5a6f5ade9bc3d1e5d35166fa00b25295_JaffaCakes118

resource
5a6f5ade9bc3d1e5d35166fa00b25295_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/remote.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack001/$TEMP/sobar.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$TEMP/remote.exe	nsis_installer_1
static1/unpack001/$TEMP/remote.exe	nsis_installer_2

IMPHASH dfb06052e74b26a42b0e490bd1c07959
SHA256 9f2bf14e31ec6527bf34cd2a14a107dcc70ec333301c5202cc3d11696b39f0ba
MD5 5a6f5ade9bc3d1e5d35166fa00b25295
SHA1 7de5f4c919b0c01c3d4c93a64b9618c5632748a9
SHA512 60a47e31117b8ee1a5a99de121d9e87955a895398e801df6be386965a09e7ab2ec557383745574e0d21e40a73a284ba49bedd049ff1d52dc5d6255e194e422ac
SSDEEP 12288:KCy5t9UrNvc3Up0+tHMIrBj2JbFNBNpmI4zZRtHiIOLQ9iuKEd7BEHTa5nbg53op:AtMCkmOMXJbFSv/JivQsG50+FIM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer MulDiv FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData RegisterClassA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA EmptyClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SetForegroundWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$APPDATA/Internat Exp1orer.qnk

SHA256 6a1bfc7b4d0b3c749f9a5737f7f0253c634bdd62fe812948807c6beae039ecca
MD5 9ffaab5f197ee38cf1fe65e19d4bb217
SHA1 39ee57d785cb31b75fe79879ab5dfed14eb1a28e
SHA512 eaa04c6437eac713912a81b2e11f97cfdc38d5d5bb459d7f4ae94d140b2bd4d74685cda43697f00b6803b1b58da3bef78ca3d9d6a4b9f5e4278ff2451aee512b
MD5 SHA1 SHA512

NSIS installer

installer

$DESKTOP/Internat Exp1orer.qnk

SHA256 6a1bfc7b4d0b3c749f9a5737f7f0253c634bdd62fe812948807c6beae039ecca
MD5 9ffaab5f197ee38cf1fe65e19d4bb217
SHA1 39ee57d785cb31b75fe79879ab5dfed14eb1a28e
SHA512 eaa04c6437eac713912a81b2e11f97cfdc38d5d5bb459d7f4ae94d140b2bd4d74685cda43697f00b6803b1b58da3bef78ca3d9d6a4b9f5e4278ff2451aee512b
MD5 SHA1 SHA512

NSIS installer

installer

$DESKTOP/ԱմƷ.qnk

SHA256 23dde6d591dc39c8b7901a49ce2edbe1591ef2b68d69700a4c81fd741f2d714e
MD5 3801cf5240ef322de5fb53224f763068
SHA1 e4286f9b6e5986b6a237bc70fdc03e8a36287e11
SHA512 3d26058c20050e236cb78533485dc2dd02ed6be0ab7037e8eac5916b75abe189d38f57ed45899787cbe69318ec4d6763633d1a8a96600fd0b20b83aaa9f03ef4
MD5 SHA1 SHA512

NSIS installer

installer

$FAVORITES/Ա.lnk

SHA256 248402dd02a096f9721d61fe867fac5cacf4dc9001fa2aa6a50a59f7405606ef
MD5 62d588bdb74e4e2e5d1689fa9272ce39
SHA1 9d0db515d8f65e57353381d707060f7343a74da7
SHA512 cbb47f7e4227177ad39a1c914e00e0ca13209fe0839d13819299ad203572b69026c541d71c5101e4cdddbcf7786c6adf339af3e4b0aab65cb188614f646a893e
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/InstallOptions.dll

IMPHASH 0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c
SHA256 21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0
MD5 107737e3282fefd85684f2fa3df6d1c3
SHA1 3befbcae116a644ae28cebdc1d7dfe6be5c8ca5f
SHA512 439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4
SSDEEP 192:FTmFxiXTQdQbg9FkGuz9lBDpO5DwbgUojcA96lK72dwF7dBG0N1:FTmriEdYQFkGUlI6vojj6l+BGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect MessageBoxA CallWindowProcA PostMessageA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 49437f4b9fd38007f3b2735f0a8a12830b995305c75118b440202980183d5c6a
MD5 0ae9c427fe7bbbbf1368c1c6d3933ae7
SHA1 c8e5131613302531c88512dada29a18886259268
SHA512 59b76b00f2b0d6242dc5bc3cb36d3ff78867445f502e34cea890c6f493c2adf9b97cec539963204ddd1c641e1a77139f46fc33dec4dc636f4b06d2edffffec6d
SSDEEP 96:vCCshwlpqUsYghN/9uvZ7CLWNCSiiVTQYBGVXRvuBDlSriklbuba1iLc+cEyzo7e:BzqUuh/uLCXIkYBGV9uVlSblbubbwtl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$SMPROGRAMS/Internat Exp1orer.qnk

SHA256 6a1bfc7b4d0b3c749f9a5737f7f0253c634bdd62fe812948807c6beae039ecca
MD5 9ffaab5f197ee38cf1fe65e19d4bb217
SHA1 39ee57d785cb31b75fe79879ab5dfed14eb1a28e
SHA512 eaa04c6437eac713912a81b2e11f97cfdc38d5d5bb459d7f4ae94d140b2bd4d74685cda43697f00b6803b1b58da3bef78ca3d9d6a4b9f5e4278ff2451aee512b
MD5 SHA1 SHA512

NSIS installer

installer

$SMPROGRAMS/Ա.lnk

SHA256 248402dd02a096f9721d61fe867fac5cacf4dc9001fa2aa6a50a59f7405606ef
MD5 62d588bdb74e4e2e5d1689fa9272ce39
SHA1 9d0db515d8f65e57353381d707060f7343a74da7
SHA512 cbb47f7e4227177ad39a1c914e00e0ca13209fe0839d13819299ad203572b69026c541d71c5101e4cdddbcf7786c6adf339af3e4b0aab65cb188614f646a893e
MD5 SHA1 SHA512

NSIS installer

installer

$STARTMENU/Internat Exp1orer.qnk

SHA256 6a1bfc7b4d0b3c749f9a5737f7f0253c634bdd62fe812948807c6beae039ecca
MD5 9ffaab5f197ee38cf1fe65e19d4bb217
SHA1 39ee57d785cb31b75fe79879ab5dfed14eb1a28e
SHA512 eaa04c6437eac713912a81b2e11f97cfdc38d5d5bb459d7f4ae94d140b2bd4d74685cda43697f00b6803b1b58da3bef78ca3d9d6a4b9f5e4278ff2451aee512b
MD5 SHA1 SHA512

NSIS installer

installer

$STARTMENU/Ա.lnk

SHA256 248402dd02a096f9721d61fe867fac5cacf4dc9001fa2aa6a50a59f7405606ef
MD5 62d588bdb74e4e2e5d1689fa9272ce39
SHA1 9d0db515d8f65e57353381d707060f7343a74da7
SHA512 cbb47f7e4227177ad39a1c914e00e0ca13209fe0839d13819299ad203572b69026c541d71c5101e4cdddbcf7786c6adf339af3e4b0aab65cb188614f646a893e
MD5 SHA1 SHA512

NSIS installer

installer

$SYSDIR/163pan.ico

SHA256 d2741b8bae61d6554f9240b493ee6d3c765609257b765754c25b26168954eccd
MD5 0a870d61d4360d3e7e38a18838b06df9
SHA1 1e17dff73dca24b71b3a0282cea442e2ae392e6d
SHA512 702402644ad405dde816a7dff79407fc97bb40b46c1469ee97b20ff082385234683f71eecb7bf2c6f984e1423e3bc0f9c2d5ccc18a288b22641f7922df5ee582
SSDEEP 384:L1h/8eYE1OKw0JclD7DvruTygB+nU6w1Xy82Dz+eDZYHH48B9M6hzWyvEsdG:Lz8LY9w0cjruW5nTOXydDB8MQzWy8sE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$SYSDIR/55277.ico

SHA256 8aef37b03b0513e96431401ded16fb5aa592deccf05be797059b3004972d7394
MD5 62304d2762e4801ad812884d49861796
SHA1 9b2df2f28585f839b7e2e70384dee8e6a508912c
SHA512 9e0e640f6df9c89424804e31dcc8d07c6a72850adb20484fafe13f30c0ae5e6ba282d87d87208f33a7ef868438cd85ffa5367d824348cbe66599120301131b42
SSDEEP 192:g/K9hFPnF293jcein8yKR/93jxGZcV93jWZ93jNR43ZMYfk5NGLD5Z7e4hHrUudQ:+OPM35F3l3W3xRndsL1mkIZB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$SYSDIR/movie.ico

SHA256 fb45832f88c9a0606f9fdf8f4c774bb118b8dbdb1bfee29258b764096adfbb35
MD5 7c8825622f7e01d86c3f81100e09a142
SHA1 fea01bbc3be36064a1c57c33eda075cfa9979d61
SHA512 9adfca40b82b5acb0927e23ce37a04791656010ec59d642ae4429062839dd2f8458abf1332f46aa2cc31e6949b3f70f0a8e25226310f099f28c4505db1c49eb6
SSDEEP 384:WN+EbdbC3TsDpDBRM9lVeoHF/YHGdhU+AHXmqR7zDeCgs58pYSrp:WgOy4BRMLFYHKhUZHL7hD8p3rp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$SYSDIR/tao.ico

SHA256 1aa6f975c46d255cca87154da128bb8440390b63baa5da0c56c12467bb8ba29e
MD5 2379e2c6ce61bdce506afe80ae3505d5
SHA1 b985ac6d5ae6223999c7a01b7723decfd313f59b
SHA512 f6fa9f8e2242c1ffdd1f222e81fdade6ae86ce74c485eb6880e07282c6583bf4744cc79b20f6430a699d636e6a1ab36d6aebde90936f1309e62d70d47b148c89
SSDEEP 48:9cLDIzw2RAXPuXRTjONm5BtDX7CIR9n89bwrYpflfi1vTxHBNqd1HybSiGkzKTCc:9YYw2aETj6SjD25bBpmVHcybSFzfR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/remote.exe

IMPHASH 1c042238f43557c055fca8642de8a074
SHA256 235d9e96c68a262c1d6093fa499c8ffc14f41cca8c79dc289bdb27d70b7411d3
MD5 71c0a16bad347349ea62d30b76bcc326
SHA1 841087fc28fb4812e0c2898ec8ac9049d3bcf593
SHA512 7d4ddb4e70d49cc1c221abf68b71f579200adefb1d79fdfd414494b32f11a004aafb3715e8131e382c61277a99abbc374ec7448f176d235bd2da581d71610fc5
SSDEEP 1536:Mppv5CNE2E/n/fn8lvOvNOH4KJJ6CR4Romu/BsKO+sqCZnAucg8s:Mppv5CNEhf8FH4KJJ6045y5CZ9Is
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer MulDiv FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData RegisterClassA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA EmptyClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SetForegroundWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c
SHA256 21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0
MD5 107737e3282fefd85684f2fa3df6d1c3
SHA1 3befbcae116a644ae28cebdc1d7dfe6be5c8ca5f
SHA512 439ac2f3066902e08d63dc3061f55063089857e765feb29fe47ba5819a9bebdff3fe2fe55fc8bfcfddb729d340f006ee95b5aa4422d712f9dcc07cc02ec410b4
SSDEEP 192:FTmFxiXTQdQbg9FkGuz9lBDpO5DwbgUojcA96lK72dwF7dBG0N1:FTmriEdYQFkGUlI6vojj6l+BGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect MessageBoxA CallWindowProcA PostMessageA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 f144d17060052ce6205fdf717a647f6b4e20c268fea14e81efc26356d00bbaab
MD5 01776e92060ac00338d0367e49518384
SHA1 928f7d41e59a1f9fefadeea6226c5a223ebcd699
SHA512 2da8cb9c0cb7ff983b137d321f48f5ecf24600c1b52570691ed527531cdb61c98f8b2cf0c53446cb4e7f98d571f8e2591a3f3570ac9722abbac25648866d9881
SSDEEP 192:SpM3f5sTMzoU7Fs0+/tcDm0tzailQvzwTaoxs+/rH6hqCeHtpflVp6kn2VgsTwp:SpM3xcMzRF4/Gv+H+D6hqbgk2rTwp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/sobar.exe

IMPHASH 18bc6fa81e19f21156316b1ae696ed6b
SHA256 e51ae0e66644fcf814a818b656d8da099274fb32e7e7bf734232782ecadf4c04
MD5 35cbcab16f3e3833f6579e49db302b5c
SHA1 63c123503c583b741607eb7a6d8dd2a7244c6fa4
SHA512 714c8abe739c58dbe7fad652ef5acd18b25d192f7100ae9aa612e69f5b4f74d5baca940a58ac63de8440b68564a4589ef52fff6e61a2034b48f82914d60190a5
SSDEEP 12288:S6oCgAXtDbQCh3vtuuDp8SqV2GjMTtzdkw:S/cXtD8Ch3vtu0qQGARp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess lstrcmpiA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer