f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118
Size 331KB
Sample240415-kp2cesda2v
SHA256 f02074eeb1cba11ac24a507940543b0ffb18121b7a23a556bfb53e0c74a8fc84
MD5 f0afec022f8492766bfefd0d07ef8abf
SHA1 45d06e99fa1f60b461a4f7bf80f1c96bc3d010eb
SHA512 c7bd8afaf24a0717c99a05b5fc3b6c4069902a9e70c68ac9cd5c2cf8328aeed8cfffe8f456acd1fbf5a6c117bc8473f38e3ebd12df88ac6b05727cab60903dcd
SSDEEP 6144:WXTN626ii5qvbmh/Jv9khqOHl/DaNq8dMdfwMhUDL3dRjCANctUcmRYXul9hgDh:6qUcMqwl/DaNqfwMECAKytll9hgDh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsBrowserOpt.dll
unpack001/$SYSDIR/adzgalore-remove.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$_5_

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$SYSDIR/adzgalore-remove.exe	nsis_installer_1
static1/unpack001/$SYSDIR/adzgalore-remove.exe	nsis_installer_2

File Explorer

f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118

.exe 331KB
$PLUGINSDIR/Math.dll

.dll 66KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/nsBrowserOpt.dll

.dll 315KB
$SYSDIR/adzgalore-remove.exe

.exe 99KB
$PLUGINSDIR/InstallOptions.dll

.dll 117KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/validate.ini

450B
$_5_

.dll 306KB

f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 f02074eeb1cba11ac24a507940543b0ffb18121b7a23a556bfb53e0c74a8fc84
MD5 f0afec022f8492766bfefd0d07ef8abf
SHA1 45d06e99fa1f60b461a4f7bf80f1c96bc3d010eb
SHA512 c7bd8afaf24a0717c99a05b5fc3b6c4069902a9e70c68ac9cd5c2cf8328aeed8cfffe8f456acd1fbf5a6c117bc8473f38e3ebd12df88ac6b05727cab60903dcd
SSDEEP 6144:WXTN626ii5qvbmh/Jv9khqOHl/DaNq8dMdfwMhUDL3dRjCANctUcmRYXul9hgDh:6qUcMqwl/DaNqfwMECAKytll9hgDh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Math.dll

IMPHASH fedb8e95b3698a6c05b69204d3c2de7a
SHA256 8a8d78657f0f6b44f18b16e7eea3e62eef6720e04cd2efc820d62bbe987afac1
MD5 468914ab4ea3afc6fda29031c758394e
SHA1 d3b632778a03567efa761401151bfe80d0fe956c
SHA512 0b3df17a3a17a82ba7092ff384c7d820d9f1103fcfa732fb399cf0ff065ec6913a73bea433e19ad787bccf272059e39d196322445d9a6327bb25738f343926ce
SSDEEP 1536:zPyr/G6SdHg4amq2MwtmIuqFVxL9NvImlRo:z6AHg6bH5lq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
MD5 997ae296af5b7ca9aaa52f6844075439
SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
MD5 32465a07028b927b22c38e642c2cb836
SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsBrowserOpt.dll

IMPHASH 486ce976f8d3cc3ada80177f5d315120
SHA256 6dee4487d5ffb10ada3cb4e4f8124ac445870cf38e3eb0df0be1ec1d9088267e
MD5 716f84312a370cbb59e89770016ac76d
SHA1 c804e0c5471e63071d4b480d53cc8faf333b9984
SHA512 2bf06e57edaa7c41466c2c3aebfdde097b376bfc13b214f5e90b2770e9756cb249f8e1978b92cf3b32cfede68b8b234537aea84d8c270e3222311cf6358ae975
SSDEEP 6144:6creMAt6kGYFZFsgNsYXnzI0LdG91TBLMZk4C/L:62eMA8XYdhNsY3zIKg1TRMZktL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

107642

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_GetComponentManager NS_Alloc NS_GetServiceManager NS_Free NS_CStringGetData NS_CStringContainerFinish NS_CStringContainerInit NS_CStringSetData NS_StringContainerInit2 NS_StringContainerInit NS_StringGetData NS_StringContainerFinish

nspr4

PR_AtomicIncrement PR_AtomicDecrement

kernel32

LoadLibraryW DeleteFileW lstrlenW DeleteCriticalSection InterlockedExchangeAdd EnterCriticalSection LeaveCriticalSection InitializeCriticalSection InterlockedExchange SetEnvironmentVariableA CompareStringW CompareStringA GetDriveTypeA GetProcessHeap SetEndOfFile CreateFileA GetTimeZoneInformation SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetModuleHandleA GetStringTypeW GetStringTypeA WideCharToMultiByte MultiByteToWideChar GetFullPathNameW GetTempFileNameW GetFileSize MapViewOfFile UnmapViewOfFile VirtualQuery GetModuleFileNameW CreateFileW LocalAlloc CreateFileMappingW CloseHandle LocalFree WaitForSingleObject TerminateThread Sleep SetThreadPriority GetExitCodeThread FreeLibrary GetTempPathW GetProcAddress LoadLibraryA CreateMutexW CreateProcessW GetTickCount GetLastError ReleaseMutex GetSystemTime GetSystemInfo GetWindowsDirectoryW GetVolumeInformationW MoveFileExW InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA HeapFree ExitThread CreateThread FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo HeapAlloc WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetCurrentProcessId GetACP GetOEMCP IsValidCodePage VirtualAlloc HeapReAlloc ReadFile GetConsoleCP GetConsoleMode FlushFileBuffers GetTimeFormatA GetDateFormatA SetFilePointer GetCurrentDirectoryA GetLocaleInfoA

user32

GetWindow wsprintfW MapWindowPoints SystemParametersInfoW GetWindowLongW GetClientRect GetParent SetWindowLongW CallWindowProcW GetWindowRect PostMessageW SetWindowPos IsWindow SetWindowTextW SendMessageW ShowWindow FindWindowW

rpcrt4

UuidToStringW RpcStringFreeW

imagehlp

UnMapAndLoad MapAndLoad

shlwapi

StrStrIW UrlGetPartW UrlEscapeW PathMatchSpecW UrlUnescapeW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

advapi32

RegSetValueExW RegDeleteValueW RegQueryValueExW RegCreateKeyW CryptDecrypt CryptDestroyKey CryptEncrypt CryptDeriveKey CryptHashData CryptDestroyHash CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptGenRandom RegCloseKey

shell32

SHCreateDirectoryExW

ole32

CoTaskMemFree CoInitialize CoUninitialize

ws2_32

inet_addr

wininet

InternetConnectW HttpSendRequestW InternetSetOptionW InternetReadFile InternetCrackUrlW InternetCloseHandle HttpQueryInfoW HttpOpenRequestW InternetQueryOptionW InternetOpenW

dnsapi

DnsFree

$SYSDIR/adzgalore-remove.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 21f7cb13c3a8d35e8533ffa55485a4c1c7c35e41d93893cbc0dda43b3b00e7e5
MD5 31709de9a5d9f2906dce36c836e4e055
SHA1 cc59ca78fa077fff9384570189ac16b091bf49ec
SHA512 bfd57f3bf8ec9c7ed04e51e67b2e0f0428cb811f0d1bf2015b78a0d5e93c65aa4da1648fe49bfecd88b7f613ef6ba4b9106fc19053c39d96011d0f18ce2ddf74
SSDEEP 1536:WUeHiWRgkkjH8nyWmJPnWb/Nv07LVpN6MzPY0rBAWCKSjqBkHBTXHccDuVbH8k5O:Wd/vyWmJqG7/wu6WCqGdccDc775kMZI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 0dd66824726715358a99b2af20e0b80a
SHA256 44e729371099650904bcd5db0af7fdad6ffc01e336ae464f0bb151f329175292
MD5 cd6e705cc6992e869f488ab211ac37cb
SHA1 c9c71edd929c15bcf5ee286d4a9e9259d1590eb5
SHA512 460173bbcff640721e54bb403e1f46d274e649a9db7d3b83d009a7f00354d434874dfdc009679e98cfb05548801b9eee78c25fe17b083fac396087ad3327debf
SSDEEP 1536:G8jeHR5cxDyiJu+Sp3o7lCNj+fgERBNxOtyg5Fu/oZSY0vXuHznnULYU455YQ+5:tZHK4Z2j+fP31gu3eHTnULB455y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

48256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked

shlwapi

PathFileExistsA PathFindExtensionA

kernel32

ReadFile GlobalLock CloseHandle GetFileSize CreateFileA LoadLibraryA WideCharToMultiByte HeapSize GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle HeapReAlloc VirtualAlloc HeapAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA ExitProcess Sleep InterlockedDecrement SetLastError InterlockedIncrement TlsFree GlobalUnlock GetModuleHandleA GetSystemTime GetPrivateProfileStringA WritePrivateProfileStringA GetDateFormatA GetTimeFormatA MultiByteToWideChar MulDiv lstrcatA GetCurrentDirectoryA SetCurrentDirectoryA GetTickCount lstrcmpA SetErrorMode FindFirstFileA lstrcmpiA lstrlenA lstrcpyA GlobalFree GlobalAlloc lstrcpynA TlsSetValue TlsAlloc TlsGetValue GetProcAddress GetModuleHandleW DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetFilePointer RtlUnwind GetConsoleMode GetConsoleCP WriteFile LeaveCriticalSection EnterCriticalSection HeapFree GetLastError IsDebuggerPresent SetUnhandledExceptionFilter GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter

user32

MessageBoxA wsprintfA CharNextA SendMessageA IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA DestroyWindow DestroyCursor DestroyIcon ShowWindow EnableWindow GetSystemMenu EnableMenuItem CreateDialogParamA GetWindowRect MapWindowPoints SetWindowPos CopyImage LoadImageA CreateWindowExA SetWindowRgn GetClientRect SetWindowLongA GetCursorPos ScreenToClient IsWindowEnabled GetWindowLongA DrawTextA DrawFocusRect GetSysColor UpdateWindow SetTimer GetDlgItem GetDC ReleaseDC KillTimer GetDlgCtrlID PostMessageA ValidateRect LoadCursorA SetCursor GetKeyState CallWindowProcA MapDialogRect GetWindowTextLengthA GetWindowTextA SetWindowTextA

gdi32

CreateFontIndirectA DeleteObject CreateCompatibleDC GetDIBits CreateRectRgn CombineRgn SetTextColor SetBkColor CreateSolidBrush SelectObject PatBlt SetBkMode GetBkColor GetTextColor GetBkMode CreateBrushIndirect GetObjectA GetDeviceCaps

comdlg32

ChooseColorA ChooseFontA GetSaveFileNameA GetOpenFileNameA CommDlgExtendedError

shell32

SHBrowseForFolderA SHGetDesktopFolder ShellExecuteA SHGetPathFromIDListA ExtractIconExA

ole32

OleSetContainedObject OleCreate CreateStreamOnHGlobal CoTaskMemFree

oleaut32

VariantInit SysAllocString VariantClear SafeArrayCreate SafeArrayAccessData SafeArrayDestroy OleLoadPicture

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
MD5 997ae296af5b7ca9aaa52f6844075439
SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
MD5 32465a07028b927b22c38e642c2cb836
SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_5_

IMPHASH ad090cc92ba62ac8f0b09d85e39af1a3
SHA256 b7f8e9c663515cc1e1deaddabe285959c668ffc6346d82ae97e35f021d30afa9
MD5 dc21e047a5c144e913f368423786d6cc
SHA1 272ae16afdbe0994ad797996ede07b8e045ca036
SHA512 301689078e21b17ae27e5a4e6f3235510b0c3ec2d1ec022ba5ac0c1b12e4e0bbf18d538a0ee362b39a0ad8667223c15f2b2a7e7a2315bbcdbd73545582bce9bd
SSDEEP 6144:x5kv9YzFPA0N7azcPFqR5pTE714TB/9VfzhiN:x5kv9YNDgzcP6C714T19Vfzm
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

126079

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

UrlUnescapeW StrCmpIW UrlEscapeW UrlGetPartW StrStrIW PathMatchSpecW

kernel32

GetTimeZoneInformation SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStdHandle SetHandleCount HeapReAlloc VirtualAlloc VirtualFree HeapDestroy HeapCreate ExitProcess HeapSize InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA GetLocaleInfoA TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleW HeapAlloc GetCPInfo LCMapStringW LCMapStringA GetCurrentDirectoryA SetFilePointer GetDateFormatA GetTimeFormatA FlushFileBuffers GetConsoleMode GetConsoleCP ReadFile IsValidCodePage GetOEMCP GetACP GetCurrentProcessId SetEndOfFile GetLastError GetFullPathNameW GetTempFileNameW GetFileSize GetModuleHandleA UnmapViewOfFile VirtualQuery CreateFileW LocalAlloc CreateFileMappingW CloseHandle LocalFree WaitForSingleObject TerminateThread Sleep SetThreadPriority GetExitCodeThread FreeLibrary WriteFile GetProcAddress LoadLibraryA DeleteFileW WideCharToMultiByte lstrlenW SetLastError GetTempPathW GetSystemInfo GetWindowsDirectoryW GetVolumeInformationW CreateMutexW CreateProcessW GetTickCount ReleaseMutex GetSystemTime MoveFileExW GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings RtlUnwind GetProcessHeap GetDriveTypeA CompareStringA CompareStringW GetModuleFileNameW MultiByteToWideChar lstrcmpW DeleteCriticalSection InitializeCriticalSection RaiseException FindFirstFileW FreeEnvironmentStringsA GetDriveTypeW FileTimeToLocalFileTime MapViewOfFile CreateFileA LoadLibraryW LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement GetFileType GetStartupInfoA QueryPerformanceCounter SetEnvironmentVariableA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime ExitThread CreateThread FindClose FileTimeToSystemTime GetModuleFileNameA

user32

wsprintfW EnumChildWindows RealGetWindowClassW GetWindowTextW SendMessageW SetWindowLongW CallWindowProcW GetWindowLongW SetWindowTextW SetWindowPos

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoInitialize

oleaut32

VariantCopy SysAllocStringLen SysFreeString SysAllocString SysStringByteLen SysAllocStringByteLen VariantInit VariantClear SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy VariantChangeType

ws2_32

inet_addr

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

rpcrt4

UuidToStringW RpcStringFreeW

urlmon

UrlMkGetSessionOption

wininet

InternetSetOptionW InternetOpenW InternetQueryOptionW InternetCrackUrlW InternetReadFile HttpSendRequestW InternetConnectW HttpQueryInfoW InternetCloseHandle HttpOpenRequestW

imagehlp

UnMapAndLoad MapAndLoad

advapi32

CryptGetHashParam CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDeriveKey RegSetValueExW RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegCreateKeyW RegCloseKey CryptGenRandom CryptReleaseContext CryptAcquireContextW CryptHashData

shell32

SHCreateDirectoryExW

dnsapi

DnsFree

Sharing

General

Malware Config

Signatures

File Explorer

f0afec022f8492766bfefd0d07ef8abf_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Math.dll

kernel32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsBrowserOpt.dll

xpcom

nspr4

kernel32

user32

rpcrt4

imagehlp

shlwapi

version

advapi32

shell32

ole32

ws2_32

wininet

dnsapi

generic

$SYSDIR/adzgalore-remove.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/validate.ini

$_5_

shlwapi