863bf0dfa1169706f566c070a1e11256_JaffaCakes118

resource
863bf0dfa1169706f566c070a1e11256_JaffaCakes118
unpack001/$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$TEMP/SitulaCystocele.dll
unpack001/$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
unpack001/$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
unpack001/$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
unpack001/$TEMP/mode/Thumbs.db/intern/PermCalc.exe
unpack001/$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b
MD5 863bf0dfa1169706f566c070a1e11256
SHA1 77175726680e40eeefdad0578a1d3377486d9fff
SHA512 21aef52bb4b5ed66c632c0ca55e156b95dd5bf2715599880fb0b5ffea523fca0b82739cf2617095336c332664ab8dcdd64fa910d3bae64c9f384767709720ada
SSDEEP 12288:nanOzOlC9Am80quPgdBHh/FOPfe+VYRVORkG:lqltm80qigrHxFGVYbi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/for/page_1/13.opends60.dll

SHA256 e3d2cfcd73d4f98f610173031b36e4ef77771c50bdb3ec3c8b4f2734b52a73c3
MD5 f04aa19e6a25638e61867d3495058e79
SHA1 f06f9e02611cdd1cf3d960897c262f528d2bfc32
SHA512 7037e51cc7e02be051e16c70ac65c10a6943640a92e91860550f3115220fb2ff78340427a4c796b411dccd803eaafc6fd5cf179432d206445fc819bd2f3df667
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 46b1a81f5ebb43404ac7229d14593d5f47930c8fc3fb5279ac5402507f7ea7b3
MD5 6ad1c32675ecd48f15535e4a0e474e28
SHA1 2d9b200ea1d9fb6442f21bb5441072bd4b9d1968
SHA512 8a425760aa2e7bbe286b2322d2413eaee42d7e386448050c46f61c461481407800ed2b5bd19beee77dd74fcb30e496d36c303d0845e1ee138babf6f483da1659
SSDEEP 384:EW2BCQspyJi6d0XsNGIEP/06V78FIISqa4ld2Cxs+NHsRo8CWewMW:fBqJbS8N7IIlaAs+NHsKe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Microsoft.XslDebugProxy.pdb

$APPDATA/for/page_1/model82.xml

SHA256 f3c17ed8cf8bae525147c888366314b003113d42d4f98da00bfc57a3aad32b09
MD5 0c74288171300e022fd3ea83ecbaef80
SHA1 7fd1e91383e3b23128c9cc7f59d431dedfcdc843
SHA512 ad94c4dbba7a1d58246923fa8aee282c7fff1a1647429d749dc0ca499ac55aa95b5d1547ef273360ec8903d194c21589d5dd457e474623128f5b288813d7f385
SSDEEP 192:BlT/sufWUnDuOEqUkdRcRDRVRxR3RqRDRjJh6RQIRKvR8R3FRd:BlTsUnDB+lfD5MpJJh6mIEvyhFX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/for/page_1/r2400.xml

SHA256 fba683055e842ca58f52b6a628e14232373c3a29c2534f6948a9b0a7f8d00a01
MD5 bfa4d51e5b67c7cbc95ad1bf45c54717
SHA1 8102bde89a44380f6cc02ce2987422db091d65cf
SHA512 46ba9a5067909dc7e97c541cd209313a804a64450cef625b57ef2c75ceace798ff6b4a601e4ad19234bb316af8fe040d35d5054732ac0e77389518a5a9172428
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
MD5 6e64e5d5f9498058a300b26b8741d9d5
SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/2006/35.opends60.dll

SHA256 99e399e564c46308a2ec22a427f5338433a820c09ff559c8f6488be9199ed1ad
MD5 b330e04d27f2b76246c9401bb9df8405
SHA1 fea5928cf1704d14ee717bb703c65aedfb194751
SHA512 b07555fa3fb5e11e91583c28922f5a59f09e0cc8244b3bc5e62cfc231cd4a4da080f0653d404ca9a8ab332f61e393ed17235858e84dca0578f8ae51e9b5f30a9
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/2006/layertab.xml

SHA256 25e97534b8db3994ab94eff9f1483629a28d8a29ca1e9946f781579132ae0b39
MD5 effafec6d3bd448c69e7fa944e1ae583
SHA1 14eb33c51cd4f8ce4a96eba48b85e6bca8aec90e
SHA512 71fee5e92be3807ae6bd6212e07f2a10f198543bc478945b6493b62635c238402cd58aa4cfd068034a685b9b70c091d704dd56a053da0141d1274ed6c050476b
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/2006/reportobjectbar.xml

SHA256 743327e874654611cc7b14ef8b148c51ffed20dbcb67a9dc5958e07d3c936021
MD5 0381ab55cd55e4931f38c02fd76724b9
SHA1 42384dac9ccb52e7784effe43449304ed5374be0
SHA512 af1905927a548cd386d7377a4e0de568bfccbc4a0cfd07a55972ea8ac962eaf9855d111bf66b9f927c79d6740952e06097a73c54446bed0c7039f4f977bfb877
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/2006/x-changelog.xml

SHA256 f0afe107b7d008cb01941df81eae9b5055dcd13bb90587717d7a82be72430a6f
MD5 2e4e76f314a0c1d644dbaaedddf378b9
SHA1 38d0f3c29c5cb41f1ed96a8541224c6f75c2911a
SHA512 3ca85d5f160da110fd2213cf1d17c95fb85cf86b1f63a7322ae241f0a9d03f59b9b74eb4da8e59d382489aa29675df9dee642721c41237e5fe7f2e709c46cc45
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/Prosody

SHA256 27c010483a5665042dd6c20c69f9fdc4bbe9f7bf7fcc516f51cc8318a8c3b844
MD5 6847287ec5adf184583fac09b774e5dd
SHA1 52183c47dd439a5695eee05e2f22608e32179427
SHA512 1e7dbf36ac5949e120f804ebd986882e7d66ce1dc3bd8d0888073ea2f3f07fc13d8d11669372822d3630caf299a1675fd9cf62891203d67b8685520ff3d2775d
SSDEEP 3072:qUHfey9EV+nU39H7PbC2Rj7vsWPXPAEBnRh+cKKAZlVzY11BtYQuPf8h8d16D6RW:flEcyR7iEBRheltYPPOPf++bKiYR2s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SitulaCystocele.dll

IMPHASH 00401e42aca9b0159f285cdcd679c68b
SHA256 18e86106e60613594527c85fe6c97287fc8c3715181a62cb2b4d2258c210b6c8
MD5 de3f3ceccff80b3b0cc7e8cc58357b70
SHA1 701387d5e62903e114f4bdf59cd4f89cc6b2ad4e
SHA512 ad16ea6af2200f7f8a8c0fd0cc1fe5c935942a8789ce057818499b1a51865bb4a0b39a4091f84a2652d2c6ea7569e3829dd5b3043b2d44083a597f3954c2c6db
SSDEEP 1536:5EOuTAjdpOExDJANAB/qepudoVoD3Qu3IEN:5yA/DJ3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

6516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

CryptDestroyHash RegLoadKeyA GetNumberOfEventLogRecords CryptHashData RegSaveKeyA RegDeleteValueA

ws2_32

WSAAsyncGetServByName shutdown

crypt32

CertEnumCertificatesInStore

kernel32

GetProcAddress GetModuleHandleA UnlockFile UnmapViewOfFile WaitForSingleObjectEx SetProcessShutdownParameters GlobalFree GetTapeStatus GetLogicalDriveStringsA SwitchToFiber lstrcmpW GlobalAddAtomA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW HeapSize

$TEMP/donations/decrypted/WebDevWebServer.exe

SHA256 bb84c772ca848ac7b9b7b9e713226187ff65e89763544f333d023be034085f3b
MD5 757bc8142aec8cf5ee8b87002a356522
SHA1 f6200a87e92024899754a5fc4d80a06240a053d6
SHA512 0a99d971fded0b760ac28c8a330dffc7c4c03ee3ea9b2370fd2b2d784a82d92e51d0b1bb167e187d70a213ac32a6a619aaf1bc0028127dccbd2e517e19e21a86
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/donations/decrypted/isabel.xml

SHA256 3dadc9e9235e73be4f6f517e58025324b9c9f9598a1b4616c7f4d31c604e42d7
MD5 951cff9049bc7e6d60e8a9cf4a98e2bb
SHA1 d5db57c9ee3668bde42a1e493c0faf9c93016a9e
SHA512 dd2a4509db98e6b1364ec19ff8f071fc2097bbcd0c4f99be5840df4b7fa8614de9887a2302e55ed93ae8ecf7ceeedd7fcc8cf3f23c4a778a4b172d392c66f4a7
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll

IMPHASH e31d4785817da405fe526d37d096e81a
SHA256 1bf2270bfa6bafe29329f9d84c5f8856b57c84af6f3ed05027cebc4f767d07ef
MD5 b59ec4aa8cc4eeb16e5567c085d5d677
SHA1 7c2442b35816e0517648a390f106910ae960f7bf
SHA512 719d127a378fb16772c5a6c4b6ea6225a27ad4cd2a0d84e237faaa7a1a4e63cdd869ad2cf04b57268e393f709adea2a8aa83c6a640111d93fd2071ebdac7a470
SSDEEP 768:MzE7orC6TyNqZ7t7Ahh5E4C6FHYm6d985dgn49kjkGnUOhBpEdpb:tkTym7t7Ahh93+dqgbjXUOhBpeb
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

31282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ActiveSyncBootstrap.pdb

kernel32

WriteFile SetFileTime DeleteFileW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetThreadLocale MultiByteToWideChar lstrlenW RaiseException LoadResource SizeofResource FindResourceW InterlockedIncrement InterlockedDecrement GetModuleFileNameW lstrcmpiW LoadLibraryExW CloseHandle SetThreadLocale Sleep InterlockedCompareExchange QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetLocaleInfoA GetVersionExA InterlockedExchange SetLastError GetFileTime ReadFile CreateFileW GetLastError WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW GetFileAttributesW

msvcr80

_crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CxxFrameHandler3 _wcsicmp memset _except_handler4_common __clean_type_info_names_internal _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt _encode_pointer _recalloc wcscpy_s wcscat_s malloc memcpy_s ??_U@YAPAXI@Z free ??2@YAPAXI@Z _purecall wcsncpy_s ??_V@YAXPAX@Z ??3@YAXPAX@Z _decode_pointer _CxxThrowException

user32

UnregisterClassA CharNextW

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegQueryInfoKeyW RegQueryValueExW

oleaut32

SysAllocString SysFreeString SysAllocStringLen SysStringLen VarUI4FromStr LoadTypeLi LoadRegTypeLi

ole32

CoTaskMemRealloc StringFromGUID2 CoTaskMemFree CoCreateInstance CoTaskMemAlloc

shlwapi

StrDupW

$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll

SHA256 7d5e33d5b52f33c807c8c00273a2ade316de42012d7b915988731440194a6bd3
MD5 9e44dec6dec0a8c055a6a48d3ee29052
SHA1 7143370f696522feb81fe920798d5792b763a561
SHA512 94c20ac41e1e9a41d02361a8273b9c86167520f0eabb545dd7e174d2d0f53576ce374f5cd34029bb1f13c28d5cde92e406b0708d2e8ace73956749e1b8970719
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll

SHA256 dbc470b89daeb73f6809b4df70fc0078d14fc8bc6b77a07ba479f93fa72afee8
MD5 d98672a1094da398dd2caad207d4d188
SHA1 a510b3394bb8f5bd2bff086dd5a874a9af762e77
SHA512 978af83abb1dfcd78e4a1074d15eeeb1322fd1261c4071623b3c6a0d05a470ab85afeaaf7eb244c3ce106875e23f5c0487daa1d523460a8f8283d0a1b5f08279
SSDEEP 384:4WswcEWTVjEBNRTDJp6Np1Od8zUXt5tqdPJbUOwjAw7j1/Og:8lVqTDJp+p1OaYt5tmbUOwj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/mode/Thumbs.db/intern/PermCalc.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 57f248daa64d83c215189a3d38b9692f93125273ee046328febe33e69df01ded
MD5 c2efc9fcbbf2d6952110fea17841b71e
SHA1 4860494e79e88beacb0155584056699adb073f44
SHA512 5aa7033b6b9de91c309554b354d47d63c08d15d4d5ebe4ac6e98e059873c74149c869dea731a2754ca31dee526f27221cd210555693e5f6886cc26d271f39ae0
SSDEEP 384:xL8f6BoGrFTth3SAUnZV7OKAyXSKglWYbW:98iBoGxtSHqKgB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

PermCalc.pdb

$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll

IMPHASH 0c089433cc11d187c270039002fb20c3
SHA256 fcba2ff7bce5ba6c0a5188cfde82009c7acd6b14cb14ce390ab5a49773a425b4
MD5 6db03aa5dfe458e7a4e21d9688d3dcd6
SHA1 256e539c011697a8983c8a609e21cdedd4d59ecc
SHA512 0a5e16a993b3c2afcc8326607046ca509d2ac63682f99a149cd539e474ed6062f54b5c6b02bb8272c271ca0bccb48c08b75d18cb4ec5350d99ec885e25de8ecd
SSDEEP 768:r5Eiu+UuJwO3YkHr05FLsHNqW/hks6qrJ/Ejv7Mbk6huUc9zhX:fuDuyO3YiIAHNqW/ms6qrJEv7Mbk5UcP
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

14296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\binaries.x86ret\bin\i386\bbt\opt\bin\i386\vsa7director.pdb

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

kernel32

LoadLibraryA LocalAlloc GetProcAddress InitializeCriticalSection DeleteCriticalSection FreeLibrary MultiByteToWideChar SizeofResource LoadResource GetLastError InterlockedDecrement InterlockedIncrement RaiseException GetTickCount DisableThreadLibraryCalls InterlockedExchange Sleep InterlockedCompareExchange QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetLocaleInfoA GetThreadLocale GetVersionExA

msvcr80

_except_handler4_common __clean_type_info_names_internal _onexit _lock __dllonexit _unlock __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null _malloc_crt _encode_pointer _purecall ??_V@YAXPAX@Z _recalloc ??3@YAXPAX@Z free ??2@YAPAXI@Z memcpy_s malloc wcsncpy_s _crt_debugger_hook memset strncpy

ole32

CoTaskMemRealloc CoCreateInstance CoRegisterMessageFilter CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString SysAllocString VariantClear VariantInit SetErrorInfo GetErrorInfo VarUI4FromStr

oledlg

OleUIBusyW

user32

TranslateMessage DispatchMessageA UnregisterClassA IsWindowUnicode GetWindowThreadProcessId GetMessageA

$TEMP/mode/Thumbs.db/intern/systemuserleadassignment.xml

SHA256 622ba17c729a468ecb86ed8422c367d15d0e64b51eeab80743c9f2b021e5b8a3
MD5 2361a1e9e6e0651a7da26d890f2e1d14
SHA1 1f5b7f181ed548b6638ba080eb80dcf60f7fb2c5
SHA512 15bb70b1591dd671071508da99acc58f4c73f939014dd5298cf337780ef35e20f934c8c8b3dcbb0c846668cfa8da129290c0e8cde3a0d166760423f817d30734
SSDEEP 192:sYSodBUwBUsPU8TvUA9PUwU8UzwsCOQTXs5ashCTXs4sLql:sTodBUwBUsPU8TvUA9PUwU8UzwsCOQTB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer