jarfix[.]exe | Triage™

resource
jarfix.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jarfix.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 3a00c5b808954e9dca76418506eacec9cb1cb0fd844318a896ebae787f5eaae2
MD5 dd9f1cadb75365e4646a814e8d022010
SHA1 a963f573f3fe0422b867dabad52bd7d345ff4d49
SHA512 b78415dd79a4579b97cc476c8fba9d886095c9a65967914c82b1aa6a3c3ad6dc51701692d3bea55284997124bd89dab4581b68276fe44104a089a0352b6cc986
SSDEEP 1536:EKJAES3bS2L6KbuVfmMk0DCwcOmwzYPdCHQw8TKw72lBN6dimW:3J2S2L6KbqDCwcOuPUSWu2lBN6fW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 87cef8501ab86470cdb266e427b811c4
SHA256 6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3
MD5 e840e7f30c85e22b09a41098ff3f3343
SHA1 ad1eb7b2ba66ae87641947025736c67efbc4b9d8
SHA512 ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8abe046ef411de4d3e6e831b6b1ee264
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jarfix-license.txt

SHA256 a60521b073f247dd4073b40490bae83322946cb833e0617a3c76bb17ec07fcd3
MD5 3cd3cee8c90d5a8478d82599c9725cca
SHA1 3249704874e300143792f083d9fdc58b778be1a1
SHA512 544433eaa985eedfb8f5189350c20e9a7e8bf92230614aabf9e9cdcd49c1ebb1af43314a59a8e3977e998f17018d9089f76049897ab0776df00bd20f10bc99ea
MD5 SHA1 SHA512

NSIS installer

installer

jarfix.ini

SHA256 62a6bd00f8036b6d042b640f5efe302de07bc475938e1fb42731117afa8dced7
MD5 1e1e300886092e62c6b7670681a8a3f0
SHA1 b1d47d9002c3299161307e8a34d2e26718643d38
SHA512 73875e9492a2d04b756bebbbb98eb03c37d22ccf05d922e45d56346d7903d2bc1370b578bf11b1c0f3cfeee5625335d64986990bf547d82a4dac1b626eb6ce9e
SSDEEP 96:3GuphUPSGZmSfyKS3rQQSPwH++6sVPgvGea6+2l6ekVgkYzkWq:xjUPDyKS7NUM6q4v5+wk6zkv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

jartest-license.txt

SHA256 3b78128a0c186e73aca6f215c41ec9dca1a4db78fb558ca759046ff4aaece4f0
MD5 fff10b6f70f3e2bf06fd6a734bfd954f
SHA1 213e89def17c945de4f297f5f4191ca2e7e534d8
SHA512 8928eee3111254a0fddfd1b4e6471e4c41786e13bf4be66dfe1b6bdd13246da3c17933ace33876c318ee6cab3aece2770b26465aeb92d9c447f296098dcc9774
MD5 SHA1 SHA512

NSIS installer

installer

jartest.jar

SHA256 54cc2fec7be26214ec8ba260468f775b04ede7e2989822250f41ec91c465cccd
MD5 9b845d429ff54e5582199af6af029a81
SHA1 ab5d9f156e5f7df0c8e991c14031e94a14e12d94
SHA512 5207409cbf209bd2d19dee3fb1fb10c0932c5ff942f5a4c96a2fabcbcc399cb27b2c1dba892e70fb74597abaf971fa9d94ae1b592e04932b1a8beddd48f23fbc
MD5 SHA1 SHA512

NSIS installer

installer

jarfix.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

jarfix-license.txt

jarfix.ini

jartest-license.txt

jartest.jar

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

jarfix.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

jarfix-license.txt

jarfix.ini

jartest-license.txt

jartest.jar