e8b803925a580c285ebcba8b652644c1_JaffaCakes118

resource
e8b803925a580c285ebcba8b652644c1_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/Encrypt.dll
unpack001/Funshion.exe

resource	yara_rule
sample	nsis_installer_1

IMPHASH 237a51742fed62d237b6f1b75452402f
SHA256 dcaacf44e38bf5f44cc5ef96b64a35ede43457a75e89364cf1cddf88a01bc108
MD5 e8b803925a580c285ebcba8b652644c1
SHA1 f38563159d92b358f06cc7874f5042f21629d6ce
SHA512 94b489ef570595579fe65dfc0a48aa874613189b617b8da2fa7a9cdc646b5563ea63eb14f855b618e95f6a22217277bc5de6fcb88b6c775e25ab5ea3e77d125b
SSDEEP 6144:/WwMnudQIhUCBaQ+ct2GLruD1GgdY0vA+1uYTbU6:Eu6b7QnpLrXcrvH46
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess SetFileTime ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose MulDiv FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ExitWindowsEx CharNextA DialogBoxParamA GetClassInfoA SystemParametersInfoA RegisterClassA EndDialog SetClassLongA IsWindowEnabled SetWindowPos GetSysColor CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CreateDialogParamA AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA wvsprintfA DispatchMessageA PeekMessageA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem LoadImageA GetDC EnableWindow InvalidateRect CreateWindowExA GetWindowLongA DrawFocusRect DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow TrackPopupMenu wsprintfA SendMessageA CallWindowProcA MapWindowPoints GetWindowRect ScreenToClient PtInRect LoadCursorA SetCursor DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SetWindowLongA

gdi32

SetBkColor GetDeviceCaps GetCurrentObject GetObjectA DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegEnumValueA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegQueryValueExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstPath.ini

SHA256 99966f26d40b6465f6f95af8692e4ffa5a084986504274e9104d7c15cfb1a535
MD5 0de5d234cb6f57468746039a8c54805f
SHA1 d72fde1eecb7b3343b07c8221e02a817ded54d59
SHA512 ce506b6eac4ebc2d0be82fefac4b1bb2302cb18a3de13e5d21806bb2cef8ff6df3c80045caca6a9ff160e033318544537564e0f7e4bcc35d25307d94af6ec2a7
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/InstallOptions.dll

IMPHASH 57354bdeea3dfae6e948101add87501a
SHA256 0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
MD5 1d5c649dde35003a618b9679d5d71b92
SHA1 0409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA512 b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
SSDEEP 384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 7d85f9c30f9e87a65fff848de2c96ac1
SHA256 be3f03c07be54354b8a9a30a8c0ac384f43c245c9b95ed1025549c76642f3fb4
MD5 5aae8598d8b53bcec81d8e8c8a6732f9
SHA1 d071fcc74a107c7d7bc5a493d305b00976b07464
SHA512 d20af152b9d1903cd9cd0ff584f14f95ee69cd7149c9ef9369257d08659d1a7ab5860055b39ebd0ead67cfc31da2571175623a5676116ce999acea2b7a643c1d
SSDEEP 96:VLJdRZk8OkmE+WHw0FMXF6CWhFxKpKsBQhEfP0:VLjPk8OT30FFAmCP0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5
MD5 4eff5fafd746f5decb93a44e3a3d570c
SHA1 a11aa7681b7e2df1c7f7492a127d332d1495ea8a
SHA512 cde82d2a1f28506e4c2264f6b82017a00af32f138ebcdbaf4cc58463870fa626f708aa57465294c5a6f096c886841e7b9112b85bf3ea2f1d8f2da816b51b2d72
SSDEEP 192:0OycJo/rJVCmIDNLU0dq5RD00lspbub76yL:6/QQ0d0RD0USq/6y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10323

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WelcomePage.ini

SHA256 3d93f201eb79587a771448b2ba80c235b10589a4f1038ead9480e2c47e2ec874
MD5 10225758d20422a5ff0eecef1e8224c0
SHA1 9e122f4b265a80379bc13d2f16caa97a58dfcb31
SHA512 b64f6347856fd31e28dd015c7820991fb604647f4b4eb3042f73b2747e42192c2606e4cf526bff3c464e63549fa1f11ca8965036ffa69e294e2cb285949cc0a1
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/blank.bmp

SHA256 4299b0f13dc027825ef9a18d059f324b3dd0f937d50578ba7577607a2d5ed03b
MD5 b53546ae991574b3cdc25301a3bd5f83
SHA1 bea8a03f49c081dce805e93214af02e05ef1e473
SHA512 e8784b08cbda1535852f5f823fb85ae6d9fc79ab260f68c80d4a7bbe25d58a007f3834540621b5588bbcc81b852021f57eeac8832126e8031054e7c0f8ea4d92
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/installpathcn.bmp

SHA256 15421cbbb3b7487d43be4cfd09ba25f1c542bf859c2a97dd277b3a3ef2f2ff36
MD5 abe542b4708f53e79a2b6ff0b2d163da
SHA1 81a15e541a855564562a36823f7d1f7b0b68e1a2
SHA512 36f4e993b3dd64d07cd5918b853030c3b3ded88b4d82eb80f4768dad762e77e7dd3138ce7f11f1cd05d2260e49d45b95fdd5f13b753868d0ba18fe08061077eb
SSDEEP 384:BVnHObhDi8s8XybRekSZxgWL5NO7xfj5w:nHObhDiH8XIgkemw4xfjW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/installpathen.bmp

SHA256 5e9a2388d12caa976c67ae6b20d64ebaeaae057d0a04b348ce053649edb0cd65
MD5 9385fb56d5c88655af4750a0dc9463eb
SHA1 fa35889cfe1ae6a5e264cfd761370c576339fed2
SHA512 2f5fc398af6708c9ee238f310d280beb38d55af965d9a3ca13340aeee7f6f5e10934c7e3628ad6d444c5719432fe6455d58fabe3378cea944d1ebd5005da2ae1
SSDEEP 384:GkcAMtyJS+FNahrnUr73RJwOb0BiMGjIOYmAINdZmHEmVLTQLREr52HC53Ygn:9nNah4BJ9b0BhOYmAINdZqfVLTwYFx9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/instpath.ini

SHA256 99966f26d40b6465f6f95af8692e4ffa5a084986504274e9104d7c15cfb1a535
MD5 0de5d234cb6f57468746039a8c54805f
SHA1 d72fde1eecb7b3343b07c8221e02a817ded54d59
SHA512 ce506b6eac4ebc2d0be82fefac4b1bb2302cb18a3de13e5d21806bb2cef8ff6df3c80045caca6a9ff160e033318544537564e0f7e4bcc35d25307d94af6ec2a7
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/welcomepage.ini

SHA256 3d93f201eb79587a771448b2ba80c235b10589a4f1038ead9480e2c47e2ec874
MD5 10225758d20422a5ff0eecef1e8224c0
SHA1 9e122f4b265a80379bc13d2f16caa97a58dfcb31
SHA512 b64f6347856fd31e28dd015c7820991fb604647f4b4eb3042f73b2747e42192c2606e4cf526bff3c464e63549fa1f11ca8965036ffa69e294e2cb285949cc0a1
MD5 SHA1 SHA512

NSIS installer

installer

CrashReport.exe

IMPHASH 89c545a01e749bf5aecb90bd053ee7de
SHA256 c246f010069fdb30966e4573cc6113e7b851c9096892775510960ea7ef85f37a
MD5 16508a7499ddd769777ab7a14322cc38
SHA1 a0660b1ef8bbbf595aead0030e075699e920aff7
SHA512 949833b6a5096d502639f01bfd509e12b71100d34ff1fffdb06767c9c33520b34a834f5a54df0f45d207482f55264b905f284c54f8316a2a4c7acae788bf3160
SSDEEP 3072:XBqOrbmvmJ9BW7YcnXk3TBfjpcJs53/1EkxC:XEOrivmxW75U3TBrpcJ6XC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7e:80:49:6c:84:32:b5:58:55:85:c0:67:23:d0:aa:eb:65:e0:49:35

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jun 4, 2010

Minor OS version

0

Major OS version

4

Entry point

47424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

FtpSetCurrentDirectoryA FtpPutFileA InternetConnectA InternetOpenA InternetCloseHandle

kernel32

FlushInstructionCache RaiseException LoadResource GetModuleHandleW lstrcmpiW GetThreadLocale LeaveCriticalSection SetThreadLocale InitializeCriticalSection GetModuleFileNameW InterlockedDecrement SizeofResource DeleteCriticalSection MultiByteToWideChar GetLastError GetCurrentProcess CloseHandle CreateFileA ReadFile GetPrivateProfileStringA GetSystemTime GetModuleFileNameA lstrlenW GetStringTypeA LCMapStringW LCMapStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA SetStdHandle IsValidCodePage GetOEMCP SetLastError GetCPInfo FlushFileBuffers SetFilePointer GetConsoleMode GetConsoleCP GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA EnterCriticalSection InterlockedIncrement GetStringTypeW GetCurrentThreadId FreeLibrary DeleteFileA LoadLibraryExW FindResourceW HeapSize VirtualAlloc VirtualFree HeapCreate HeapDestroy LoadLibraryA IsProcessorFeaturePresent SetEndOfFile InterlockedExchange WriteFile TlsFree TlsSetValue TlsAlloc TlsGetValue RtlUnwind Sleep GetACP InterlockedCompareExchange GetProcAddress GetModuleHandleA ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree HeapAlloc HeapReAlloc TerminateProcess IsDebuggerPresent GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA GetSystemTimeAsFileTime SetHandleCount GetStdHandle GetFileType

user32

GetClientRect GetWindowRect GetWindowLongW SetWindowLongW DestroyWindow SendMessageW LoadIconW SystemParametersInfoW IsDialogMessageW GetParent PostQuitMessage GetSystemMetrics DispatchMessageW CharNextW PeekMessageW MapWindowPoints DefWindowProcW GetDlgItem GetWindow LoadImageW ShowWindow TranslateMessage CreateDialogParamW SetWindowPos GetMessageW UnregisterClassA

gdi32

CreateFontW DeleteObject GetStockObject

advapi32

RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathA ShellExecuteA

ole32

CoUninitialize CoCreateInstance CoTaskMemRealloc CoInitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathRemoveFileSpecA PathFindFileNameA

comctl32

InitCommonControlsEx

Encrypt.dll

IMPHASH 9db75371d7554a8ca5b7e27a94fca919
SHA256 68cf718e9196b462248af847a430e7c40e2b1e3c9022d02e8cbfc21b1321f3be
MD5 5468eb7b4cd7e648a337a187e565447d
SHA1 f0269db098eb699ec7583ab40dd4bfb311a51b5d
SHA512 af48c98fd449f7e4733605cc6c57259df459f49820f7a572174a9b07dfd52c1fe9c0cd8b6866463c72b1150c9d5505dbb580bffb276f85ef19650a5dac7e9d43
SSDEEP 768:l9MVMloL02y2aP8ny4X+RW5yBWVB+Tyy0RiNWMx5j:l9wMlygmX+RW5GWwyy0cr5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\build2.2.0\symbols\Encrypt.pdb

Funshion.exe

SHA256 6d652e5a07f4b1a4c79fdccbb8097c82e1aab62ecffa1fd0f6e632253e06cf37
MD5 f612eddb96487d0d7fc9112cdccc33ef
SHA1 e7f2ef54352c055b94783b19425177e02d11a8ea
SHA512 c85653e598d2e873cbf17ac8ea717120607f923599e4abf3f51b087d4f537092dcc5c9d5a194e1caa38da52c2bfd836588f1a0448492f411f8ae98cca532711a
SSDEEP 1536:2B5XTWIYt4IwlcM6lx/3G/2AmvK4GphPT1gXUl:GWIgoH2AmvDq7gX2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

588594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer