c03fc5fb5c692b47427fcc1a1f9b3d92_JaffaCakes118

resource
c03fc5fb5c692b47427fcc1a1f9b3d92_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/Internet.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/repair.exe

resource	yara_rule
sample	nsis_installer_1

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 ff1d75a3d2af4c3150c427c74b5a1b1046ca2cc3a3bc0aaf11cd87e0cad96047
MD5 c03fc5fb5c692b47427fcc1a1f9b3d92
SHA1 0e6d5e2974430388c6f026e66ab2881167c7c54d
SHA512 ef109e65fd647dba1e11475f025cc10745be9c85ee003fbd4739a96238c3527e551cd2a56c69304e299a4533d6bd99185a1e2e499974fb9b37c7b429daded32a
SSDEEP 6144:MpfotPZUyEETMjh/VWDlM8pDW+0fnAvGGeARke06D:4uMtulvMJfnAweFD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2
MD5 32aa6334fc543e70ef0f792bb9a0c45a
SHA1 54be1f5004f7e5afe7c9ba160495076ea2a4d60c
SHA512 ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae
SSDEEP 192:V6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTwK72dwF7dBdcQOz:V6JaVh4I5rpPbTw+BdhO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/Internet.dll

IMPHASH 04281f88c3d826e409dc7c24629e7efc
SHA256 96100f4ba9563ced97add567f4461541cbe9a085ab5276754bee38dc060a6867
MD5 78d026611a970fe14e983a6b9490ea34
SHA1 cbf63f3aade515f3fc3fbbcc4e12913f1a472d49
SHA512 efbb6bcca88dae073babac2dcf1ad8444c209792cd82820a00483fa365cb899f4979ca29d6ca22de4b975eae2dab8e736a83bc574265925cafcdcfae9cb7915f
SSDEEP 48:qw8gNw0WamqZ3XDo5CKNzt9ymk4q4HSIbYvjDkCLL5HqKI:PPWamqRzqN3vH+fJLL5D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 7868cd55f358bfb360f9eb8ce1512ca0
SHA256 f1c245f152db080cce5a0c8c4ab1c9727721d2f69e22a56955647db9332a3cdc
MD5 952ce5aeeab2b77728a9fd9cb38d2d74
SHA1 0cb1b936dddab231f789813789027965cc46fcfc
SHA512 598a243ad7148f08501da05c5e3e4b9ead817c613bd539c350f84042e2b7a37fa5b24697ca27d474c68b4715a3274f208369f182b70b844f59b3b5f16f5ed36c
SSDEEP 96:Z+yBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tkGhEl5VN:Z+6epxPE1r8/FtmCDtbg5v
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 dc198967b0fb2bc7aaab0886a700c7f4d8cb346c4f9d48b9b220487b0dfe8a18
MD5 7d85b1f619a3023cc693a88f040826d2
SHA1 09f5d32f8143e7e0d9270430708db1b9fc8871a8
SHA512 5465804c56d6251bf369609e1b44207b717228a8ac36c7992470b9daf4a231256c0ce95e0b027c4164e62d9656742a56e2b51e9347c8b17ab51ff40f32928c85
SSDEEP 192:IDO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:TKAFERdlxhGRYUzqZaf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 32d5989ea374e916c260981fc95d7e22566e511624727f19a82fe804512fe491
MD5 95633062af2cb1d6fd19f6023ff55f32
SHA1 112249575e7ec84a64ee40865d7932b4fcca9000
SHA512 62d75e176d6d1f1814df78f1aadd3b996d9831b5bfa59b4b829173a6b95a419451c3aa7b4bc7a13e38c2782ffc1c8c664f49f5529e0d3b550ee42f8fa23e97eb
SSDEEP 384:8lvOebj1CkRf2QJKAl7QQY1jVq9fEnfAXTJGWy5R+E0A9fz9rmAsc0BpVqNl4+Jj:kvpbj1CkJ2QJKAlsQOBUeAXTzyyEh9f/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 7474a3ab078f3104d47784d42bb08786216c3f6173d68eea5497c391ab955df3
MD5 55f5aaa0449ff3f647a58538c64b0ba3
SHA1 5c40dda4d1b15648a0d1a391944c180e29cf6ec4
SHA512 8dbf63c7f856ba261099db49fbf511bdaa6e01f356f5f04823318543deab6c674e520c43fad231a39140f5a9ca9ba8faa6075425b4cf845956d4092df63bd07a
SSDEEP 3072:bXSE7vjHHHHHHHHHH2HHHHHIHHHHHHHHHHBHHHH1kViSowKvfr9:lZdSojfr9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

repair.exe

SHA256 a25cdf7ea1009fd0b89980282b12b7a517e669912c58d1d57ffba7289c25db07
MD5 6d3793f447d58e306518335580810c98
SHA1 67ca33110994368ffa63bb4c8c209bee29b9ca56
SHA512 6fb7d199e8f7745d2284ae74863d133389bf910766718a06b3bb96e9a3fa5f88e5e11be437a3298bc9a640ebc6a32bda6c2dce33808c0f8877f74dbf626f5cb9
SSDEEP 6144:5rcihvKU0a5mcYdoo5Yf6NdEdfy0WEUWwvkL8L3M0:5YiAUBx6/EdKWaB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

529860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths