92843471434ce36f688d7e80fc532df2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
92843471434ce36f688d7e80fc532df2_JaffaCakes118
Size 666KB
Sample240603-vfbqhsch51
SHA256 128c7acb8d2cb842afcbe6bd73e951be139f1d9c760bfa81c08625ee4fcf5518
MD5 92843471434ce36f688d7e80fc532df2
SHA1 689b574d33691b2e10a54ed08815935b202bf43f
SHA512 e8f286b2c7a0c7a798c608ab5e07772f9dc66e73cdea3b87e49e01de85f725535e4dc5abcefde8eddc6a140a0f03e720c714aa0029d90f34e6a91e17126aa851
SSDEEP 12288:4Ew0uF7YCUzFZiJ7TkZwYcwXUT6gQhEZj9k/IXu0JRGCM:4f76zq7gZZcwXRDhEo2ukECM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
92843471434ce36f688d7e80fc532df2_JaffaCakes118
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_lib.dll
unpack001/$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_vlib.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsisunz.dll

File Explorer

92843471434ce36f688d7e80fc532df2_JaffaCakes118

.exe 666KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_lib.dll

.dll 708KB
$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_vlib.dll

.dll 295KB
$PLUGINSDIR/inetc.dll

.dll 31KB
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

198KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsisunz.dll

.dll 88KB

92843471434ce36f688d7e80fc532df2_JaffaCakes118

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 128c7acb8d2cb842afcbe6bd73e951be139f1d9c760bfa81c08625ee4fcf5518
MD5 92843471434ce36f688d7e80fc532df2
SHA1 689b574d33691b2e10a54ed08815935b202bf43f
SHA512 e8f286b2c7a0c7a798c608ab5e07772f9dc66e73cdea3b87e49e01de85f725535e4dc5abcefde8eddc6a140a0f03e720c714aa0029d90f34e6a91e17126aa851
SSDEEP 12288:4Ew0uF7YCUzFZiJ7TkZwYcwXUT6gQhEZj9k/IXu0JRGCM:4f76zq7gZZcwXRDhEo2ukECM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/LangDLL.dll

IMPHASH e981c0ab92cb1f191bb5e23392e14796
SHA256 47b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
MD5 a1cd3f159ef78d9ace162f067b544fd9
SHA1 72671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA512 ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
SSDEEP 48:apTVWFeApYx2lxaKe3yfeEIWCGWNpBWLGGrx3pMt4z8mtJ7HofYZVSLa:RFG0xaKkyfjIWTW7BYrhSbmtJ7/V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_lib.dll

IMPHASH 48aba9a51f5ab59d086fd2fd3ebd0d4e
SHA256 dcf08a1cc39947e88969b717254f1dcb8b9f9787b3f43e0bfeb06cab39f3dc71
MD5 a739eb5eaa5cf8c8234450bc7d67fc37
SHA1 f45ba077c726d37ac7a8ee878bd0902d24dfe1ba
SHA512 5e3c3a45c40bd1d6f8e2700b640339ef428a3ae22ee3366ef6760acd01c1738f7987da9db1587445df12508122ef04c4f26d23bb5eb1aad83bbaed3fdee607c5
SSDEEP 12288:IiqgOcsDRSOSwADny14g7UFPb6CmW2KBrBMOd/13bYSBAVOvgiJns5QSkWKwwBLj:IiycstSpDLaYFP+iPBA0oiJniQSUxmDW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

417374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetOpenA InternetSetOptionW InternetCanonicalizeUrlA InternetCloseHandle

kernel32

GetLastError GetProcAddress GetVersionExA ExpandEnvironmentStringsA WideCharToMultiByte MultiByteToWideChar WaitForSingleObject CreateProcessA CloseHandle LocalFree LoadLibraryW CreateFileW GetTempPathW GetCurrentThreadId GetCurrentProcessId InterlockedIncrement InterlockedDecrement lstrlenW GetSystemDefaultUILanguage SystemTimeToFileTime GetTickCount InitializeCriticalSectionAndSpinCount Sleep LeaveCriticalSection GetFileAttributesW CreateDirectoryA SetCurrentDirectoryA CopyFileA EnterCriticalSection CreateMutexA GetCurrentDirectoryA GetUserDefaultUILanguage ReleaseMutex GetSystemTime DeleteFileA CreateThread SetFilePointer CreateDirectoryW SetFileTime GetModuleHandleW ReadFile GetCurrentDirectoryW LocalFileTimeToFileTime GetTempFileNameA GetLocalTime FileTimeToSystemTime GetFileInformationByHandle lstrlenA GetLocaleInfoW CreateFileA GetFullPathNameA SetStdHandle QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP ExitProcess HeapDestroy HeapCreate IsProcessorFeaturePresent GetStartupInfoW SetHandleCount GetCurrentProcess GetTempPathA FindNextFileW WriteFile GetModuleFileNameA GetModuleFileNameW GetFileAttributesA FindFirstFileW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CompareStringW GetCPInfo LCMapStringW FindFirstFileExA WriteConsoleW SetEnvironmentVariableA GetDriveTypeW SetEndOfFile InterlockedCompareExchange GetProcessHeap SetLastError FormatMessageA LoadLibraryA GetDriveTypeA FindClose FileTimeToLocalFileTime ExitThread RaiseException RtlUnwind GetCommandLineA HeapAlloc GetSystemTimeAsFileTime HeapReAlloc HeapFree InterlockedExchange DecodePointer EncodePointer GetStdHandle GetFileType WaitForMultipleObjects PeekNamedPipe SleepEx InitializeCriticalSection DeleteCriticalSection FreeLibrary VerSetConditionMask VerifyVersionInfoA

user32

UpdateWindow MessageBoxA GetWindowRect ShowWindow MapWindowPoints MoveWindow SetCursor RemovePropW GetParent SetTimer SetFocus DestroyWindow wsprintfW LoadCursorW SetPropW SendMessageW GetPropW CallWindowProcW GetClientRect RegisterClassExW GetWindowLongW BringWindowToTop DefWindowProcW CreateWindowExW SetWindowLongW

gdi32

CreateFontIndirectW DeleteObject GetObjectW SetTextColor

advapi32

CryptGetHashParam CryptReleaseContext CryptHashData CryptAcquireContextA CryptCreateHash RegOpenKeyExW RegCloseKey RegEnumValueA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA CryptDestroyHash

shell32

ShellExecuteA FindExecutableA

ole32

OleCreate OleUninitialize OleInitialize OleSetContainedObject

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

ws2_32

bind accept listen ioctlsocket gethostname WSAStartup WSASetLastError __WSAFDIsSet WSAGetLastError select recv send WSAIoctl setsockopt getsockname ntohs WSACleanup htons getsockopt getpeername closesocket socket connect freeaddrinfo getaddrinfo sendto recvfrom

wldap32

ord33 ord200 ord60 ord35 ord32 ord30 ord301 ord27 ord26 ord50 ord41 ord46 ord22 ord211 ord143 ord79

normaliz

IdnToAscii

shlwapi

PathFindFileNameW PathRemoveFileSpecW

__03251b778f2f4bc599d5e984149876d1 __0bb74cb3f530478fb710b34b5a21cc5c __0fa445e61b3341d5a0bf0fc41f9342f9 __18e0fadfda8441b1b475c8637d51a1a8 __1a559391734d48a08433037fd036e9f8 __24a9ff23b4084583bf743f904d885349 __252f85ab52204a678bf48680f2a5dbbc __29132d7e401349caa03289bf8e6236b6 __2d2a62ca65f44fe3a6cffc3f5a863cb9 __2d2f380873d2489ba9f3233e75cefa72 __2dbca6055ed046fc86c57a56dbd04847 __30c6f9292f524408a310b85d7665e5c5 __328316fbaa8144a699ccd50238d83894 __453c5b1d41d14168b99d4b1bbee8cead __4a39f2256d9b413499b39847ebfb7a18 __4a78a8236bd544f2a60562cf904b87f9 __670d15187b6949f3b8f5a3b446382146 __7ac24bed20fe4fc1a2a19c763d103b9a __7c5b864b695a46cbb4083a964220de89 __80826000f44040f4aab3cd636c8d9252 __8451d588b8aa4067a97c340c0be11ecf __88609743696c456ba79c7c3f241e4c5b __89a7305d51eb4415b74efa05daae86ba __8ca537a3c36c4da6a8c0298204c3cc2d __8e46020e12104850a097bb3e158b0b41 __8fc9a57d29784b589ad33f660f8565dc __97f1336a65004612b80521e2b942891c __9a966b705eb248728d55a80dc227ae4f __9bdfd327e71549fd8b2dc43a4ee0f201 __9bf738f4d7bf4dde867b3bf299649d50 __9c95e4f767d44f20aafd20c4e883dbbe __b80c8f945f154bd280d4ba7de025291b __b92f0df1cbf647d98b921eedf2fca82f __b9f9d30633424cb19f275943c51eba43 __bdb80c2e8d72464dafbb741072ef2710 __bf6444bcebb74618bf86757fa7111b6b __c226dc3ddd6e4b839c0a7e3ce8ec9425 __db5d6faf4e2d42a084e5d973b06fe02f __e449cf78c412439aad1327cefad863b3 __ea8640c5926445e9a009f56b3951c44b __ec5919db96d74800a579bd1505c6c485 __ec7a0a8d8a7547be89a92c1f08db8f04 __ef384adf68d547b5a715762f5c7c8ea5 __f09c49d722ca49999d30556ee7bc9288 __f26e0c1ad5a549ddbeef0e606f223235 __f498cd254e104e188f4c6c0c4feb9923 __f569e8c8687d47d58726c470d9e5970e __f915b872b0884edcb42f223a78f06012 __facb3ed6607e4b298d36e164e9c04737

$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_vlib.dll

IMPHASH a67e8287f0bfdd5104f7323f0331a6a0
SHA256 9dc8817d4f9a3c2a843ddabe8acfb6fee7897bf49dbe6e6ba3c7b1e56552ad85
MD5 7105dd0491f34f257cca14e3de599fd3
SHA1 e47c9d036197ef570d97fe51e2276b37b2b01cc1
SHA512 fefaa1b06971576c9ec4e122541f8c97cf3dcc6804626e95432bba2288528e40c24444dda6aad0d5146bba67bd64732427399742eecb79c021ed38087b63931b
SSDEEP 3072:5IuZetOHA8FlkEzsnDp4kEjDxjU4L1qEqwac8frFhz0XYfFiP6ss3n6xQDy1tjY7:513mykEj1j/qED8tfF4dgkEVJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139914

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\popajar3\SDKObfuscation\Obfuscator\ValidationScriptLibrary\ValidationScriptLibrary.pdb

shlwapi

PathFindFileNameW

kernel32

GetModuleFileNameW CreateFileW GetTempPathW GetLastError GetProcAddress GetCurrentThreadId CloseHandle GetCurrentProcessId FindFirstFileW GetFileAttributesA GetTempFileNameA GetModuleFileNameA FindNextFileW LoadLibraryW GetModuleHandleW GetVersionExA ExpandEnvironmentStringsA WideCharToMultiByte MultiByteToWideChar GetComputerNameW GetVersionExW InterlockedCompareExchange WriteFile Sleep GetLocalTime GetStringTypeW GetCurrentProcess SetStdHandle WriteConsoleW CreateFileA SetEndOfFile GetTempPathA InterlockedExchange IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetLocaleInfoW GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer GetProcessHeap InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapReAlloc HeapAlloc GetCommandLineA RaiseException RtlUnwind LCMapStringW GetCPInfo CompareStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate HeapDestroy SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW ExitProcess ReadFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetACP

user32

wsprintfW

advapi32

RegEnumValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

shell32

FindExecutableA ShellExecuteA

ole32

CoInitialize CoInitializeSecurity CoCreateInstance CoSetProxyBlanket

oleaut32

SysFreeString VariantClear SysAllocString

$PLUGINSDIR/inetc.dll

IMPHASH 86cdacc6fa5e3ff4938d358350751516
SHA256 9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2
MD5 5da9df435ff20853a2c45026e7681cef
SHA1 39b1d70a7a03e7c791cb21a53d82fd949706a4b4
SHA512 4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f
SSDEEP 768:FRci+9MscTJMR2+d8heiwhSruaFajMGbJDVVG08:Fg9sTJv+AVwhl25ci
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcstol _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul wcsstr wcschr memset _chkesp

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW CreateFileW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersW HttpOpenRequestW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisunz.dll

IMPHASH 1b37562e8104552588ae892e11fcdff2
SHA256 c31b590cba443de87f0f4a81712f0883ac3b506f3868759d918d9a81f84ea922
MD5 bd97d86d8bd07ebdc8ec662a3f31dfd5
SHA1 5e2b3a1af5ee53ab6d1d6c2cb8127add39ee7e82
SHA512 4575d1ea0d1b2f74df74cad94eae7fdf31c513e5dc6d945e81e0873b99f94a5d81b1c385c71ab79a19e5bb6c00fc5fffec7a3bbfd60ad7de312cbb53d8bcce9a
SSDEEP 1536:uPmnCuZs9reYWvAHvXhxQdJeY3tMCo9NTJwd6aimHr5jr5T51NT:uPmnCuZs9KoPX6rA9Nl2Rrt51h
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25724

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSection CreateDirectoryW lstrcpyW GetVersion lstrlenW lstrcatW LeaveCriticalSection EnterCriticalSection WideCharToMultiByte MultiByteToWideChar lstrcpynW lstrcmpiW lstrcmpW GlobalFree GlobalAlloc HeapSize LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree CloseHandle WriteFile GetConsoleCP GetConsoleMode RtlUnwind ReadFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapAlloc VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW InitializeCriticalSectionAndSpinCount CreateFileA GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA SetEndOfFile GetProcessHeap GetLocaleInfoA

user32

MessageBoxW CharPrevW PeekMessageW TranslateMessage DispatchMessageW FindWindowExW GetDlgItem SendMessageW wsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

92843471434ce36f688d7e80fc532df2_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_lib.dll

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

wldap32

normaliz

shlwapi

generic

$PLUGINSDIR/__ea8640c5926445e9a009f56b3951c44b_vlib.dll

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsisunz.dll

kernel32

user32

generic