c0aaf1e29a4db05ffca7c108020083ab_JaffaCakes118

resource
c0aaf1e29a4db05ffca7c108020083ab_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/aminstall.dll

resource	yara_rule
sample	nsis_installer_1

IMPHASH 9632e80596371cfa7f563f680f3c4498
SHA256 fd37bbba7671d0620e521c605de9765cab9f9bf031b2a5e507ec67cd174e3068
MD5 c0aaf1e29a4db05ffca7c108020083ab
SHA1 33bd6b8297336c6d37bef0d4a8586f9986bcc335
SHA512 7465a6bdd7978bb6ce41afcced2ab738709f144ae40710b29a6f3b987525a41dd3bc9cc79cd1d3ff5b2116e7a75fd4bf931e291432814a215f0c6e4510fe5f9b
SSDEEP 196608:7y+KRgm/XijxwVfbbiaufpAGTVMMkmSPYtiY03Vk4T69Rb9u1luQz/:u+KRzKjcbWhSAtiY0+aAI1lP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

kernel32

SetErrorMode GetExitCodeProcess WaitForSingleObject ExpandEnvironmentStringsA GetEnvironmentVariableA lstrcmpiA FindNextFileA DeleteFileA FindFirstFileA SetFileTime GetFileAttributesA CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA CreateDirectoryA SetFileAttributesA CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetModuleHandleA ExitProcess lstrcpynA GetCommandLineA GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GetVersion GlobalUnlock GlobalLock GlobalAlloc CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA EnterCriticalSection Sleep LeaveCriticalSection InitializeCriticalSection CloseHandle GlobalFree LoadLibraryA GetProcAddress CreateThread FreeLibrary MultiByteToWideChar GetCurrentProcess WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose MulDiv CopyFileA

user32

CharNextA DialogBoxParamA GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA ExitWindowsEx InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint PostQuitMessage

gdi32

GetDeviceCaps CreateFontIndirectA DeleteObject CreateBrushIndirect CreateFontA SetBkMode SetTextColor SetBkColor SelectObject

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegDeleteKeyA RegOpenKeyExA RegDeleteValueA RegCreateKeyA RegCloseKey

shell32

ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHFileOperationA

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 3764e6c387ce3c76b39936a24d523dce
SHA256 75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84
MD5 4c7d97d0786ff08b20d0e8315b5fc3cb
SHA1 bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c
SHA512 f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a
SSDEEP 192:6KdqJ4Bhf1mdCMI26t510swClJOeFIsm7F1QuPs:6KdE4zAddwR0swqOeFxu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH aebc3107701149edfc563b8db7a789fd
SHA256 4f945ad53b7aa8ed516b2f58c2ed9f15c13bbdf0e489d71c7347b80583cee5fd
MD5 388c408cff35a38d04e3cda18f63af07
SHA1 9c2aa2ed8b526ace4267acbcf5648b2601019ac4
SHA512 542292d61ff209f6c98c62ebad549024611a7d42fb951f8cc211b886f0d202d5e0da3b754c84c8a00043c748ed527351fc524357412cf88875e6bf729cbba46f
SSDEEP 96:MFJsQxcnqakqeStS6+NMKQwECv0nGhFZxTxZ05hU/61:C9xcnqakCN+N9n0na1K5y61
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 445ca064c668ebcb89957d525a8bef23
SHA256 4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67
MD5 e085476805e8f5ef1c7ed635c5309017
SHA1 609e79fdc29d6dee40cc5dd333094db5f9f63eec
SHA512 082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f
SSDEEP 96:DomrrPB3x4gJcp7/qzt1SGr3DEkJjUFezthPhwrWNHRW5j5/Y0+YAZIhtyPEM75C:nnTEjwT3XgFshpwrlR5/7AZlTpVHlmV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\Cpp\!nsis!\System\Release\System.pdb

$PLUGINSDIR/UserInfo.dll

IMPHASH 48cfa0ea7e353e4a7dd23572da8374ef
SHA256 25c4f65b02eca4ad897d7a623b3ca1290bac836e98ab5ee5f6c527dfb6a41dd7
MD5 419d642fe3436fda8bb22eea9c37a6ca
SHA1 c1644131b880c6e03f14de3c79efd27093a77908
SHA512 29df088e3b5189efd6fbeebc2f23c5850303d40fe5331cd336bb852d986f9ab66f7bcd963ebf8c4e4eea7d49a6590027490d651a3e4781024c7983a2c456a337
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_3_

SHA256 f29200f61bfa4d61a32ae45d8f408a5a0f9b419e528d7575a27ab7d18d0de084
MD5 6de22913ed7419282acd902dd3f295e9
SHA1 d9dcde04783a1d3ed19e66aaec0e88151cdfafb2
SHA512 516a947449ba49755fa7348653be788db0126b1c957194d89c6748099a1efb0bd9b8d9dd97062dad62e09282263264419d611efd0a711a936ed190d91206a9c5
SSDEEP 96:lSKRP00BMa1h1MIVw2sqxYRXh5ey4k3g8+aBIkuNvk/:lgK1tVsqxYRXh5ey4k3g8B2Ne
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

aminstall.dll

IMPHASH 76fbb9b8004920fe4df42a7f9c664001
SHA256 a5240dd109c8721f3d8b0279375dff0044c5461cf68306eae9267fa122f0caf1
MD5 2ec42398e55da7ef94b72261b9a598ea
SHA1 ebb8ea2af408b985117930b214b3ac9fb9bfb27c
SHA512 c5532c8f7628c56f2aebd311261202b3764d1a04111dc90040de9711f7df49dfc71fd9b674b1d9251052bafec0b6dff9f9b49ec79fa2fb484fda7891905edb77
SSDEEP 3072:N5ejXjok9otaxPAWe3TBfywbl0UjpXwtep6+BR:N4jMk9ot0AWe3TBJeUSMR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegSetValueExA RegCreateKeyExA RegCloseKey

kernel32

GetLastError RtlUnwind RaiseException GetCurrentThreadId GetCommandLineA GetVersionExA HeapAlloc HeapFree HeapReAlloc FlushFileBuffers GetSystemTimeAsFileTime TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetProcAddress GetModuleHandleA SetUnhandledExceptionFilter ExitProcess TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter LeaveCriticalSection EnterCriticalSection VirtualAlloc IsBadWritePtr SetStdHandle IsBadReadPtr IsBadCodePtr GetACP GetOEMCP GetCPInfo InitializeCriticalSection InterlockedExchange VirtualQuery LoadLibraryA MultiByteToWideChar VirtualProtect GetSystemInfo GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapSize InterlockedIncrement InterlockedDecrement GetSystemTime CreateFileA ReadFile SetFilePointer CloseHandle GetModuleFileNameA WriteFile SetEndOfFile

user32

MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer