3793628d232a1c2bcd3d35e12456c05b_JaffaCakes118

resource
3793628d232a1c2bcd3d35e12456c05b_JaffaCakes118
unpack001/$EXEFILE
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack001/$TEMP/$EXEFILE

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH b40f29cd171eb54c01b1dd2683c9c26b
SHA256 df7ff30c3275f7f32233642357b5be884434e64fc60e386659cb6412a142c968
MD5 3793628d232a1c2bcd3d35e12456c05b
SHA1 0fdc57150cad30761780a98c8e9c3752c5c7f0cf
SHA512 70ca39d1e2c73ae8520ea287de8d4a0d1770d9a421cdb2abb4769789805c527b4135b824b28f50ae4206161833298496111a06943ff41ce8e0b3931cf1fac9cf
SSDEEP 6144:D+K0zxl/aEZlr7uLT7Z+NIPYWe5WFxR24kp6PKoi1ryYpb:qz+2qvZnYQF3OA29b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA CompareFileTime SearchPathA GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA SetErrorMode LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetModuleHandleA LoadLibraryExA GetCommandLineA GetTempPathA FreeLibrary FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA MulDiv WriteFile MultiByteToWideChar

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$EXEFILE

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4cc27e18b1a79e729ef3c3032257f3b1e4b5cb55ea34b9e548380b01493cc2c3
MD5 30bfedc658f64ad26beeaf7f86f59195
SHA1 c117d11c71b174dcbc4befa04d0189ef653a4fbb
SHA512 79f3ea5c465220d58e139d9829bd3f00faf4a39113e02b8e549f42496fb62263de4751063a085bf3d2962b15c72728309261f1faf3579e36e99198d7ecf536b6
SSDEEP 96:H/xEAOhcoR5m76X/Rlo/u5LaXiVXLBOCPwveaxhdy+v8:fxUaOm76X/RS2syCCGHd1v8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$EXEFILE.config

SHA256 689393cb6ef8116640554d67c5c5d1742817bb53afb754f14a28134ea8abed8b
MD5 26d995b829f45c1588f33b0e5b465c57
SHA1 1d6a7acaeb2623bbab9b04da4b2e799aa9927a4b
SHA512 3b16c66eee1a4d439f4e4c0a6fb5770e604ddca61527795db766334d9be389159393605337a830f5f99a37bd3f212bc3b3738e059e3f4f37732765341ecfaa76
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Banner.dll

IMPHASH f81377f1c55b7962f1e18d52fc7eb628
SHA256 de59710bad95741c41e608f946d9eb4edacdf73ab92a1a3341f8a160b8952c66
MD5 fcca36e21ca7c4ecfc29f6804acbd76b
SHA1 2f1972d5a0ec8377e043b9b304e62c24c6c38506
SHA512 1885aaf379e6547e519a65751d192beb9f078d63f056886cbcdae75f37f12bf8e89c98fa3c45aa60967e19ba51329a8384cf7a64d851ab10b648b17daf9b175e
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA512 fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b
SSDEEP 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245
MD5 1dadb63a5dfaa0679485c5dbaf96033f
SHA1 d1717aab683c55bd13bbd520d2a91178efa0d676
SHA512 46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722
SSDEEP 384:wck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2PE:wck76gibLCMLDLCx04HNVPE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/$EXEFILE

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4cc27e18b1a79e729ef3c3032257f3b1e4b5cb55ea34b9e548380b01493cc2c3
MD5 30bfedc658f64ad26beeaf7f86f59195
SHA1 c117d11c71b174dcbc4befa04d0189ef653a4fbb
SHA512 79f3ea5c465220d58e139d9829bd3f00faf4a39113e02b8e549f42496fb62263de4751063a085bf3d2962b15c72728309261f1faf3579e36e99198d7ecf536b6
SSDEEP 96:H/xEAOhcoR5m76X/Rlo/u5LaXiVXLBOCPwveaxhdy+v8:fxUaOm76X/RS2syCCGHd1v8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/$EXEFILE.config

SHA256 689393cb6ef8116640554d67c5c5d1742817bb53afb754f14a28134ea8abed8b
MD5 26d995b829f45c1588f33b0e5b465c57
SHA1 1d6a7acaeb2623bbab9b04da4b2e799aa9927a4b
SHA512 3b16c66eee1a4d439f4e4c0a6fb5770e604ddca61527795db766334d9be389159393605337a830f5f99a37bd3f212bc3b3738e059e3f4f37732765341ecfaa76
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/b56a64536fe34301bb3a63a7300b0151.txt

SHA256 f26d30c4cc5cf9bdc09c1a5bea9f044737fd132a27bfe72a6d22fb19b578cdeb
MD5 4024e1829a86df7d3e27a9f7e3f4f2fb
SHA1 c8c2a968a78c5486c3497da03b0ad99c4a4dd05b
SHA512 81f39f29cd920d77ce62e48f295e2d07c73072ce34c4a8f897ebf13928ed798b11557da93469437c8adfbb4cf97acff087ee37c82e7211b4882702e9c91c6a0a
SSDEEP 6144:V/aEZlr7uLT7Z+NIPYWe5WFxR24kp6PKoi1rp:02qvZnYQF3OA2v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

b56a64536fe34301bb3a63a7300b0151.txt

SHA256 f26d30c4cc5cf9bdc09c1a5bea9f044737fd132a27bfe72a6d22fb19b578cdeb
MD5 4024e1829a86df7d3e27a9f7e3f4f2fb
SHA1 c8c2a968a78c5486c3497da03b0ad99c4a4dd05b
SHA512 81f39f29cd920d77ce62e48f295e2d07c73072ce34c4a8f897ebf13928ed798b11557da93469437c8adfbb4cf97acff087ee37c82e7211b4882702e9c91c6a0a
SSDEEP 6144:V/aEZlr7uLT7Z+NIPYWe5WFxR24kp6PKoi1rp:02qvZnYQF3OA2v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer