JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4
Size 353KB
Sample250121-vlsafstrgl
SHA256 bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96
MD5 0626220c6b36b91ef947bfadb5ffc3b4
SHA1 3d90a5f553480b4e27aecb1529a0f355e1304615
SHA512 fe4ebbe0f4111ed569f64be4c57d6bd2345f853973ec8f1191a5d15de5fae85a43b38bdf53a0369414672c5e8320721605bbc3efb466aba78010837f0bf2ef0e
SSDEEP 6144:WX7eov9mh+35YitVNuwGwKl+/97/x0jG4nO8NZHATQW+F6YYN+onLYcyz:4Ah+35Yit8vUF7/xN4N/Az+4v6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsBrowserOpt.dll
unpack001/$SYSDIR/cont_milehighads-remove.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$_5_

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$SYSDIR/cont_milehighads-remove.exe	nsis_installer_1
static1/unpack001/$SYSDIR/cont_milehighads-remove.exe	nsis_installer_2

File Explorer

JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4

.exe 353KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/nsBrowserOpt.dll

.dll 346KB
$SYSDIR/cont_milehighads-remove.exe

.exe 99KB
$PLUGINSDIR/InstallOptions.dll

.dll 117KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/validate.ini

450B
$_5_

.dll 356KB

JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 bc89ef35f15c4ae4268961e8a8bc53a883afe23b3bf8e841a17499e0e9957b96
MD5 0626220c6b36b91ef947bfadb5ffc3b4
SHA1 3d90a5f553480b4e27aecb1529a0f355e1304615
SHA512 fe4ebbe0f4111ed569f64be4c57d6bd2345f853973ec8f1191a5d15de5fae85a43b38bdf53a0369414672c5e8320721605bbc3efb466aba78010837f0bf2ef0e
SSDEEP 6144:WX7eov9mh+35YitVNuwGwKl+/97/x0jG4nO8NZHATQW+F6YYN+onLYcyz:4Ah+35Yit8vUF7/xN4N/Az+4v6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
MD5 997ae296af5b7ca9aaa52f6844075439
SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
MD5 32465a07028b927b22c38e642c2cb836
SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsBrowserOpt.dll

IMPHASH a956f8fe64d9f55dfd05f40e46715b6a
SHA256 3ecdf73e76df53fac77110170d203e4f27f5751a728b85732ee7269d96413162
MD5 2dd8fcef25c5238b7f03f39fc6288cde
SHA1 85c4e016f0a0fbb6b94026a5ac92b1ad7730c65d
SHA512 62ffe3745e16421d22e8e9be6329cb5ecef102012c0fe9bcfdaed5124fe9557700225af35d07381a9dc6e17fcc9b15a25aed6b95f6194bf793ba8a82062a6745
SSDEEP 6144:RSf8qGJH+sm9HOP3C6RUT8zrn5noK06HwVu2ge7eiTLg8862iZc1TBriH/acZo:0f8qGZ+smR03C6RUT8fn5i6HwVu2get0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

131340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_GetComponentManager NS_GetServiceManager NS_Alloc NS_Free NS_CStringGetData NS_StringContainerInit2 NS_StringContainerInit NS_StringGetData NS_StringContainerFinish NS_CStringContainerFinish NS_CStringContainerInit NS_CStringSetData

nspr4

PR_AtomicDecrement PR_AtomicIncrement

kernel32

InterlockedExchangeAdd lstrlenW EnterCriticalSection InterlockedExchange LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetEnvironmentVariableA CompareStringW CompareStringA GetDriveTypeA GetProcessHeap SetEndOfFile CreateFileA GetTimeZoneInformation SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetModuleHandleA GetStringTypeW GetStringTypeA GetLocaleInfoA GetCurrentDirectoryA SetFilePointer GetDateFormatA GetTimeFormatA FlushFileBuffers GetConsoleMode GetConsoleCP ReadFile HeapReAlloc VirtualAlloc IsValidCodePage GetOEMCP GetACP GetCurrentProcessId QueryPerformanceCounter VirtualFree WideCharToMultiByte MultiByteToWideChar GetFullPathNameW GetTempFileNameW GetFileSize MapViewOfFile UnmapViewOfFile VirtualQuery GetModuleFileNameW CreateFileW LocalAlloc CreateFileMappingW CloseHandle LocalFree WaitForSingleObject TerminateThread Sleep SetThreadPriority GetExitCodeThread FreeLibrary WriteFile GetProcAddress LoadLibraryA DeleteFileW GetTempPathW CreateMutexW CreateProcessW GetTickCount GetLastError ReleaseMutex GetSystemTime GetSystemInfo GetWindowsDirectoryW GetVolumeInformationW MoveFileExW InterlockedIncrement InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA HeapFree ExitThread CreateThread FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileW RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo HeapAlloc GetStdHandle GetModuleFileNameA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy

user32

GetWindowRect GetParent SetWindowLongW ShowWindow SetWindowPos GetClientRect wsprintfW GetWindow MapWindowPoints SystemParametersInfoW PostMessageW IsWindow SetWindowTextW GetWindowLongW SendMessageW CallWindowProcW FindWindowW

ws2_32

inet_addr

rpcrt4

UuidToStringW RpcStringFreeW

imagehlp

UnMapAndLoad MapAndLoad

shlwapi

StrStrIW UrlGetPartW UrlEscapeW PathMatchSpecW UrlUnescapeW

wininet

InternetReadFile InternetConnectW HttpSendRequestW InternetCrackUrlW HttpQueryInfoW HttpOpenRequestW InternetCloseHandle InternetQueryOptionW InternetOpenW InternetSetOptionW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

RegSetValueExW RegCloseKey RegDeleteValueW RegQueryValueExW RegCreateKeyW CryptDecrypt CryptDestroyKey CryptEncrypt CryptDeriveKey CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptGetHashParam

shell32

SHCreateDirectoryExW

ole32

CoUninitialize CoTaskMemFree CoInitialize

$SYSDIR/cont_milehighads-remove.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 a335978dea32d6c9c587c074d74ffe10bc08387d763a8ef85a9995c05097a087
MD5 b848c9ff117e8a3e664cabbd04a4a6f5
SHA1 b04ad42b93a05a280378eab33225bfe47af55f77
SHA512 edd410b981b30d2b19f4cafd3f888540f24ed9e2b7d21756b8357a6a53088ca27a0673e4f3d6010dcbce449779afb889483a57e50aa07a378b8ba4989a883c69
SSDEEP 3072:Wd/vyWmJ8XKEvixA+D1eb4HzEeM/W10ofRKzd0x:WXrdoA+D1e8yafAzd4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12837

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 0dd66824726715358a99b2af20e0b80a
SHA256 44e729371099650904bcd5db0af7fdad6ffc01e336ae464f0bb151f329175292
MD5 cd6e705cc6992e869f488ab211ac37cb
SHA1 c9c71edd929c15bcf5ee286d4a9e9259d1590eb5
SHA512 460173bbcff640721e54bb403e1f46d274e649a9db7d3b83d009a7f00354d434874dfdc009679e98cfb05548801b9eee78c25fe17b083fac396087ad3327debf
SSDEEP 1536:G8jeHR5cxDyiJu+Sp3o7lCNj+fgERBNxOtyg5Fu/oZSY0vXuHznnULYU455YQ+5:tZHK4Z2j+fP31gu3eHTnULB455y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

48256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked

shlwapi

PathFileExistsA PathFindExtensionA

kernel32

ReadFile GlobalLock CloseHandle GetFileSize CreateFileA LoadLibraryA WideCharToMultiByte HeapSize GetProcessHeap SetEndOfFile GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle HeapReAlloc VirtualAlloc HeapAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA ExitProcess Sleep InterlockedDecrement SetLastError InterlockedIncrement TlsFree GlobalUnlock GetModuleHandleA GetSystemTime GetPrivateProfileStringA WritePrivateProfileStringA GetDateFormatA GetTimeFormatA MultiByteToWideChar MulDiv lstrcatA GetCurrentDirectoryA SetCurrentDirectoryA GetTickCount lstrcmpA SetErrorMode FindFirstFileA lstrcmpiA lstrlenA lstrcpyA GlobalFree GlobalAlloc lstrcpynA TlsSetValue TlsAlloc TlsGetValue GetProcAddress GetModuleHandleW DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetFilePointer RtlUnwind GetConsoleMode GetConsoleCP WriteFile LeaveCriticalSection EnterCriticalSection HeapFree GetLastError IsDebuggerPresent SetUnhandledExceptionFilter GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter

user32

MessageBoxA wsprintfA CharNextA SendMessageA IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA DestroyWindow DestroyCursor DestroyIcon ShowWindow EnableWindow GetSystemMenu EnableMenuItem CreateDialogParamA GetWindowRect MapWindowPoints SetWindowPos CopyImage LoadImageA CreateWindowExA SetWindowRgn GetClientRect SetWindowLongA GetCursorPos ScreenToClient IsWindowEnabled GetWindowLongA DrawTextA DrawFocusRect GetSysColor UpdateWindow SetTimer GetDlgItem GetDC ReleaseDC KillTimer GetDlgCtrlID PostMessageA ValidateRect LoadCursorA SetCursor GetKeyState CallWindowProcA MapDialogRect GetWindowTextLengthA GetWindowTextA SetWindowTextA

gdi32

CreateFontIndirectA DeleteObject CreateCompatibleDC GetDIBits CreateRectRgn CombineRgn SetTextColor SetBkColor CreateSolidBrush SelectObject PatBlt SetBkMode GetBkColor GetTextColor GetBkMode CreateBrushIndirect GetObjectA GetDeviceCaps

comdlg32

ChooseColorA ChooseFontA GetSaveFileNameA GetOpenFileNameA CommDlgExtendedError

shell32

SHBrowseForFolderA SHGetDesktopFolder ShellExecuteA SHGetPathFromIDListA ExtractIconExA

ole32

OleSetContainedObject OleCreate CreateStreamOnHGlobal CoTaskMemFree

oleaut32

VariantInit SysAllocString VariantClear SafeArrayCreate SafeArrayAccessData SafeArrayDestroy OleLoadPicture

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 1d74275fb0ddcb7c01a92c4ea5c7ef137cdfa0b48ae2b293f0ea178b355cbaa8
MD5 997ae296af5b7ca9aaa52f6844075439
SHA1 9814f0b09219ac2eed875d842b9362c3b32bec6f
SHA512 a81ee17129278a185e91f6615da2d9e47940580fcaac3806ace17a0c0e48995f8e85de6deedcec502782141acd381fb7dd1c72a93fcd40112afadc3741572349
SSDEEP 192:u4lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/126gszA:uysdM80dCI5a2LsQ5IlPNRY00AlACU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
MD5 32465a07028b927b22c38e642c2cb836
SHA1 309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA512 9d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff
SSDEEP 192:gO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1axgMO:ZKAFERdlxhGRYUzqZax
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_5_

IMPHASH f47034fa9e712272f3324ac4a1510fb8
SHA256 9c365454cdb24ca83cda0667f75ab32dff1b0abf8bb5861f83ad8c73ead7b7d7
MD5 3b758b989821e5ca2b73033707430ccb
SHA1 f4563245e38e5c746f9cc0ea7b1f1a38c7113b2b
SHA512 f113ff7403b7305c6686f3d57d3c9e66262f29593c385de387d5258bcdebda323c8e4eacb79542c0db87952c6dc957754e30f16ee565404144c952fb755fc732
SSDEEP 6144:p8Z3s9FSZkn2VT7aMKGvOIYnGrR+h+7eeMTTBkkRnRazS0RTgbpJRICa:ps3ak7DfnrR+yYTTekRnR5WgNa
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

167617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

StrCmpIW UrlEscapeW UrlGetPartW StrStrIW PathMatchSpecW UrlUnescapeW

wininet

HttpOpenRequestW InternetCloseHandle InternetReadFile InternetQueryOptionW HttpQueryInfoW InternetSetCookieW InternetOpenW InternetSetOptionW HttpSendRequestW InternetCrackUrlW InternetConnectW

kernel32

SetEndOfFile CreateFileA GetModuleHandleA GetTimeZoneInformation SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA GetLocaleInfoA GetCurrentDirectoryA SetFilePointer GetDateFormatA GetTimeFormatA FlushFileBuffers GetConsoleMode GetConsoleCP ReadFile IsValidCodePage GetOEMCP GetACP GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA GetFileType GetStdHandle SetHandleCount HeapReAlloc VirtualAlloc VirtualFree HeapDestroy HeapCreate ExitProcess HeapSize GetProcessHeap TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleW GetFullPathNameW GetTempFileNameW GetFileSize MapViewOfFile UnmapViewOfFile VirtualQuery CreateFileW LocalAlloc CreateFileMappingW CloseHandle LocalFree WaitForSingleObject TerminateThread Sleep SetThreadPriority GetExitCodeThread FreeLibrary WriteFile GetProcAddress LoadLibraryA DeleteFileW WideCharToMultiByte lstrlenW GetTempPathW GetSystemInfo GetWindowsDirectoryW GetVolumeInformationW CreateMutexW CreateProcessW GetTickCount ReleaseMutex GetSystemTime MoveFileExW SetEnvironmentVariableA HeapAlloc GetModuleFileNameW MultiByteToWideChar SetLastError lstrcmpW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetLastError GetCPInfo LCMapStringW LCMapStringA RtlUnwind RaiseException FindFirstFileW InterlockedDecrement InterlockedIncrement GetDriveTypeA CompareStringA CompareStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetCurrentThreadId GetCommandLineA GetSystemTimeAsFileTime ExitThread CreateThread FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW

user32

wsprintfW SetWindowTextW SetWindowPos CallWindowProcW SetWindowLongW SendMessageW GetWindowTextW RealGetWindowClassW EnumChildWindows GetWindowLongW

ole32

CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree

oleaut32

VariantChangeType VariantCopy SafeArrayDestroy SafeArrayPutElement SafeArrayCreateVector SysAllocStringLen SysFreeString SysAllocString SysStringLen SysStringByteLen SysAllocStringByteLen VarBstrCmp VariantInit VariantClear

ws2_32

inet_addr

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

rpcrt4

RpcStringFreeW UuidToStringW

urlmon

UrlMkGetSessionOption

imagehlp

MapAndLoad UnMapAndLoad

advapi32

CryptGetHashParam CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDeriveKey RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegQueryValueExW RegCreateKeyW CryptGenRandom CryptReleaseContext CryptAcquireContextW CryptHashData

shell32

SHCreateDirectoryExW

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_0626220c6b36b91ef947bfadb5ffc3b4

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsBrowserOpt.dll

xpcom

nspr4

kernel32

user32

ws2_32

rpcrt4

imagehlp

shlwapi

wininet

version

advapi32

shell32

ole32

generic

$SYSDIR/cont_milehighads-remove.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/validate.ini

$_5_

shlwapi

wininet

kernel32

user32

ole32