ad795aebd3065a1b1afd33df18590758_JaffaCakes118

resource
ad795aebd3065a1b1afd33df18590758_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/NsResize.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH e3e1ba523cf61b826993834dca364e87
SHA256 56a479280a54fad7a582c3ff8623c885210cf49432a29592c91f2bd95bf6ac3d
MD5 ad795aebd3065a1b1afd33df18590758
SHA1 de6fde3aafbb8da8bf6de2ccf4c3507e71b2cd8f
SHA512 a6c12d0572cc548b7dfd1e792887ecbac8c98d88e5717ae9364eaa43b751ab49f4c8f9480536fc6c87dca9802a119d56240aa0d68276f16666e20d2aec4923a5
SSDEEP 6144:Kn/L+GOmXqA8VtR4ZhSTpkdpNRauPmuRfV/A/ETrSQ1tj:0zOmXqActRYhgk5Ra6mkflTrSq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFullPathNameA MoveFileA SearchPathA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA GetShortPathNameA SetCurrentDirectoryA Sleep GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetModuleHandleA GetTickCount CloseHandle lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc WaitForSingleObject GetExitCodeProcess CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA SetErrorMode GlobalFree LoadLibraryA GetCommandLineA MulDiv DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer WriteFile GetPrivateProfileStringA WritePrivateProfileStringA MultiByteToWideChar LoadLibraryExA FreeLibrary

user32

EndDialog ScreenToClient GetWindowRect RegisterClassA EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard CreateWindowExA SystemParametersInfoA GetDlgItem TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA LoadImageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow EmptyClipboard SetClipboardData OpenClipboard FillRect DrawTextA EndPaint wsprintfA SetTimer

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ord17 ImageList_Destroy ImageList_AddMasked

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Adobe-Korea1-1

SHA256 192a8cebb3ca934fdb5ed0f191166d6e5eed7e2a393f5b2b4bc311e5fe3c6972
MD5 b49b9922507dea3e5b617f96b7bff848
SHA1 f13f59963d966e7524b69e3f1b292bfe03805e91
SHA512 1d94a058b889f399575e3a109fab8c43454cf6556d4947fa5d0dd43f91d2e2b86c6ef29b0cc3b199294b2100598007dd07d27a68864df8e8de0781ba93d91091
SSDEEP 96:QJSM2OMSrYJQrYJLWl/3gF9M+uy9U3WqZlDZE7wOoQfqt5K/:QJ+SrsQrsil/3gU+uS7Kvcvk4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

NsResize.dll

IMPHASH e07e00e45407ff0dd6abc9eaa981fa7b
SHA256 1734bceb77dab6739b80575fd7ee87c437327d8eb147339e1d93b7d3235c5394
MD5 d53bd2d5591a78ea15b3bd59e2652bd6
SHA1 40968bcae13ee63469d241200679b25dfa5fdd4c
SHA512 c07bbab95251f16ac4b1c03e0324792b35badd111cced2e5c8e0de467226e572edfe5ca6e528c3494664f2569774f6a422806f54883cc2ef3726e21f4a011f5b
SSDEEP 192:CQRZmWPG1Cg3ROenIw77QXyDWscAIJJgjZZZZIIqIqIAY:CQRZmH1C0tIw7QyW8sWZZZZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

article.appendix.title.properties.xml

SHA256 4ba4637bffa741ba5619c3de97b6c209b5a9deb330385efc7a588492a98b7b45
MD5 adb1a285a2b926f98c062fbb74e1e992
SHA1 1f9799a61072673042a1a3da0fdf3fa93cf10f90
SHA512 aa65628e34601645dfcdcb1f5f0347ae84555bd1a99432d4c25a50044dae932385bfa1f50551f6577d184de684f9264743facb53f4aa2e46bdfeff5c85bc6bd7
MD5 SHA1 SHA512

NSIS installer

installer

btn-next-static.png

SHA256 35d36d6619e249e8bf4838098fd1770c78617e3019162aaca092f8fa37c82dcb
MD5 20418349e7f8244ea53bc174b2ff9576
SHA1 edb9087b6d85247ea0cad0060f540b0f890a80e1
SHA512 b12946ca17bb23403e106d561ae42d15695efde73eb4efb4099b57824c7ba0d2e331850022405f1d5da9502b568a217c06f259600cbbacc0d1c2b7210b31081f
MD5 SHA1 SHA512

NSIS installer

installer

teasel.rtz

SHA256 944d5c5d262a5c20648ff238fca8cf452b4f32ecb928ed61a0d59cd1c30e46cf
MD5 a1a913b5f1a8521dac138a3d44dc0e60
SHA1 1853cbee899fcb818651201122e57adb2fbee5c3
SHA512 1deea16cf842c998693b7cadecc7b6212cc3dc16cfd5c7e38e288ef5deba45479a2108fab64f975419ad65896a8ac506fcc55f5822d41b03f95d8ca7be2515ba
SSDEEP 3072:D0jhZfrwx1VjhWkhJGPnrkr7vIo1w0nM86ItUdTdjMXYh2xDDe/U:QhZfYjh3GPrkrLIo286vVdjIx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

usableness.hus

SHA256 28a614e4e0d8477b7624238a7abbb592b7b9fc9492851fe1e044697474fb476a
MD5 9f9772ed0c8e66ec2c94a5547843e402
SHA1 b20b17e20d0c0f60c1ace3931be17ee951fa3aa2
SHA512 784b584f3e4fd45d3a58a29da8c91743082dffa906af32ae1c653d1f01018f0a3d72ee085ba89709da3ce461b921885bc572514ef10dbb823f590343d7b730df
MD5 SHA1 SHA512

NSIS installer

installer