c8369302447663994f8a624f6e37d440_JaffaCakes118

resource	yara_rule
sample	upx

resource
c8369302447663994f8a624f6e37d440_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsWebJPDesk.dll
unpack001/out.upx

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

SHA256 1a6cda06edf1eb65697a86c2042455afae400c76a6dc8e2af28fff4667b7584b
MD5 c8369302447663994f8a624f6e37d440
SHA1 55fa3c3066a19e013e99b6fabe9e5cc30a085fb2
SHA512 763cc5accb202b36f456d894838f00e1a77f75d9a9ea4edbf1b39828afd673909753757e7c7502e991a0652973fbe3b61ec00ca8251a1994222487f8990a19f2
SSDEEP 3072:PgQWi92i9+233kCF9dI3LPAXOXln6ELB4WP3P829V8S4Dhg0fn2J6Z2SLqF+C4VV:PgLw1dILPAX8ln6aB4WP3E29V8S4Dhgg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

316528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 fb7cf5e9b42f7a5a4ab31e59708b00ef4feee9d24f3ecc400026bcda9a1969f9
MD5 3ab8215a12c408f238619d28579084fc
SHA1 57e08898a2a595d5059f961c6be485441e62ad5e
SHA512 c4b094eb9fd9fad54fa98806f5a9b3b76ec0ba5e8b421fc797141209d6ecfb50092df99bfcd3aa243e225e37f014b2c9c903e65ac6a73a7c62ea84316f18e7b7
SSDEEP 768:pGg3FD11xkIP3CEndothHLDBSatt6FxmULUC/SesU3xrZ5939g+eGQQ3DGohn:pGg3XkIPDn6nrXtt6FxmUL7QYGo
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 2df3b204a3809a6abb75eed7c3b6cec7525f49c689474d3ae5f6e8e47ca61dc0
MD5 1f1fade65fa369e0652a39f0c4e438ec
SHA1 af2bf0b7abda4e6d133a7c6bcad65700b13d5230
SHA512 2e2088e8d714ba215dca55c31d26f2c7b89462d7111da4ed881cfea8cafbd35bc8c90123775bb4bac94e4726408255a2928c6c227107e8482aaa368fe3fd853b
SSDEEP 3072:PD7umP4dt+rOx0s9+bbqRpbP9PPBPxPPIP3KhKKVKIKmQ2yAy3DIe0m9:PfumP4dt+ix0s9+bbqR5P9PPBPxPPIPx
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
MD5 ab73c0c2a23f913eabdc4cb24b75cbad
SHA1 6569d2863d54c88dcf57c843fc310f6d9571a41e
SHA512 99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
SSDEEP 96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsWebJPDesk.dll

SHA256 67c186d5b5a217e48f83bd73b7e4090a31493236a9a34f1f51f0f8386c3fd86e
MD5 e1feb7e3362e5acb3ee811b3055aab2c
SHA1 cfee2131885806b90cf65a285cf62edd7637d84d
SHA512 e7392f68caf4629603bfad4346b70dfc0d80bab58f5d37bc4eef9bf976de16cbd7773c005e5ced4a1b1cdac6cece74aa7d83adffe3529fc944d1df8214068313
SSDEEP 1536:FA6ivWCLc2LoUYig13XQSgFaKMNmIgLR/cjJ/+tVkzgsQpdqTVbr:BivWsCitskrJiItRdyr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

26934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 d772a93c83424d4cb0643da123600619e863149c2a521fc0d167fc7e0f342994
MD5 5fd8dc0cb290b4d58a1ac4e31dc68ab6
SHA1 f6d4c9d405297de9b7dd058d32f5eea4ed64f5c1
SHA512 e30f9b1cfc2ed28a121f8af5640f3a04b6bcdae2e6d2d59fd039dc053d68170267dffdf34ea36756d3fd7c1236a8f0ee86c3658992bc2e61f744130dff31fec7
SSDEEP 3072:w3c1fP4R2i9+233kCF9dI3LPAXOXln6ELB4WP3P829V8S4Dhg0fn2J6Z2SLqF+Cr:KOPlw1dILPAX8ln6aB4WP3E29V8S4Dh+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths