68bf896809c8f7ddc9c741357736ce67_JaffaCakes118

resource
68bf896809c8f7ddc9c741357736ce67_JaffaCakes118
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc3.dll
unpack001/$PLUGINSDIR/locate.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 c5a9ebfdd73e78b688c3ee1b034ef5ec7e4629521a3ec0bae37ead0f4515b38f
MD5 68bf896809c8f7ddc9c741357736ce67
SHA1 29a8dfa895ef77f97a8af199eb7d205803bd63a0
SHA512 1b827ddd7a7b4c9cb8763c474e69d8dc991e1700e5bd3155f04fb0834dce61040f4ebc62baa7b169d146a6f66f19bdbbc00316971973df43b3422a0f8019b3a6
SSDEEP 6144:tsxhgsQ5Ajc9SOBXbsIU/KSvnqJ9ebcmAyfwn3:6h05En0XbsIcZqJ9fmon3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/1clogo.bmp

SHA256 92cd9abff257db3984e52839f6e53184c745b9eedd89b16bc30a8429c8036765
MD5 7eaeeed795a94ce15fbe90bd2aee1099
SHA1 58a29012acc3c59890f35f5764eeefc45ce24266
SHA512 b0f3af9077bbd2291cd66c8233df1660bcfac6314f588b0b501ee86cb94440a6e99d41d0dbb38736a6dcb6291d77263cafe5525f05dbda4689cdeacb2ec26dc5
SSDEEP 384:HGXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXR:DYFqZC43K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/accept.bmp

SHA256 7baca1380f469042514a5fef60dde2361aa47e8bb0fe8e01c1ec175d22c97251
MD5 d2b45ba831902d1f030b7090682cfa1e
SHA1 398c9098d01b3d333ed11971cceb4d685a561814
SHA512 c195b1aeea3b35c111750ab423bbdd4c03ad81701539db77961f079eefce80da013ed1341254d38ea819528ea50e4de5236f2e9d10c4f7d7eb17db65d70919fb
SSDEEP 48:Fg2Cnww2i1SJ4Gw102JLDJ111hZKtZVpPjB8kmM5vfr7GDoxetl3g8uZ:Fg2OD1SW02JHF0tZVpmhM5vDaw84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept1.bmp

SHA256 114c238c17d1cbc30e0d1f30fc5db00f6cfa579d27f755b6494bdcf1687e285b
MD5 cec7eff3bd27fb989b1862b65cf92bef
SHA1 4b61a2778f759e8b6c5c5fff51d0607455528480
SHA512 2bfad999a07d4126a83772af059af66f97a1a3e2156e486309639c0d7efcaed57933faa80f295429eff2cbcd450c4851d191e2f370ebed06fb45a12dd922a1b0
SSDEEP 48:Fg2CsF1wk8ig4C7Q10DGG+D9HG1111jZgHI5PjlimMxrhoDUgt3g8uZ:Fg2l192G0DGB9syH45PMdhwLe84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept2.bmp

SHA256 f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e
MD5 f642e8cfce23aa5d124533357de7394b
SHA1 80ce98a2bc4b416db357ea52a74424d742cfaa55
SHA512 d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26
SSDEEP 48:Fg2CsFXtwOW3iC4CnE10DGGiGpUDQ1116ZlNCmNdFIz6PjfmMMrhHDaBr3g8uZ:Fg2lXtJz50DGXGUZrUmND3yMShj/84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept3.bmp

SHA256 b77cd138ed85e75c1e68d8c4709db2b4bdee1cac79cd56fde3d10f9c2199ebd9
MD5 f9fb54ee9ebc5ca38459de73f3055784
SHA1 d2e58aef1bbebfdf4265002b12f402fb805d2bce
SHA512 f821a21e77be530db3aa0b80cca0157f39fd905f1546a85ee94b3ba6e28cc91fe186cb43cd8684bb6306b249ece2e07552655b03c11195c854689e308bd38b18
SSDEEP 48:Fg2CdtwWoiI4E10jUDK1116ZuWdFv6PjImMxrCDYV3g8uZ:Fg2ctvy0KrUWDChMd6l84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/bab_off.bmp

SHA256 1ad7a0167392f615c859d2ffab5f71eb9d0e3dbc389fa3f0113e00ed19e13837
MD5 1f318da2aa637ed250b01458ed307b75
SHA1 09269aeb456ccad34b82ad3c258a24318d0dd169
SHA512 4341a0d10c185bb8ac8d2c2f57df9d13a62530f8ea48e4a527ec5fbdff63d5437dc223d9361a1f29354287def43d2d94ed6941b7f017f41a93f378edf3a23534
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bab_on.bmp

SHA256 82d0504a6f53e6d347c2da6e19dac7693422ce4f2823c05de285712f7a23bb8f
MD5 f68b98f565d3d928b4d7b7fc9e0c7560
SHA1 8766193fa35770833b1c4037fb5ef12c83a2d68c
SHA512 f111590febf373ca783de4c3bdf7bf2fcb7197ac71d7450c6089035592c2ac4dff34fcdc5277925e9399e21f92116631f3f4596f70372200d1022e2257fdc1e1
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/decline.bmp

SHA256 eab3f8b4cada67892acc64a6233742f1c81d1709e7b5eca06672378a9b54005c
MD5 4e34c7ad18913485c49528203402b4f1
SHA1 5d3229b72f7d8203c6a3e4bd1dc36337589a8be8
SHA512 8fbc89ed67e5a932591f62dfc7a095f9be65c5da5ca037c2b7264d2e5d7137bb6601da527d53c7559afeef85b958ef934e851f3fc42b2a0a8d84ed794f7ece07
SSDEEP 384:Fg7wXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7X5:FrXXXXXXXXXXXXXXXXXXXXXXXXXXXXXl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc3.dll

IMPHASH 1dd454ac5c9407d14ae23ee8e8cd4203
SHA256 fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
MD5 9d8ce05f532dc7b5742831ec8a63c2d8
SHA1 b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
SHA512 98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
SSDEEP 384:Aj+e6b0GUi0VV/0BiYkUm4i+Hr4Bc+AmPiMUTMF620Ac9khYLMkIX0+G2CykiDM:Aj+e6byNskUbi+Ly8xMSMj4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

16031

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strtoul strtol strchr memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

GetFileSize lstrcatA GetTickCount SetFilePointer CloseHandle DeleteFileA GetLastError CreateFileA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree lstrcmpA SleepEx GetProcAddress LoadLibraryA MulDiv GetModuleHandleA TerminateThread WaitForSingleObject CreateThread InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep lstrcmpiA

user32

GetWindowLongA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA SetWindowPos SetDlgItemTextA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA

$PLUGINSDIR/locate.dll

IMPHASH 7f8181c74f882a780c7cd485241e8b51
SHA256 d88a04c1e39db583eaad727fd390fe599ab10198ee040bfbdd22daefadbd2372
MD5 7d3317f57c1a368480ace3c0ca804eeb
SHA1 d4c7e185bc64aac82339f51ba6c21cf0713c9f1a
SHA512 5598c2e6caa2f66edd48f8c8305e054d4b0740b5f2b7ed92cf197a13ac66ba99a32013d34b3c2e28d007ab7979eb90a50681324eb736b1410e7df1902e4ec32a
SSDEEP 384:ev/vPBkA6dK8wiLe45naPji7hpx2kRV+qgm:evyvwiNnGji7Xxjc8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/skip.bmp

SHA256 a4acb445bdc94b951334ed467a3d165446457487f70877f7554e1d8e7afdef58
MD5 f2f64c5809be74da2dfe6e0eea5a4242
SHA1 6ec394130b6ef5fa5945c629f1aa157cdbde9814
SHA512 7769c5fafb26b07d22227c6d9d5e12082d2a0f94584c174f9cf41165bcabb2c061557544fa14e421433f3cac8b0ef9a5aa2b797ddbdf5a12660e89c40e3ad72e
SSDEEP 384:Fgye5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA:Fw5XXXXXXXXXXXXXXXXXXXXXXXXXXXXA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/stvheader.bmp

SHA256 92cd9abff257db3984e52839f6e53184c745b9eedd89b16bc30a8429c8036765
MD5 7eaeeed795a94ce15fbe90bd2aee1099
SHA1 58a29012acc3c59890f35f5764eeefc45ce24266
SHA512 b0f3af9077bbd2291cd66c8233df1660bcfac6314f588b0b501ee86cb94440a6e99d41d0dbb38736a6dcb6291d77263cafe5525f05dbda4689cdeacb2ec26dc5
SSDEEP 384:HGXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXR:DYFqZC43K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/v_sign.bmp

SHA256 b371a34ff2eee757b4b201303c175cc7c67d0a1ae940cd9ffdc399ce6260911a
MD5 d988221412cc88fb7837b949bd4f3ee0
SHA1 eff16cfeadddcbd651f1e891007d1decb813d22a
SHA512 56b32a1bc7875e490754f57eabf81433286926e89e8c311b62911b64d81ee406a646266d927902ff3ee14e09071f780c90679438754bee618408d832b5f14928
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/x.bmp

SHA256 fa38e6ef9c8784caeeb7013d9cf9c7357ed018ca8f6167a956350a8676b28a00
MD5 987efa59699d4b9b6a8c51c537cde81b
SHA1 5a551f50c1447d273d843d4766f5cafd16bd7fa4
SHA512 983e24dfc672951d2be94ce6c3df9ad74478852344a32fa184b22c17829c370ee9500982a5c0f316c2bbae6f2e5f2ae2aa5bc8004e739dae1ef8dbc2c22cd8a7
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer