ba1f62e61b604fa00a25ea9edf2326a0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ba1f62e61b604fa00a25ea9edf2326a0_JaffaCakes118
Size 312KB
Sample240617-3hcplashkn
SHA256 e9f59772a453d9aa212e6eee9cf789d2e59c73c99267612262942d576c5196b6
MD5 ba1f62e61b604fa00a25ea9edf2326a0
SHA1 0c62bdd9fc3a5eca53f82471b81a765a99ef494e
SHA512 0e6037ecbde3fb134b3a98c11a9fbed2c43480558633e305c5d2c20640ce3b7047ce93cacfabb1dd96f8bad37aeba1240cd297437564cccbf37ae080e1df4228
SSDEEP 6144:Me3z2O75+ZPPfnE2Qyn20Uqhj5lFBbRrQ/qQNof7R2TDtuVF575+ZPPfnE2Qyn2d:UOF+ZPPfnEUnxjvDbRrbRf7QBupF+ZPM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
ba1f62e61b604fa00a25ea9edf2326a0_JaffaCakes118
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/IpConfig.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/fct.dll
unpack002/$PLUGINSDIR/nsProcess.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

File Explorer

ba1f62e61b604fa00a25ea9edf2326a0_JaffaCakes118

.exe 312KB
$PLUGINSDIR/IpConfig.dll

.dll 114KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/UAC.dll

.dll 13KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
STool.dll

.dll 146KB
STool.exe

.exe 98KB
SToolHelper.dll

.dll 34KB
Uninstall.exe

.exe 107KB
$PLUGINSDIR/IpConfig.dll

.dll 114KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/fct.dll

.dll 4KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB

ba1f62e61b604fa00a25ea9edf2326a0_JaffaCakes118

SHA256 e9f59772a453d9aa212e6eee9cf789d2e59c73c99267612262942d576c5196b6
MD5 ba1f62e61b604fa00a25ea9edf2326a0
SHA1 0c62bdd9fc3a5eca53f82471b81a765a99ef494e
SHA512 0e6037ecbde3fb134b3a98c11a9fbed2c43480558633e305c5d2c20640ce3b7047ce93cacfabb1dd96f8bad37aeba1240cd297437564cccbf37ae080e1df4228
SSDEEP 6144:Me3z2O75+ZPPfnE2Qyn20Uqhj5lFBbRrQ/qQNof7R2TDtuVF575+ZPPfnE2Qyn2d:UOF+ZPPfnEUnxjvDbRrbRf7QBupF+ZPM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH a9988f98d52a3c7d16228f87844f85ea
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

kernel32

lstrcpynA InterlockedIncrement InterlockedDecrement GlobalAlloc MultiByteToWideChar GlobalFree lstrcpyA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement SysAllocStringLen VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

STool.dll

IMPHASH a0529b626f816a4a30b6ad6a496b430a
SHA256 955953bf3bb27b4ef069ff284940509ca3d323051692d109ac752b979d6579a5
MD5 f3040af2de1f905a2d7de9ec0bd77aa8
SHA1 e4059ed476f69f8fc191c2653325f561cc41cb4f
SHA512 936f58d742f5011e834ff74c0a15d6960a8db1e144468a6a49f49ce5d56ce229ca1a421018290459fe1e49fd3d296ef00130575289945264a09919a3f091aaba
SSDEEP 3072:g6qXuj9gWctJXYK9GftLEoetdBlDAnPx7reaFUE:yAiGftL5gXFAPUNE
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

75725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord6880 ord2864 ord1116 ord1176 ord1575 ord1168 ord1577 ord1182 ord1232 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord6143 ord6467 ord1131 ord2725 ord3953 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord815 ord4274 ord541 ord6883 ord2065 ord801 ord3726 ord5829 ord2827 ord861 ord940 ord6282 ord6283 ord924 ord1228 ord926 ord2764 ord6663 ord540 ord5683 ord4204 ord2763 ord4277 ord939 ord5572 ord5442 ord354 ord5186 ord1979 ord665 ord6877 ord4278 ord536 ord4129 ord2915 ord941 ord858 ord2818 ord2614 ord860 ord823 ord825 ord5710 ord537 ord1601 ord539 ord535 ord800 ord342

msvcrt

??1type_info@@UAE@XZ _CxxThrowException __CxxFrameHandler memset memcpy _mbscmp memcmp strlen _initterm malloc _mbsnbcat strcat _mbsnbcpy _mbschr strcpy _except_handler3 _adjust_fdiv free wcslen ?terminate@@YAXXZ _onexit __dllonexit wcscpy realloc _purecall _lrotl _local_unwind2 _mbsicmp atoi strtoul sprintf sscanf

kernel32

GetModuleHandleA GetLastError WaitForSingleObject CreateToolhelp32Snapshot Process32First Process32Next CreateThread LoadLibraryA GetProcAddress FreeLibrary CloseHandle GetModuleFileNameA GetShortPathNameA lstrcpyA lstrcatA CreateDirectoryA GetFileAttributesA GetCurrentProcess FlushInstructionCache lstrlenW lstrcmpA InterlockedDecrement InterlockedIncrement GlobalAlloc GlobalLock GlobalUnlock lstrlenA MultiByteToWideChar EnterCriticalSection LeaveCriticalSection GetCurrentThreadId LockResource LoadResource SizeofResource FindResourceA GlobalFree WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte HeapDestroy GetVersionExA GetVersion Sleep TerminateThread GlobalHandle LocalFree LocalAlloc

user32

GetClassInfoA SetWindowLongW RemovePropA ShowWindow CharNextA GetMessageA PeekMessageA DispatchMessageA IsWindowVisible ScreenToClient PtInRect GetWindowRect SetPropA SetTimer SetParent MoveWindow SendMessageTimeoutA LoadCursorA GetClassInfoExA RegisterWindowMessageA GetPropA GetWindow SetWindowLongA SetWindowTextA GetWindowTextA GetWindowTextLengthA GetWindowLongA UnhookWindowsHookEx GetSysColor KillTimer CreateDialogIndirectParamA CreateWindowExA wsprintfA GetDlgItem SendMessageA InvalidateRgn InvalidateRect SetCapture ReleaseCapture CreateAcceleratorTableA GetDesktopWindow GetParent GetClassNameA RedrawWindow SetWindowPos BeginPaint SetFocus GetFocus ReleaseDC GetDC CallWindowProcA EndPaint FillRect GetClientRect SetWindowsHookExA IsChild DestroyWindow IsWindow CallNextHookEx DefWindowProcA TranslateMessage RegisterClassExA

gdi32

SelectObject BitBlt DeleteDC CreateCompatibleDC CreateCompatibleBitmap GetStockObject GetObjectA CreateSolidBrush DeleteObject GetDeviceCaps

advapi32

RegCreateKeyA RegOpenKeyA RegQueryValueExA RegSetValueExA RegDeleteValueA RegEnumKeyExA RegCreateKeyExA RegQueryInfoKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegCloseKey

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromString CLSIDFromProgID OleUninitialize OleInitialize CreateStreamOnHGlobal OleLockRunning

olepro32

ord253

oleaut32

SysFreeString SysAllocString VariantClear DispCallFunc SysAllocStringLen LoadRegTypeLi VarUI4FromStr LoadTypeLi RegisterTypeLi VariantInit SysStringLen

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

wininet

InternetOpenA InternetOpenUrlA HttpQueryInfoA InternetReadFile InternetCloseHandle

shlwapi

PathCombineA SHDeleteKeyA

shfolder

SHGetFolderPathA

Name

.text

Size

76KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

STool_DA

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

STool.exe

IMPHASH 83513bc9a6665139fc3eb024425eda94
SHA256 370fd825c69629032b8d0587aa4562857f122644473c7ba93891e5477698cab8
MD5 0ffcbe714433e2aef9a71c7277773afc
SHA1 549d9173569b5036274fa3ef0f38ac48391af5fa
SHA512 9504b9346bb183ff5b72d86ca60daba5d4ae008d0657e23d1d0fb32db41d6cfcb83eb8b516f0af7e0e317cc23d90c6038c4800dabd1acfb365ead973c3876726
SSDEEP 1536:+CGeEtajBwtlztQyL/6RvptHT9SHxrMnnPx72Ik:1QNtl5h/6RvpKHWnPx72Ik
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

54508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord5829 ord3726 ord6883 ord6143 ord2818 ord941 ord665 ord1979 ord5442 ord5186 ord354 ord2614 ord4277 ord4129 ord2764 ord4278 ord6663 ord924 ord926 ord6877 ord6055 ord1776 ord5290 ord3402 ord567 ord2135 ord818 ord2688 ord6197 ord5710 ord539 ord1799 ord4226 ord2486 ord614 ord290 ord1601 ord1113 ord3237 ord1114 ord6283 ord6282 ord861 ord2086 ord860 ord1228 ord2763 ord5683 ord5572 ord2915 ord536 ord3870 ord4204 ord940 ord2827 ord2065 ord1949 ord4034 ord537 ord535 ord939 ord4299 ord6453 ord6215 ord470 ord755 ord2379 ord4710 ord858 ord4234 ord324 ord2623 ord3597 ord4425 ord4627 ord5277 ord2124 ord1576 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4998 ord4853 ord4376 ord5265 ord800 ord540 ord801 ord541 ord823 ord6394 ord6383 ord5440 ord5450 ord2107 ord1134 ord2621 ord1168 ord1232 ord2514 ord2841 ord641 ord3663 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord2864 ord4673

msvcrt

__p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __set_app_type _acmdln exit _XcptFilter _exit _setmbcp __getmainargs _controlfp __CxxFrameHandler free malloc _mbscmp _mbsicmp _mbsnbcat _mbsnbcpy _mbschr atol _except_handler3 _local_unwind2 atoi strtoul sprintf sscanf wcslen __dllonexit _onexit

kernel32

MultiByteToWideChar CreateDirectoryA WinExec InterlockedDecrement InterlockedIncrement WaitForSingleObject TerminateThread lstrlenA lstrcmpA LoadLibraryA GetModuleFileNameA Sleep DeleteFileA GetFileAttributesA GetProcAddress FreeLibrary GetVersion GetVersionExA CreateMutexA GetLastError CloseHandle WideCharToMultiByte GetStartupInfoA GetTempPathA CreateProcessA WriteFile CreateFileA Process32Next CreateThread Process32First CreateToolhelp32Snapshot GetModuleHandleA GetLocalTime

user32

IsWindowVisible IsWindowEnabled GetWindow KillTimer EnumWindows UnhookWindowsHookEx IsIconic SendMessageA GetSystemMetrics PostMessageA GetWindowTextA GetWindowRect SetPropA GetPropA wsprintfA SendMessageTimeoutA GetClassInfoA RegisterWindowMessageA GetClassNameA GetParent EnableWindow IsWindow GetClientRect DrawIcon SetTimer RemovePropA SetParent

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyA RegCreateKeyA RegCloseKey

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA

ole32

CoInitialize CoUninitialize

oleaut32

SysAllocString VariantClear SysFreeString

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

wininet

InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetCloseHandle InternetCanonicalizeUrlA

shlwapi

PathCombineA PathFindFileNameA SHDeleteKeyA

shfolder

SHGetFolderPathA

SToolHelper.dll

IMPHASH 98d8d9210d0cc0fee14d09c3b64a6b0c
SHA256 4662131057507b16eeafd8b4c9b46cb7fc42474829dba277fffd2f427daf41c3
MD5 d4f5d39a83ef5569d8caf61777273499
SHA1 911d9bd3450c0fc7b2fd14883ecafb32183ef963
SHA512 245fda06c1f1b7ca21b0653efed09d19cd9da4dde737acd87bd2e9457db8948aa07132583d8d209a11e51b9dfb54455bbddf14728ba0f4b779bd332ee8e275f3
SSDEEP 192:KMjYYFef+PuNX16X52AMG3KqWzx86bEc/nTun8o8vAw0Fcou7+wse+PjPBD2/SbY:d/efxNF6p2zqWH4c/nan8OdfuSPL0Ie
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=nbiz Ltd.,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

41:69:b2:18:a1:22:41:2e:6d:5c:c3:23:0c:1e:c9:c2

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 25, 2013 - Apr 26, 2015

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

Major OS version

Entry point

6484

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord3953 ord2982 ord3147 ord3259 ord4465 ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord5714 ord1176 ord1575 ord1168 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord6467 ord1578 ord600 ord826 ord269 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord815 ord823 ord825 ord561 ord1116

msvcrt

__CxxFrameHandler free malloc ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv

kernel32

LoadLibraryA GetProcAddress lstrcmpA LocalFree LocalAlloc

user32

TranslateMessage PeekMessageA GetMessageA SetWindowsHookExA DispatchMessageA GetParent GetClassNameA CallWindowProcA GetWindowRect IsWindowVisible GetPropA IsWindow GetWindowThreadProcessId SendMessageA GetWindow RegisterWindowMessageA CallNextHookEx SetWindowLongA

Name

.text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ADCDATA

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

968B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Uninstall.exe

SHA256 dad0b8686c4270ed82e664f04ead27bea155e1856c2e058f955e7b3662a535f3
MD5 991b9fea093498f38fba61064ffb92d2
SHA1 c6f6eb487c39c055b408d0948cae1980a9c58769
SHA512 fff0eb2f55d8cf9c89674720eba9e160a94b0ab8ba3cff3ddc3d4878f1753559d099f046b211466b8383ddeaffcab2e7f85c4329ed9d49cf0737833376930be2
SSDEEP 3072:MgXdZt9P0DUKxdnr76SB+ZP55fnPcHI1QHSnja05Ko:Me3R2r75+ZPPfnE2Qyn20Uo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH a9988f98d52a3c7d16228f87844f85ea
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

kernel32

user32

wsprintfA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement SysAllocStringLen VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/fct.dll

IMPHASH ea6c66dd8fdf3fe3fb04ddbc357acc4c
SHA256 010f5e0c69b4a630b08b2551e03d8044a33350f151848dcf50953407012fab29
MD5 e3f3809f51c7982d96aaf9c090f7d176
SHA1 7494daa8000c0b31c58d94edc509232569a4606f
SHA512 3fca284e384abc95201dc73f19bd9d75413e8890e819967070b9d9991115be2a8c17e07bd1aaaffcbc770b393bf9a2af253100ac4d9efba8d21110bac97737fc
SSDEEP 48:qlQOVagyAU3gJS+Tgc43uiu7Dh/gdp/gRfykVwv+:qa33gJS+ccQuiuJE/kyku
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

ba1f62e61b604fa00a25ea9edf2326a0_JaffaCakes118

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

STool.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

olepro32

oleaut32

msvcp60

wininet

shlwapi

shfolder

generic

STool.exe

PE Signature issue

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp60

wininet

shlwapi

shfolder

generic

SToolHelper.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

generic

Uninstall.exe

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32