fbb90145e9e5f6466147e5c280dc0b63_JaffaCakes118

resource
unpack001/$0/questurl.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/$0/uninstall.exe	nsis_installer_1

IMPHASH 4a9446e5cc2412c6405cea69dddb93be
SHA256 2e5d4efcd41c904f184fac0f2839d018fe71145ef204f47ce5802321b3d9fea3
MD5 fbb90145e9e5f6466147e5c280dc0b63
SHA1 7b7396ba629372f90968bfc84f30d79d64a50751
SHA512 e467972ca994099a378a1e1da1f849d26f0dc92aaf0c8c37bd2c195f9b94872326bf3628a373fdd2ee4eb113a618d3a7631a51765aa2f7840add6a8e9f123c22
SSDEEP 12288:MHniuTZzqNcY7f/t2H0xZBluDO1uHIUcP4DRIKUp7JQvFVyN:MHniuT4e+/fxYtzC4n0Q/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ea:2a:2d:67:41:c1:cf:f6:e6:91:e5:d4:90:72:d0:7a:92:37:63:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QuestUrl.com,O=QuestUrl.com,POSTALCODE=90245,STREET=Suite 2020+STREET=2141 Rosecrans Ave,L=El Segundo,ST=CA,C=US

Chains

Apr 28, 2011

Minor OS version

0

Major OS version

4

Entry point

13006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess lstrcmpiA CopyFileA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$0/questurl.dll

SHA256 033318ac1a0fa9c3fce6e7deb2df67dbe4e286d61f8198e293fcb642923dcb0e
MD5 4089fdcf40af70743ca059a734b9da77
SHA1 55821cd721cb1c4bcff4e54bea1432a536ae9b6f
SHA512 c1acfee36b4b62b41ca007731ae39eb5ec4230b0bf66521c81cbc5ce671a8460b36b91e990e366126911c27b6517cf3378a4f3947b3328d5666cb157c61795e1
SSDEEP 12288:n+j4kB3jA31ZNc0uwAP333QMx0fpxnzj1S87uY/uXfm:nik3m0LA4Mx0fpp/1S87pSm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$0/questurl.exe

IMPHASH f0249fd62be0885feb1772c151a83e97
SHA256 30f44d4e31d5bbe59ac9aa99ef139880e8bdfb466be0c60c082184149d9fa1dd
MD5 562d4920a84b669cfbb1be163a6a9d3c
SHA1 00af37e3fb9b41daf5c4c05c1609d4fa8f91ee5d
SHA512 b3e36262229e15d47b8956ce5ae1776bd4510c1e93686a28255fcc4915ff168a43c47d1b9b350da9e11e84f8f5708a09104ff24f788ae5536419751668f411a5
SSDEEP 768:7lNP5bj9oDHSqlnfAobIhmBOvBY3OTNiDVD+TpeYKZ62OtOAyMAV1l:JX/9YHSyn5fBOvG3OTUDAzKZ3cL+l
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

22815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$0/uninstall.exe

IMPHASH 773e933db287d0293e61a62d958e00ab
SHA256 968f9320876119b4fd3bdee48dffd83fab0c47c03732148e7124d2af3c8ef873
MD5 a8cb4c299acee185c94ef6f3c23efced
SHA1 1d938f6655cb713344d45e9ab49bc683042de893
SHA512 fa3573593c67b478cf80d9a8be5f7a342cbaa392afd22ff4a00b19c12c60a8aec23cc8226dab9575029225d4fd9b591a9ec6ff0451f8648480c113204856430c
SSDEEP 1536:8EkjY1zy214Qay0DGkJ7qAELVigJIdUcpVPVwfdEOk2/DVZFE:bkjAJ4dDGkJ+AI0XzNwf2U/P
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

43:da:70:4e:45:e9:88:50:42:8a:3f:c4:27:b0:2d:ba:e0:1f:3c:73

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=QuestUrl.com,O=QuestUrl.com,POSTALCODE=90245,STREET=Suite 2020+STREET=2141 Rosecrans Ave,L=El Segundo,ST=CA,C=US

Chains

Apr 28, 2011

Minor OS version

0

Major OS version

4

Entry point

12628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess ExitProcess lstrcmpiA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b3d296ff6f7abb1319ee006fcc6c4d98
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints GetClientRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA PtInRect LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA OpenClipboard

gdi32

SetTextColor GetObjectA SelectObject GetDIBits CreateRectRgn CombineRgn DeleteObject CreateCompatibleDC

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder SHGetMalloc ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 e5dec4f9e9cc979ba5721921c6a978f006904f74fe6ecfc2b24ed873363f498b
MD5 3786e12c08b60fee6ab7f22f536d4878
SHA1 23cc391f3c1407bc8ad1b35c0c94591980197fd1
SHA512 6a962c9695cfa84ce7a8304c0098631a8c408164b0d600e01c9933e59d968af70ab033f53b37bcd715cc3d33757380ea15c5861a2b31f46975501ea0cc3f3e48
SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwocd5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1keTY/Zk3vX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/InstallOptions.dll

IMPHASH b3d296ff6f7abb1319ee006fcc6c4d98
SHA256 551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
MD5 d765c492c21689e3d9d61634371fd861
SHA1 ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA512 9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
SSDEEP 192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints GetClientRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA PtInRect LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA OpenClipboard

gdi32

SetTextColor GetObjectA SelectObject GetDIBits CreateRectRgn CombineRgn DeleteObject CreateCompatibleDC

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDesktopFolder SHGetMalloc ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
MD5 fe24766ba314f620d57d0cf7339103c0
SHA1 8641545f03f03ff07485d6ec4d7b41cbb898c269
SHA512 60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
SSDEEP 192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 4868ee046975b35282e7a613526d3c9d7b3e0b1122794238d286aa464b0b5bd1
MD5 81b9854cd40b04c3d50391ea6d28c61e
SHA1 d31ae147cac2daef64aa27dab5179334e2101da8
SHA512 cdf7d0924536c3ebd58bde52617287035d481b4b07622efd6a0e37cefeffe1a6cdb42c80b2b94e9ab57006bbf981fb8a23b87cf00783cd73e5419a5c5880facf
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 e5dec4f9e9cc979ba5721921c6a978f006904f74fe6ecfc2b24ed873363f498b
MD5 3786e12c08b60fee6ab7f22f536d4878
SHA1 23cc391f3c1407bc8ad1b35c0c94591980197fd1
SHA512 6a962c9695cfa84ce7a8304c0098631a8c408164b0d600e01c9933e59d968af70ab033f53b37bcd715cc3d33757380ea15c5861a2b31f46975501ea0cc3f3e48
SSDEEP 384:QeH0fR9FDyy4pqeTbmd811S729+D9zUug+1Sp5xwocd5AK5G1/Zk3Ju8X:vQEy/eTbmd811S729YAu1keTY/Zk3vX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer