37a0b78e19c25f27df230a7b90971db0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
37a0b78e19c25f27df230a7b90971db0_JaffaCakes118
Size 569KB
Sample240512-b91f7adh34
SHA256 22894ff22c8ce3cba8869242622460bb9168deb05e724bf6371433df60d6280f
MD5 37a0b78e19c25f27df230a7b90971db0
SHA1 b6362b4ad7a4e93809d11d6417e8bc550c642f05
SHA512 ecdf4284fcaba23941e36f7cd05f99b7d3a99ce57f7e22d22e9294b375ea04a6187ef27484bd8bf44c4b4a9ec304d362c5947db331f0fde74cee4dc351351877
SSDEEP 12288:DFdIJTu8vzHunn+f0c9R2dvJNRMXRQuIe6/P3N8AbfdmaMx:DFdIJTP7Hin+f03vJNIRIe6/fN8WfdFs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 12 IoCs

Checks for missing Authenticode signature.

resource
37a0b78e19c25f27df230a7b90971db0_JaffaCakes118
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/CustomLicense.dll
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/NSISArray.dll
unpack001/$PLUGINSDIR/NSISpcre.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc_n.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nxs.dll
unpack001/$TEMP/$_73_/ext.doc

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

37a0b78e19c25f27df230a7b90971db0_JaffaCakes118

.exe 569KB
$PLUGINSDIR/ButtonEvent.dll

.dll 4KB
$PLUGINSDIR/CustomLicense.dll

.dll 4KB
$PLUGINSDIR/IpConfig.dll

.dll 114KB
$PLUGINSDIR/NSISArray.dll

.dll 18KB
$PLUGINSDIR/NSISpcre.dll

.dll 164KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/inetc_n.dll

.dll 20KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 6KB
$PLUGINSDIR/nxs.dll

.dll 6KB
$TEMP/$_73_/$_73_.zip

.zip 117KB
$TEMP/$_73_/ext.doc

.exe 574KB

37a0b78e19c25f27df230a7b90971db0_JaffaCakes118

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 22894ff22c8ce3cba8869242622460bb9168deb05e724bf6371433df60d6280f
MD5 37a0b78e19c25f27df230a7b90971db0
SHA1 b6362b4ad7a4e93809d11d6417e8bc550c642f05
SHA512 ecdf4284fcaba23941e36f7cd05f99b7d3a99ce57f7e22d22e9294b375ea04a6187ef27484bd8bf44c4b4a9ec304d362c5947db331f0fde74cee4dc351351877
SSDEEP 12288:DFdIJTu8vzHunn+f0c9R2dvJNRMXRQuIe6/P3N8AbfdmaMx:DFdIJTP7Hin+f03vJNIRIe6/fN8WfdFs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/ButtonEvent.dll

IMPHASH 0ece15e7d9bb35972aec701f46192460
SHA256 d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f
MD5 55788069d3fa4e1daf80f3339fa86fe2
SHA1 d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
SHA512 d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616
SSDEEP 96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CustomLicense.dll

IMPHASH 17ea51acf0005f354251d1882460a13c
SHA256 bdf2d5ac95808ffe5b29aac71fcc2eb64bdca5b272a9c4082a74e20d0b1f20da
MD5 ae97fd89eec5000b400e6bc7e8db0e56
SHA1 7ec1073f712ff5bd68deec894c36c0385bacdd68
SHA512 2e0d0182d7fda547bfd3f25c56d0c20ba75809ac8d4c96c2b40aad3db9a61c730a650c7e02c6050ab37abdf8ce66ea1e4479921d72e21f55b6fd42a3dc033ec3
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4380

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH a9988f98d52a3c7d16228f87844f85ea
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

kernel32

lstrcpynA InterlockedIncrement InterlockedDecrement GlobalAlloc MultiByteToWideChar GlobalFree lstrcpyA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement SysAllocStringLen VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/NSISArray.dll

IMPHASH 91596216b99c852af6e0fb1fe8192de4
SHA256 b279c82b7e6f6bf652c5b5440c20f01d522f6e8d3c79b72076e18796166316f6
MD5 c4279b957d4dc593074479bc088b74c1
SHA1 53de3c1bb13a19a0ae19d9db5cbef1b919520f83
SHA512 c1746122489ceb6c3af6c535beccd8d9d853c53dcb41274f122c43bc0ea5f9fe83873218e22d9c69a39f83ed54e7d5b8b9ab0adefaec23cf5d8c3a51438688c5
SSDEEP 384:DCuvLnlVk/V6r7OpI5czJwLJuJJKymEA3SLNk4Eqe05:bDlVk/Xp7TKymeLN1Eo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

16699

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISpcre.dll

IMPHASH 3efd46aba10b2e88f0bd15c6467e81ad
SHA256 43041f8540dccbc33268bfbef53037d17170b037f6393e77c21429f303ae828f
MD5 bfe060c22b44914e05d3f5367de6c9fe
SHA1 24c72b0b57b0066a5e8b235104a0502400e44b9a
SHA512 ad3a23edd8d62b198e4a2ccf03f6d607dee41fa23fd6f9dfabdc5ee424b5e22a6e00b8a28e50fe177829a2cc25ce05484423e97c682036fc5146e2adf560bc44
SSDEEP 3072:5YFyk+vtvpoYYPkoYMtXTP5V+4Km//sbJVlseEOb+Y+UT:KFyznYntXL5XKCk9MeEm7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

77471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\ms_projects\NSISpcre\Release\NSISpcre.pdb

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc_n.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nxs.dll

IMPHASH fd495db6c916b55c715b6e970a4627e1
SHA256 033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3
MD5 8ca09b6200ffa05b54c6672d855beb4a
SHA1 daa16fe49c8b2250e9d2383b861cda51f876de49
SHA512 6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14
SSDEEP 48:qnnScipSivON+tPTCkWqjqoay6NvC9A220B20BNatQK5zAgQIl0YawUy11TKcZ8Q:an3N+2AjqoWvC5VRxMLawvxM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5611

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/$_73_/ext.doc

IMPHASH 15847eb10d7d06dcd5980e8a9b786fd6
SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
MD5 42badc1d2f03a8b1e4875740d3d49336
SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

446284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocString SysAllocStringByteLen VariantClear VariantCopy SysFreeString

user32

CharLowerA CharUpperA CharLowerW CharPrevExA CharNextA CharUpperW

kernel32

SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetConsoleCtrlHandler FileTimeToLocalFileTime GetCommandLineW SetFileApisToOEM GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetConsoleMode SetConsoleMode GetStdHandle MultiByteToWideChar WideCharToMultiByte GetLastError FreeLibrary LoadLibraryA AreFileApisANSI GetModuleFileNameA LocalFree FormatMessageA FormatMessageW GetWindowsDirectoryA GetWindowsDirectoryW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW lstrlenA GetFullPathNameA GetFullPathNameW GetCurrentDirectoryA SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SearchPathA SearchPathW GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW CreateFileA GetFileSize SetFilePointer DeviceIoControl ReadFile WriteFile GetCurrentProcess GetProcAddress CompareFileTime FileTimeToSystemTime GetSystemInfo GlobalMemoryStatus GetModuleHandleA DosDateTimeToFileTime FileTimeToDosDateTime SystemTimeToFileTime GetSystemTime WaitForMultipleObjects OpenEventA UnmapViewOfFile MapViewOfFile OpenFileMappingA GetTickCount GetProcessTimes LocalFileTimeToFileTime QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId VirtualAlloc VirtualFree WaitForSingleObject CreateEventA SetEvent ResetEvent CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc CreateThread TlsSetValue TlsGetValue ExitThread GetCommandLineA GetVersion ExitProcess TlsAlloc SetUnhandledExceptionFilter TerminateProcess HeapSize GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA FlushFileBuffers UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW InterlockedDecrement InterlockedIncrement IsBadReadPtr IsBadCodePtr SetStdHandle GetCPInfo GetACP GetOEMCP

Sharing

General

Malware Config

Signatures

File Explorer

37a0b78e19c25f27df230a7b90971db0_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/ButtonEvent.dll

kernel32

user32

generic

$PLUGINSDIR/CustomLicense.dll

kernel32

user32

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/NSISArray.dll

kernel32

user32

generic

$PLUGINSDIR/NSISpcre.dll

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc_n.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nxs.dll

kernel32

user32

generic

$TEMP/$_73_/$_73_.zip

$TEMP/$_73_/ext.doc

oleaut32

user32

kernel32

generic