81cdf48af5e5a5aec0525ad344583938_JaffaCakes118

resource	yara_rule
sample	upx
static1/unpack001/jpdesk.exe	upx

resource
81cdf48af5e5a5aec0525ad344583938_JaffaCakes118
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsWebJPDesk.dll
unpack001/jpdesk.exe
unpack001/out.upx

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

SHA256 91a99e3da090d87713a3ba04ff4ac24b568687e95668985d364d0e3aa7cd678d
MD5 81cdf48af5e5a5aec0525ad344583938
SHA1 c96dd457ce8291dbaf096c76249c6d5487cc1b1a
SHA512 3c69df7edd7a3f2ee4d2906826045ace4d8de9e8236ff0a499090068af17e201b96408b58b087ef38809f466e2deb6b2f96ebfef22ec09abefda83271f317518
SSDEEP 12288:Qw1dILPAX8ln6aB4WP3E29V8S4Dhg0fn2J6Z2SLqFzgdqRfZx2HRtGDzLjZQLbec:Qw1dILPAX8ln6aB4WP3E29V8S4Dhg0fJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

312432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 5047f47c4b73892be304af2aa889209902825d3618cfd8b2a9f9ff89d559bc0b
MD5 c4203db37eb20d747f7befc633efc347
SHA1 cec3c8d4f695f40179df7b0dbe7dc841ed2ee714
SHA512 c83a53319cc4ca2fdea5521f6c57ed88689bdf0fdf182dcbd7f55acde2aece2a844aa34212aa4af12708093299c137b958b92aaeaba529a5b486448482f455a7
SSDEEP 384:els/UxbCisb8e0nXG6xAv/cS2Gzn6WRZFdcnEyNwteFFF0dMPtcVciq91IXxImFh:R6+b6WaOFduv8KwX9
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 a34cf3a30dac04e8c2099f15beb92b989affaed5eb9b37c6d3cedc03144374df
MD5 e6879a100704cfdf2eb254184ae4aa97
SHA1 23b112857913e05d7369c482c287fd082dcfa171
SHA512 6eed5dbb91a116b8dafb41976ecae8d9161f892ff4a1aa17493102207e61d2b43f69ba7392aed4b27596999f2b743d111d9b40ea76c02e426d8ee7822d2a2d5b
SSDEEP 768:FQ5lcO9s3gVv2VqwfR816H7dKQztiMy0Jnd8By4sR71JACiXH/T3:FCyNfjH7dKQz5d8hsN1nyD
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
MD5 ab73c0c2a23f913eabdc4cb24b75cbad
SHA1 6569d2863d54c88dcf57c843fc310f6d9571a41e
SHA512 99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
SSDEEP 96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsWebJPDesk.dll

IMPHASH 41e9a68b1898b32849e51e06864d0592
SHA256 a057243d20b92c344c4f81729b3cbdeff752c78a1a21f04f0ef16eadb461d54d
MD5 704dfda5b0998820a981e81ad414d031
SHA1 e6387a2bc7b98e7d826eed9e45e7653eb75c8bfb
SHA512 8253f4e1e1f820e84309d89203d98601137f05bc22861f7330ec0747cd80be798cea0caca3cf1c6abdac0c8cc5011dced68213785080253501c03c62028c281e
SSDEEP 3072:JqGaJBifD3FnhMxCq+X1qQkkc6ncSQ9vyw8gekwvegplJwwwwww6pZaELk5:MBqzFKxq1qdKcS0Hwjl2Jw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount LoadLibraryA HeapSize GetConsoleMode GetPrivateProfileIntA WriteFile SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA HeapReAlloc VirtualAlloc EnterCriticalSection GetPrivateProfileStringA GetTickCount GetCurrentProcessId GetSystemTime SystemTimeToFileTime GetVersionExA GetModuleHandleA GetProcAddress GetSystemInfo GetVolumeInformationA CreateFileA GetLastError CloseHandle CreateDirectoryA GetProcessHeap HeapAlloc HeapFree WritePrivateProfileStringA GetPrivateProfileSectionA lstrcpyA LeaveCriticalSection QueryPerformanceCounter VirtualFree GetConsoleCP GlobalFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetSystemTimeAsFileTime RtlUnwind GetCurrentThreadId GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW RaiseException Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA

user32

PostMessageA GetClientRect ShowWindow GetWindowTextA MoveWindow ReleaseDC GetDC GetWindowRect LoadCursorA SetCursor SetDlgItemTextA InvalidateRect FindWindowA GetSystemMetrics CreateDialogParamA SetWindowLongA SendMessageA CallWindowProcA MapWindowPoints UpdateWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA IsDlgButtonChecked DestroyWindow CheckDlgButton LoadBitmapA GetDlgItem

gdi32

GetTextExtentPointA GetTextExtentPoint32A CreateCompatibleDC SelectObject BitBlt DeleteObject DeleteDC GetObjectA

advapi32

RegCloseKey CryptAcquireContextW CryptGenRandom CryptEncrypt CryptDecrypt CryptDestroyKey CryptImportKey CryptSetKeyParam CryptAcquireContextA CryptReleaseContext RegQueryValueExA RegOpenKeyExA

shell32

SHGetFolderPathA

ole32

OleInitialize OleUninitialize

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry GetUrlCacheEntryInfoA InternetAttemptConnect

jpdesk.exe

SHA256 f897b1c1e7e6ee1fe48ebf13d17375d356a616172a746e69875543e7d734d39c
MD5 42dfd04658b243cd6a8c7c3115bb2784
SHA1 07e6e2e883900f64948bdf23228bf724aca09f6d
SHA512 bd6dd329ccec7aed18c29eaadaead8180f47090acff0494fdb996486702f144a08e0606be1e7a68165f1b7d378ed3695a8588050a4b98afb281fb18b0cd26106
SSDEEP 6144:ueoBXYLh4aDij5piL2YHZiXNdA6PYvr79gujzShZkq1REMdlbFTV25Sn4Ed+cLsN:ueoMpij5piBHYsFj7euKhqMaNi+HpxGm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

2403440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 ccf0f320a4f7e4efcdb56c68b07432104bb1e0e42971f8a1f553d74f7f5217a9
MD5 105980a0428fe04269096ea0b1937183
SHA1 d3be2ceea90c9e47c5e3335e0f96500c7303ab23
SHA512 46f0ab1d1363767e84bbe4e376cead2b6b818f70d6ff434ff2e9e33cf62d4c397019535e6c516d4c1b82fe219a2fc66dd6c4cdaa7281d67750b690f073bb0dd5
SSDEEP 3072:w3c1fP4k2i9+233kCF9dI3LPAXOXln6ELB4WP3P829V8S4Dhg0fn2J6Z2SLqF+CL:KOPKw1dILPAX8ln6aB4WP3E29V8S4Dh+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths