3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118

resource	yara_rule
static1/unpack003/$PLUGINSDIR/md5dll.dll	acprotect

resource	yara_rule
static1/unpack003/$PLUGINSDIR/md5dll.dll	upx

resource
3f9eb923df0704d8b0020383f194ad7c_JaffaCakes118
unpack001/$TEMP/svchost.exe
unpack002/$PLUGINSDIR/NSISArray.dll
unpack002/$PLUGINSDIR/blowfish.dll
unpack002/$PLUGINSDIR/inetc.dll
unpack002/bfw.exe
unpack002/cftmon.exe
unpack003/$PLUGINSDIR/NSISArray.dll
unpack003/$PLUGINSDIR/NSISdl.dll
unpack003/$PLUGINSDIR/blowfish.dll
unpack003/$PLUGINSDIR/inetc.dll
unpack003/$PLUGINSDIR/md5dll.dll
unpack004/out.upx

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/$TEMP/svchost.exe	nsis_installer_1
static1/unpack001/$TEMP/svchost.exe	nsis_installer_2
static1/unpack002/cftmon.exe	nsis_installer_1
static1/unpack002/cftmon.exe	nsis_installer_2

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 c3005294d4fa3fd59ee4492607e39076ff8e455e23dc6391277feb34b185978b
MD5 3f9eb923df0704d8b0020383f194ad7c
SHA1 1524c28a726dd90f6416cc3ab306fe4d0fee7cbb
SHA512 6b71dfdbd2eaf05fda8dbe60b81c8a4ff6218b30dfcbd3bc2245faa3adafaf21e7104802f235acc417ec555d38fdb78571feab7067532ccc1eccdf904cd7fe96
SSDEEP 49152:5Fu7U7pIv0BoUoXBj5jracNibLHkJkgZv:io7av0BoPj52DkJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

323KB

Virtual Size

323KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$TEMP/hosts

SHA256 e1b710e4ad0bc8ed5fabcb21175164b2c947599e617f08a27b6318a983284116
MD5 d79a07f179d5bddc6812076b268b9c50
SHA1 b927a65bb788be1c0e227f350bd65f5752644e28
SHA512 73a18b5e0803a941aa3b86c7fc4f5d46317c63fbd6c2c7d5f63764fb859d379892769fc43a12e3e6bc6b9149b7d4c08226830ab18e3ddbcf0ff0dc8eb9c0fe4b
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/setup.exe

IMPHASH 750342c19b16f8bea5ced8b26528d203
SHA256 1c2d82d5c78cf8ca293d174c540eac003bca79be52d34f2404cfc4ac4879c42e
MD5 822c753f5b8737072d30ad468e15d436
SHA1 1186d8957c2d1d68f711d398d431a13289935dba
SHA512 7e38acaaf47c8f672a31732070c2941dd3c17e6da74998bbf7d118244f75cc2f1dbbae52862cd33173e9c4f8e438fc3e056c3e4f1eade03caf865054b40897f9
SSDEEP 24576:NXnD5tfLR57jXacNi9JLHgZJJkDofjZSS1:tjracNibLHkJkgZv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

cf:2a:7d:87:7b:bb:86:4e:f8:fd:29:1e:f6:ab:82:ef:99:e5:33:28

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 21, 2010

Minor OS version

2

Major OS version

5

Entry point

299676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

t:\setupexe\x64\ship\0\setup.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

secur32

GetUserNameExW

rpcrt4

NdrClientCall2 UuidCreate

advapi32

GetTraceEnableLevel ConvertSidToStringSidA ReportEventW RegisterEventSourceW DeregisterEventSource OpenProcessToken GetTokenInformation FreeSid ConvertStringSecurityDescriptorToSecurityDescriptorW AllocateAndInitializeSid RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey OpenThreadToken GetTraceEnableFlags GetTraceLoggerHandle UnregisterTraceGuids TraceEvent RegQueryValueExA RegOpenKeyExA RegisterTraceGuidsA RegEnumKeyW GetLengthSid AddAccessAllowedAce AddAccessDeniedAce InitializeAcl CopySid SetSecurityDescriptorDacl InitializeSecurityDescriptor GetSecurityDescriptorDacl CheckTokenMembership IsValidSid

kernel32

GetModuleHandleW GetDiskFreeSpaceExW LocalFree FormatMessageW GetSystemDirectoryW VerifyVersionInfoW VerSetConditionMask CloseHandle GetCurrentThread CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW LoadLibraryW SetLastError GetModuleFileNameW GetModuleHandleExW OutputDebugStringA LoadLibraryExW FindResourceW FreeLibrary WriteFile lstrlenA SetFilePointerEx FindClose FindFirstFileW GetFileAttributesW SetFileAttributesW CreateFileW DeleteFileW CopyFileW SetFilePointer GetFullPathNameW GetTempPathW GetProcAddress FindNextFileW lstrcmpW SetCurrentDirectoryW GetCommandLineW ExpandEnvironmentStringsW GlobalFree TlsFree TlsAlloc TlsSetValue TlsGetValue DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection RaiseException HeapFree GetProcessHeap HeapAlloc HeapReAlloc WaitForSingleObject GetVersionExA RtlCaptureStackBackTrace GetUserDefaultLCID VirtualFree GetSystemDefaultLCID GetModuleHandleA SetUnhandledExceptionFilter VirtualAlloc HeapSetInformation HeapCreate HeapDestroy HeapSize HeapUnlock HeapLock ReleaseMutex GetLocalTime GetLocaleInfoW GetProcessTimes CreateMutexA OpenMutexA CreateSemaphoreA GetShortPathNameA GetModuleFileNameA GlobalAlloc GetSystemInfo TerminateProcess LoadLibraryA LocalAlloc Sleep InitializeCriticalSection CreateDirectoryW GetFileType CreateFileA IsDBCSLeadByte LockResource LoadResource GetStringTypeExW GetACP IsValidCodePage SizeofResource FlushFileBuffers GlobalMemoryStatus ReleaseSemaphore EnumUILanguagesW EnumSystemLocalesW EnumCalendarInfoExW GetDateFormatW GetCalendarInfoW EnumTimeFormatsW EnumDateFormatsExW GetUserDefaultUILanguage GetCurrentProcess IsValidLocale GetSystemTimeAsFileTime CompareStringW CompareStringA MultiByteToWideChar WideCharToMultiByte GetVersion GetTimeZoneInformation GetSystemTime SystemTimeToTzSpecificLocalTime GetCurrentProcessId GetTickCount GetCurrentThreadId SetErrorMode GetVersionExW IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlUnwindEx ExitProcess GetStdHandle FreeEnvironmentStringsA GetLastError lstrlenW UnhandledExceptionFilter GetStartupInfoA GetCommandLineA RemoveDirectoryW GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP LCMapStringW LCMapStringA GetOEMCP GetCPInfo QueryPerformanceCounter FlsAlloc FlsFree FlsSetValue FlsGetValue DecodePointer EncodePointer

ole32

CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString OleRun CLSIDFromProgID

oleaut32

SysStringByteLen SysStringLen VariantChangeType VariantInit VariantClear SysAllocString SysFreeString GetErrorInfo SysAllocStringByteLen

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW CommandLineToArgvW

user32

CharLowerA CharLowerW CharUpperW CharUpperA MessageBoxW CharNextA GetKeyboardLayout GetKeyboardLayoutList GetSysColor EnumDisplayMonitors GetMonitorInfoA GetSystemMetrics SystemParametersInfoA GetDC ReleaseDC GetMenuCheckMarkDimensions

shlwapi

PathGetCharTypeW

wintrust

WinVerifyTrust

dbghelp

SymCleanup SymInitialize SymGetLineFromAddr64 SymGetSymFromAddr64

gdi32

GetDeviceCaps CreateSolidBrush CreateDCA DeleteObject DeleteDC

msi

ord8 ord117 ord160 ord159 ord91 ord67 ord180 ord95 ord31 ord71 ord141

$TEMP/svchost.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 a467d6f91034d1936d550745a4514344115341e3c9b1228ebe17cdaec24f7172
MD5 a10354f476aa8c50b96d55d9e8d2bb0d
SHA1 4490f75e0b3b0653896a1ee4add263485f20fc22
SHA512 2a99dc95c2bf58ade2157d2bf49d9b2b7152224df6637e3f2ec169510791b5bff2691eecad3e5f6d9593daa7633e118dc609e44f72fd1ac4192215ef6465657c
SSDEEP 12288:OmMD2tn5CCppD2tnN40OyuE3iPlkwdisMVUoX27aqu1VSX4ZdjnpKS:Om/tn5bpItnNH0BoUoXY4Djpd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISArray.dll

IMPHASH 8772d66326aa6d7b2a9d5c4b0a7afb36
SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
MD5 14b848866035dea39b912da628307231
SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4839

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/blowfish.dll

SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

906B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

89B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

bfw.exe

IMPHASH e4eef1be56d90d81d07974dd8dd3b1da
SHA256 848616dba8805eb304f0daab2156b37402adb3256b2a17144c8ba3a3a4f01bce
MD5 2fcdf1cac08db959d41078c3296bab40
SHA1 611479a912a1c13565fda76542df2dce048e60d8
SHA512 f6c33bfede57d92e35eb5035033e62901871ead0242f8e91aee5113b98cd6dd9cc477356a6a92f2ef1ef6420cefb931c7da6739f9c91a611cc483016d60dd6ae
SSDEEP 6144:p6Jb/iKDIv2ZQXQt7zBUnTna10f9YpnFQ7FrPtr8rM+HuLFd:p6Jb/iKDIQpzBUnf/rl+7u
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

1

Entry point

144016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

Beep CloseHandle CreateEventA CreateFileA CreateMutexA CreateThread DeleteFileA EnterCriticalSection ExitProcess ExitThread FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FormatMessageA FreeLibrary GetCPInfo GetCommandLineA GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStrings GetFileAttributesA GetFileInformationByHandle GetFileTime GetFileType GetFullPathNameA GetLastError GetLocalTime GetLogicalDrives GetNumberOfConsoleInputEvents GetOEMCP GetStdHandle GetSystemDefaultLangID GetThreadContext GetTickCount GetVersion InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadLibraryExA LocalFree LocalHandle MoveFileA OpenEventA OpenMutexA PeekConsoleInputA RaiseException ReadConsoleA ReadConsoleInputA ReadFile ReleaseMutex ResetEvent SetConsoleCtrlHandler SetConsoleMode SetCurrentDirectoryA SetEndOfFile SetEvent SetFileAttributesA SetFilePointer SetFileTime SetStdHandle SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree WaitForSingleObject WriteConsoleA WriteFile

user32

GetSystemMetrics

Name

txt0

Size

272KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

bss1

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat2

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

dat3

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat4

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat5

Size

512B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat6

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

imp7

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dat8

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

cftmon.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 d74d2e5ae997d48fe7eb705338d27e95ecd40a9f08c1e8fa989a98c6a3f19994
MD5 75cedbcff197897f97629194d631145c
SHA1 4843b854dbfcf8ac0350843857319f340c9ae4d7
SHA512 f2868a8f867a4676213edae6bb382adef1c7c831985cb5df56cd0c1de3eba1b171ac537f6d83c9525db1a5311365a0d121e7cddc51761b2adda2dc054ca340a2
SSDEEP 1536:/pgpHzb9dZVX9fHMvG0D3XJHNUZF47BLK9rjd1V/DOJ/x6s+bMnikqIzjbanyb:hgXdZt9P6D3XJtkFQKNhDqx3tni5K5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISArray.dll

IMPHASH 8772d66326aa6d7b2a9d5c4b0a7afb36
SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
MD5 14b848866035dea39b912da628307231
SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4839

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/blowfish.dll

SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

906B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

89B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

setup06.cab

SHA256 a8746d7033f7e3891a64ae1bd1116fe82c93cc049ba61e433c8659348dfd2e36
MD5 b023012f4156204886737091f4a2f389
SHA1 868d7acecc190fffa7b0df7342671b88138bb7a5
SHA512 eaa954dc7987fdd9c9cd1329a3765417071161a3f4dddf7bdd6bae2643fa3e3446171499adcf821642852c265ab9e086d95e8b44a2d5c5d1148df8978dab8cf4
SSDEEP 6144:cYABR0OCFunEpQDxYyIjiZIGdl4cs97sldisBGVUf0OD2X27HvCDlless:d40OyuE3iPlkwdisMVUoX27aqZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer