60

wininet

shlwapi

shfolder

generic

IETabHelper.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

generic

Uninstall.exe.nsis