963469fc2a770ab2128bf73b4b8e3a5d_JaffaCakes118

resource
963469fc2a770ab2128bf73b4b8e3a5d_JaffaCakes118
unpack001/$1/$OUTDIR/sftp_plugin/tc_sftp_uninstaller.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 6d50622e39a48dc8f46fdb91afe7af75939f1259243652e1c52b4217abf3ae1a
MD5 963469fc2a770ab2128bf73b4b8e3a5d
SHA1 d662dfa11e8aea62e70d0557e6731b3ea6582875
SHA512 67d4068af18c25b14d4d66350696f656441d47ab21017a7f1621628ea937acf42caf96dc85122fd9168f83fa88ecb25f97ed50c176aeae7f3eba4eab20564ae4
SSDEEP 6144:wW+7+eMX3XA7enW055Uqj61NSPHomhwYqtK:wR0XAQB55UqjtPHdmDtK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$1/$OUTDIR/sftp_plugin/tc_sftp_uninstaller.exe

IMPHASH e221f4f7d36469d53810a4b5f9fc8966
SHA256 36b1104781e2c77a1e76593e697ac99621f27db3bfd5c282f7ae3579bf510a5b
MD5 e04b1bbeaff6221daf4d4ae0ed7fd00c
SHA1 cbe6a9e349a6711dc9e040e15ec32345c1bb7aee
SHA512 2f8523b1fd5bed682dc841292a5523eabbd49fea71b1e088a5080c375ed8e67b22e95e60129516d96bd720845a1c27fd37fd993d1cadfd81296176f683066334
SSDEEP 768:j9qjtOoh/pZbvc+HX+fFXSJA/mIj6qkzry8F9zGPVzISJRnHzioSe4bU/iXAB8+O:j0joUxZbE+HOI66qkryz9zIMipGVW3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW SetFileTime CloseHandle GetShortPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError GetFullPathNameW CreateDirectoryW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW SetFileAttributesW ExpandEnvironmentStringsW SetErrorMode LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc LoadLibraryExW GetExitCodeProcess FreeLibrary WritePrivateProfileStringW GetCommandLineW GetTempPathW GetPrivateProfileStringW FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData wsprintfW CreateWindowExW SystemParametersInfoW AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage GetDC SetWindowLongW LoadImageW SendMessageTimeoutW FindWindowExW EmptyClipboard OpenClipboard TrackPopupMenu EndPaint ShowWindow GetDlgItem IsWindow SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InstallOptions.dll

IMPHASH b233fd95d297fbba0563f3f6eae042e0
SHA256 2a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
MD5 f8d9d9418e6e1827ed2b53dd930e48fb
SHA1 c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
SHA512 510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
SSDEEP 192:eMGGr8JZYGO9QQr5aQbf1QuQVOmDsjcdOISYKoTs11929WtshLAzuy:eMGu8Jy1ai5aZBptdYYKCs/Yos
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData GetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW EnableMenuItem DrawTextW GetSystemMenu MapWindowPoints OpenClipboard

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
MD5 3e6bf00b3ac976122f982ae2aadb1c51
SHA1 caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA512 1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
SSDEEP 192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

2611067143.html

SHA256 4faba6277b74fc4f8c3fb5810621d0efc7262435b0b737cb685c8a0db17d32ae
MD5 250d3404348dcab3d26c3f5d945b2817
SHA1 abe992ff2636ae70367a893cb289ef741b9850fb
SHA512 2e17e8f2f1fedb4f7583275d15bdb777a6e0b7900ef3f5d665b2e10696f021a3df9df1a2ad6df99c8c35c0639ba6604657cc07ff6977dfe53639694f88579795
SSDEEP 96:UQLHgGzwHhGoPxnxMLHkNLMcbtDALLPTBD:UQTgyXoZnxMTkdbqLLPVD
MD5 SHA1 SHA512 SSDEEP

FRM1678109908.jpg

SHA256 8dd4ad72017db4cc49f66c6937e79a2ef1fbaeea53ea4f7275d899da77f7a2cd
MD5 bb5a078b4acb7760190270674f850aaf
SHA1 80f825182ab9136ea469e2063e04abd7e9a3fe9e
SHA512 c57a3c3181a03c0c0ffbcffb5b4f390c77616dfbc5cff7ff0d869898978c1e423bd2e87e034283c452664675c78c217a89c97df83ba4d5360187556ee8661177
MD5 SHA1 SHA512

PzGuNVcm.ARJT

SHA256 4388738cb55f1619cbd592f182aa82776cbe4b5b0d53333649c37c476a1edecf
MD5 5d1515750e13182c82417ebbccacac45
SHA1 fda1b689e3597a910ed23c694e27053422c7b5ef
SHA512 7ef4b40f3225babd944eb976209c4e17e05fc9045bd28f6b39232f83f0e0f55e728f6cb813e5d6bab2e40c9355afe236dccff7f6ecb520db3b4bc2b408f9d026
SSDEEP 192:vYMMkP81gy8pr4GGMP+Pu9aYK7Sp2XuV3FW3KT1UE8nMM0wNFcFP6IWPNV0OL4fw:PMkP81gr4Jtu4m2sW3iZU90cCFP6IWDD
MD5 SHA1 SHA512 SSDEEP

aMV2H8tRMVnACQCA.TBX

SHA256 4487b1179b0cdd600421c33ad36f5c940fe41d629d9d8fe4fba5d1c8f4a5ce60
MD5 d50ae5ca7973fc792ed79df63324507a
SHA1 f9cd708a759f13f789e2a22caf90f71d7500f062
SHA512 af88ffe36d6326025f8a9d8bbc7a94a23e9ed760635fd1f776fff49a63a6ac9858dccb0d95470a631f63ff0b586acabfbf53608831a6bb8ba955dbefb40434cb
SSDEEP 3072:JtVSlfwmt1RkABIKr9bnB56ve9s0EiSFcd9oil6/ic4zWJ6VDxh0eb7ocHyWALw:JLMwwPk+r9b6xh1a9oiFc4zWgBxh0eP/
MD5 SHA1 SHA512 SSDEEP

confirmClose.gif

SHA256 325289617e9816a767d10d6086d4ac96623fb982ce32e904c06603ee25697e88
MD5 a91df967bdefac7407c9ce78f631ccb3
SHA1 efbba37103479ecc4803938181ad97dcb8a454bc
SHA512 90df149763b6b67e870220fdb2b533b96ea8a12c52b4370cc4cafdce2812312fcbde8b4cbd791b637382d31f395bd792f70b75dca9c249111860993ec216f2ef
MD5 SHA1 SHA512

contact-domains-org

SHA256 32ed6780f2a874cadda773883b48fc02ff96ce5903cd3eb961f0c7ccee63f7a7
MD5 cfaf6a3fcda0d70c054e1e027268823e
SHA1 ca5fafeb1c0b1c288a5ca854faf19781ae9c83a0
SHA512 8a9876222df0f0a459e851e9ce0af9d30956d82709491ef38f43bcbfd9a3e757a07fad82f2bd498131e2069b3d9ac300a7b2ba3773efa415de30853a70ae7688
SSDEEP 384:edrUmjq6fQiwyEB83O9gdvoOC5lh57aFKi6i0dqZNU/BJDEuWdZ:u0GDBQ83Lyl5VW6i0dqZNIBJDEH
MD5 SHA1 SHA512 SSDEEP

polyglot

home.js

SHA256 7efa0094b8a05b440cdc60468f5584caa1cebc61c76e1c59001c6986fec1e198
MD5 4aaa6aea7c106ede4e7174829e275743
SHA1 0a389da170d56e1152bf3807f6b168f8ec26649c
SHA512 109a06f67946650b4f45a90df9b422645050328ddd4be5a896da637f7c914edbc08380854c32e41b9595b9c13eb26de11e3bbdfa5feb27576a5d0bf3b6983bc1
MD5 SHA1 SHA512

home1099482986.html

SHA256 ba3bd12f3eb03698f919faf79c167f8318ca85a46e064a5fc0ca3ca5ce6f4f9f
MD5 4b4731c10f51e1ad8921dc9756041b80
SHA1 54022fa74774d658cb58611c3a6e59b7705b2ecb
SHA512 effdf8cba9b8222197b718cbdedf5cf01a9538b8085d2216824305ff66ca55fda04b3a367a02511c3bbf0a90dc448d4e59b94d0a395eb7d9ca79a9f150441561
SSDEEP 384:g/1ey5mfePOyPKTX2F7Yy87zGCCkdW/a4azlZaCPtnclXF0VW3sq7Bm:gtejePOyPKTX2BD44azHVwsq7Q
MD5 SHA1 SHA512 SSDEEP

home1259317828.html

SHA256 5dc34d66248d7054b364fae9ed97f5ec3da0fbf9a3fbabcff3cc286ea7c4f375
MD5 9e40a22a452816fd7d81aa9254e9fd40
SHA1 0c419830cf8cd6d9e7b5f4f2c64c1a87567e730b
SHA512 4b984b8d95a79751e3b4d093200cca68d82ca82df8f0b1653b2db5dda795a8da6dc1d0c9fd8362071de222fac44f21d72499293c7676b572d440046f033036ce
SSDEEP 384:Ws/1ey5mfePOyPKTX2FwYy87zGCCkdW/a4VzlZaCPtnclXFlVW3sq7Bm:dtejePOyPKTX2aD44VzqVwsq7Q
MD5 SHA1 SHA512 SSDEEP

index1449123078.html

SHA256 8ebb146e6e3e9741f2c889baed2e96afd23956b8e71a5fd1114c46769b8c9777
MD5 5f05fe70d58d5058c7b0997490bb449d
SHA1 13f38efe4f41f86e72726da215c9d62534148e00
SHA512 b5e1eb1df064bbb8dd204a269edeffb38131abe99cb3be987d757e74e1cf467cc70a003a64ae7b8c785f7b42fa2ef5819eddf7072a2ef257d5c22faebe73aa69
SSDEEP 192:klcdyhPpWsd4jd3hOWTxtkUGgYyRjz1JDC708:5wWsW533HpYyDJOj
MD5 SHA1 SHA512 SSDEEP

polyglot

Sharing

General

Malware Config

Signatures

File Explorer