2d94069398144fddc58ae08242b94d0a_JaffaCakes118

resource
2d94069398144fddc58ae08242b94d0a_JaffaCakes118
unpack001/$0/scanquery.exe
unpack001/$0/uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/$0/uninstall.exe	nsis_installer_1

IMPHASH 4a9446e5cc2412c6405cea69dddb93be
SHA256 5976e037d6566d69a00c443532b6463373f94f6fe33e4e96ead1e4656c824290
MD5 2d94069398144fddc58ae08242b94d0a
SHA1 2c9ecbeeec2e3fbc8ba260a38efc60209bbcf011
SHA512 df188d529b9080446ffe670d3f41472aa20a6aa47a5c3b6e403a503e31feaedfd3447a9d3e3267977c81e5e8dec23ed010fb0046ede0c9f08d06e999dcf50e8a
SSDEEP 12288:p4+RNfJ0b9tW8SUedSrA2HGlTdb5ZTzAx3TvTC4EBB66ybl2LF7KSUqFIGJfgqFz:p4+neWdYrvHIfTIT/Cml24SUgIGJfgqB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess lstrcmpiA CopyFileA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$0/scanquery.dll

SHA256 ac06c978a9305b9ac6948027b0139b4f785acb92a3525696f6de04cc8396b75c
MD5 6c62e0351f324cbdf3f40659687c28fb
SHA1 88df3182daf77f7333ec23af72f86aa001479c88
SHA512 0b753104c738c2d7e9e66b773580ce6c27ed5179707caf5e1089e25d121232e6eef2ceb6252019900639487d877be62aa4cc40ce72d4a429891e9a04eee1173d
SSDEEP 12288:9WRE0hKfue7giA/wCLm7v7xS4muGQGC3YK3fMRSBsdZLjpY67fOTxYDJaGGa9/j:9sh8ue73AYCL8Ts4m+b3fMjZe6zOiBxb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$0/scanquery.exe

IMPHASH ce0b1341c2d56b2a292ea93cdbfdc755
SHA256 e86ce704b6caa6e7400f1f2883c5b39d1d4ccbaf8ee61b123dc49de2b7873ae5
MD5 5e0d01130d3f28e1d3abbfd847eabdbe
SHA1 0f16c83b31146e818aa55b7d047a07aa21d75a02
SHA512 d7e9b7b8aa54442112f62212800a8f69a19e40fe6442ac26be5439fe903c98c6e37392b6903d09cc8245fbf9f7992f82f05dbbfe90a2e2df698631f97f61ce88
SSDEEP 768:GK/elBdtQ9KKW13HDWz+P5rX/kJKyC6VJl:p/elBeKf13HA+xrvk4yVl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8735

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$0/uninstall.exe

IMPHASH 773e933db287d0293e61a62d958e00ab
SHA256 f17b04164f332b6fefe9cf8280657940d45acd5f822816752b74ab0ce740f5cd
MD5 326bab29f247b0d0b8438334af19d2a9
SHA1 df0411d0ed56443af8015d2ffe54af67d627cb9a
SHA512 e357e9dea57e906b09b1c9fd8d50dd379ac065fd7c6c54be4f493cf7783269ab2e01630a8a82d914b8f131a747efc9684b9f26280d725d5520f6558dca4efdac
SSDEEP 1536:PEkjY1zy214Qay0DGkJ7qAELVigJ/cfUcpuQMF2Ir1A2/D7:8kjAJ4dDGkJ+AI0aAkQ+2IrR/H
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess ExitProcess lstrcmpiA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b3d296ff6f7abb1319ee006fcc6c4d98
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints GetClientRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA PtInRect LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA OpenClipboard

gdi32

SetTextColor GetObjectA SelectObject GetDIBits CreateRectRgn CombineRgn DeleteObject CreateCompatibleDC

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder SHGetMalloc ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 abed0331d11e2fa2137f606e6ccff4756811b980c1b008a720113fb668756af4
MD5 9ea07dbca3fe82d634f432df37e11ef3
SHA1 60e83405f1213fa8565c5e7b02513896a08233d8
SHA512 0614cdf32663a14b5838f3d160d797d8f131672907292cb99284cbe8e167a2d200c213fab9c0aa9a3a95c9bab2cc14c74dcab560cb27f97654e8ff36d9efac64
SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwoca5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1kFTY/Zk3vX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/InstallOptions.dll

IMPHASH b3d296ff6f7abb1319ee006fcc6c4d98
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints GetClientRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA PtInRect LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA OpenClipboard

gdi32

SetTextColor GetObjectA SelectObject GetDIBits CreateRectRgn CombineRgn DeleteObject CreateCompatibleDC

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder SHGetMalloc ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 abed0331d11e2fa2137f606e6ccff4756811b980c1b008a720113fb668756af4
MD5 9ea07dbca3fe82d634f432df37e11ef3
SHA1 60e83405f1213fa8565c5e7b02513896a08233d8
SHA512 0614cdf32663a14b5838f3d160d797d8f131672907292cb99284cbe8e167a2d200c213fab9c0aa9a3a95c9bab2cc14c74dcab560cb27f97654e8ff36d9efac64
SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwoca5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1kFTY/Zk3vX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer