08e6a2bb6a202710b693e2940808cef8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
08e6a2bb6a202710b693e2940808cef8_JaffaCakes118
Size 272KB
Sample240620-xqdc7ssgrd
SHA256 42378b1eca3cfe3e71d500781cfe3dd11f82d8b65b848ddd04439b4b9952f5c5
MD5 08e6a2bb6a202710b693e2940808cef8
SHA1 3d57163aa6b2cf8492db3cfb9b878d801fc23c7f
SHA512 a408fb40a778f37ab94da87d6a337f2cb24253d3a437d72a335c8bdfb2a831e469d1296a2435d0a146db6ed7ddd3f468563000f43e9aa725db26c049b3d36839
SSDEEP 6144:6e34wtg75+ZPPfnE2Qyn20UlwkQKrPNHqdtj75+ZPPfnE2Qyn20U:BtgF+ZPPfnEUnFKrPQjF+ZPPfnEUn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/SelfDel.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsProcess.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

08e6a2bb6a202710b693e2940808cef8_JaffaCakes118

.exe 272KB
$PLUGINSDIR/IpConfig.dll

.dll 114KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/SelfDel.dll

.dll 4KB
out.upx

.dll 5KB
$PLUGINSDIR/UAC.dll

.dll 13KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
SmartTool.dll

.dll 106KB
SmartTool.exe

.exe 42KB
Uninstall.exe.nsis

70KB
adc.acc

.dll 28KB

08e6a2bb6a202710b693e2940808cef8_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 42378b1eca3cfe3e71d500781cfe3dd11f82d8b65b848ddd04439b4b9952f5c5
MD5 08e6a2bb6a202710b693e2940808cef8
SHA1 3d57163aa6b2cf8492db3cfb9b878d801fc23c7f
SHA512 a408fb40a778f37ab94da87d6a337f2cb24253d3a437d72a335c8bdfb2a831e469d1296a2435d0a146db6ed7ddd3f468563000f43e9aa725db26c049b3d36839
SSDEEP 6144:6e34wtg75+ZPPfnE2Qyn20UlwkQKrPNHqdtj75+ZPPfnE2Qyn20U:BtgF+ZPPfnEUnFKrPQjF+ZPPfnEUn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

68:d3:a7:b1:e9:14:d8:85:50:9c:16:51:fe:20:08:d0

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 4, 2010 - Feb 2, 2012

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/IpConfig.dll

IMPHASH a9988f98d52a3c7d16228f87844f85ea
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

kernel32

lstrcpynA InterlockedIncrement InterlockedDecrement GlobalAlloc MultiByteToWideChar GlobalFree lstrcpyA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement SysAllocStringLen VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SelfDel.dll

SHA256 281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
MD5 7cff7fe2caea5184d98c147e7e263132
SHA1 21f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA512 fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
SSDEEP 48:CzHDh3jgWMynQfXKsJ3eAn67wN4VDm0pmoZSeJY8JTaCILFoyTFS7lWsaEaSueq:S18WMynkXKOOATEVUPnS7s9TShqTM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

30144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 16b76fa1fdb38370620685dca43c8dc868c311a440416e5a99201af8602584f4
MD5 89e19ef4c9e148d9a25abb001b1bd707
SHA1 b344be397b903dfa19c82a19dca3520abd68412e
SHA512 17e04657483700a0d1ce1a588f587a0f17dbf7f07d945c08e88ee64bdc2a0ddded680aca1b009a1fab194bc97551733ae1b248ae7029c2e7a7555b59d189f785
SSDEEP 48:CV/wr5gIkjfqzDcFGb7Gfq815pwsL9ANPJ4ZAyTFS7lWsaEaSu:VgB2z4Wkp5L9ARJ4ZVS7s9TS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH ee75cece63794fa22feebed80a358b16
SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
MD5 29858669d7da388d1e62b4fd5337af12
SHA1 756b94898429a9025a04ae227f060952f1149a5f
SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetVersionExA lstrcmpiA GetCurrentThreadId GetProcAddress GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA SetForegroundWindow CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog SetWindowLongA LoadImageA GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA DestroyWindow

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation OpenProcessToken FreeSid CloseServiceHandle EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SmartTool.dll

IMPHASH f720b9efedd758185810477233e757a5
SHA256 5caad6897762c1781d9fe1227b068a940a50ffca7cb4b563116a5b3f14f4a45b
MD5 c3fe27e59dba45b00172fb0e556951cb
SHA1 39cd86014029a7d1080250650cb79eec6e280d19
SHA512 c7511156ebaea6de4f06961d881389f67843e9e6550dd05de03d500b59d1beebe5e2808be85e2e67be91780d53013ef0ff29937cbb7c6ebc2eecba4587448ac1
SSDEEP 3072:w/NCtMw7QJX4+AuPHsPs8JoUmj7/ijA++g:wMYP8qh//1
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

68:d3:a7:b1:e9:14:d8:85:50:9c:16:51:fe:20:08:d0

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 4, 2010 - Feb 2, 2012

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

54479

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord1255 ord6467 ord1578 ord1253 ord826 ord269 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1168 ord1575 ord1176 ord1131 ord2725 ord3953 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord815 ord4274 ord861 ord6282 ord6283 ord2764 ord6663 ord926 ord4204 ord939 ord800 ord924 ord4129 ord2818 ord860 ord823 ord825 ord5710 ord2614 ord858 ord537 ord1601 ord539 ord535 ord540 ord600 ord1116

msvcrt

memcmp memset strlen free malloc _mbscmp strcpy memcpy __CxxFrameHandler _except_handler3 _mbsicmp _purecall realloc ?terminate@@YAXXZ ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv

kernel32

GetModuleHandleA GetLastError CreateToolhelp32Snapshot Process32First Process32Next LoadLibraryA GetProcAddress FreeLibrary CloseHandle GetModuleFileNameA GetShortPathNameA lstrcpyA lstrcatA lstrcmpA GetCurrentThreadId GetCurrentProcess FlushInstructionCache lstrlenW InterlockedDecrement InterlockedIncrement GlobalAlloc GlobalLock GlobalUnlock lstrlenA MultiByteToWideChar EnterCriticalSection LeaveCriticalSection LockResource LoadResource SizeofResource FindResourceA GlobalFree WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte HeapDestroy GlobalHandle LocalFree LocalAlloc

user32

RegisterClassExA SetTimer IsWindow DestroyWindow DefWindowProcA wsprintfA GetClassNameA GetMenu AdjustWindowRectEx CreateWindowExA GetDlgItem SendMessageA InvalidateRgn SetCapture ReleaseCapture LoadCursorA GetParent GetDC GetDesktopWindow ReleaseDC RedrawWindow SetWindowPos GetClassInfoExA RegisterWindowMessageA GetWindow CreateDialogIndirectParamA SetPropA GetWindowRect ScreenToClient SetWindowTextA GetWindowTextA GetWindowTextLengthA GetWindowLongA KillTimer FindWindowExA TrackMouseEvent PtInRect GetClientRect InvalidateRect SetWindowRgn CallWindowProcA CallNextHookEx GetPropA RemovePropA GetWindowPlacement IsWindowVisible MoveWindow ShowWindow SetParent SetWindowsHookExA UnhookWindowsHookEx CharNextA CreateAcceleratorTableA BeginPaint FillRect EndPaint GetSysColor SetFocus IsChild GetFocus SetWindowLongA

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject BitBlt DeleteDC CreateRectRgn CombineRgn CreateSolidBrush GetStockObject GetObjectA GetDeviceCaps DeleteObject

advapi32

RegOpenKeyA RegQueryValueExA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegEnumKeyExA RegCreateKeyExA RegQueryInfoKeyA RegEnumValueA RegCloseKey

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromString CLSIDFromProgID OleUninitialize OleInitialize CreateStreamOnHGlobal OleLockRunning

olepro32

ord253

oleaut32

RegisterTypeLi LoadTypeLi VarUI4FromStr LoadRegTypeLi SysStringLen SysAllocStringLen DispCallFunc VariantClear SysAllocString SysFreeString

msvcp60

??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

wininet

InternetCanonicalizeUrlA InternetCrackUrlA

Name

.text

Size

56KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SMARTTO

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

SmartTool.exe

IMPHASH c67f5ef01a4a49994eb94b985aad2711
SHA256 7b9fd7ea1c9dc710f67d3066369f51bf5fc4002062b356a2f53038b02c79fce0
MD5 d1859658605c11d217cb9d3e0540ca61
SHA1 1e2cb13bdbe6c6e6568a127258d7df38e67e26d5
SHA512 5b144619b2b4d97724fcbb850c8041f020f1b44494121ce42a8949280c8570fb8cd9213e7d467eb695364c6ae31e8b83e08e609e55473c933e0828fed3ad052f
SSDEEP 384:J5ifwRFKhAcAELTLCT5/M7Ygi6RYm59Pe18WJ07c4xJ4YJLuPkCQu:6wRlcvCT5+06CHJ0A4xJNLuD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

68:d3:a7:b1:e9:14:d8:85:50:9c:16:51:fe:20:08:d0

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 4, 2010 - Feb 2, 2012

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

15036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord535 ord922 ord537 ord800 ord2820 ord548 ord4710 ord2379 ord755 ord470 ord6215 ord1168 ord6453 ord801 ord4299 ord939 ord541 ord858 ord860 ord540 ord4277 ord4129 ord2764 ord6883 ord4278 ord6663 ord924 ord926 ord6877 ord2614 ord941 ord2915 ord536 ord5572 ord5683 ord4234 ord324 ord3597 ord4425 ord4627 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord1576 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4998 ord4853 ord4376 ord5265 ord6394 ord6383 ord5440 ord5450 ord2107 ord1134 ord2621 ord2514 ord2841 ord641 ord3663 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord5710 ord4673

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _setmbcp __CxxFrameHandler _mbscmp free malloc _splitpath atol _except_handler3 _mbsicmp _local_unwind2

kernel32

FindNextFileA FindClose GetFileAttributesA WinExec GetCurrentThreadId GetModuleFileNameA FreeLibrary SetEvent WaitForSingleObject GetLocalTime CreateEventA ResetEvent CreateThread RemoveDirectoryA DeleteFileA GetProcAddress CreateMutexA GetLastError CloseHandle GetModuleHandleA GetStartupInfoA FindFirstFileA GetTempPathA CreateProcessA WriteFile CreateFileA LoadLibraryA

user32

GetParent GetClassNameA EnableWindow GetForegroundWindow GetWindowThreadProcessId AttachThreadInput GetFocus SetWindowsHookExA KillTimer UnhookWindowsHookEx PostThreadMessageA IsIconic SendMessageA GetSystemMetrics GetClientRect DrawIcon wsprintfA CallNextHookEx SetTimer

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyA RegCreateKeyA RegCloseKey

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA

wininet

InternetOpenA InternetCanonicalizeUrlA InternetCloseHandle InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA

adc.acc

IMPHASH b4cb6de93e4fbad00cfcff7a81ab391d
SHA256 3c20fa6446d636d46c9e049887437e794787574969e0b7818571da7169543f11
MD5 90fb210a39450f5cc40685f1af8e8cba
SHA1 8a4d4b84c5a8de91c4123dcb1f097daea2e8344f
SHA512 522769d16dcc161e63b796c82ce6b78e3015f9836987c9a22222858b422160acda6516fc320e28dd103df8bafce5eac2c1209d9af0bec9a8adfbb889086a60d0
SSDEEP 384:gRKcuNzFctEVKxoQKxqgiDi1tlXaZdRe8BwWkez01OTOtXQfWYJLuPkCQu:SKLSohxqgt1tdMdQYzeOTOtgfPLuD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

68:d3:a7:b1:e9:14:d8:85:50:9c:16:51:fe:20:08:d0

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 4, 2010 - Feb 2, 2012

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

11627

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\2010-10-01\프로젝트\SmartTool\SmartTool1.0.0.1\adc\Release\adc.pdb

kernel32

IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange QueryPerformanceCounter InterlockedExchange DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime HeapSize FindResourceExW FindResourceW LoadResource LockResource SizeofResource Sleep GetModuleFileNameW GetProcessHeap HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

RemovePropW SetWindowLongW SetPropW GetWindowLongW GetParent GetClassNameW UnhookWindowsHookEx SetWindowsHookExA CallNextHookEx GetFocus CallWindowProcW MapVirtualKeyW keybd_event SetWindowTextW GetWindowTextW GetWindowTextLengthW DefWindowProcW GetPropW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyW

imm32

ImmNotifyIME ImmSetCompositionStringW ImmGetContext ImmReleaseContext

msvcr90

iswspace memmove_s wcsnlen memcpy_s wcscpy_s _vscwprintf vswprintf_s ??2@YAPAXI@Z memset free _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _except_handler4_common _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal wcscmp wcschr _wcsicmp wcslen _CxxThrowException ??3@YAXPAX@Z __CxxFrameHandler3

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ADCDATA

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

08e6a2bb6a202710b693e2940808cef8_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/IpConfig.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/SelfDel.dll

generic

out.upx

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

SmartTool.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

ole32

olepro32

oleaut32

msvcp60

wininet

generic

SmartTool.exe

PE Signature issue

mfc42

msvcrt

kernel32

user32

advapi32

shell32

wininet

generic

Uninstall.exe.nsis

adc.acc

PE Signature issue

kernel32

user32

advapi32

imm32

msvcr90

generic