jaffacakes118__6ddcef131154ebf4843161cf11c72a3a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__6ddcef131154ebf4843161cf11c72a3a
Size 1010KB
Sample260919-gjbyssca25
SHA256 5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46
MD5 6ddcef131154ebf4843161cf11c72a3a
SHA1 139dedb0697382fb5acee003472969ce8cb9d694
SHA512 13bbf957e507de33258be7685d940202321cf14194f2513246a2e77bf4ea6c8f90c1b64f216567b956d6bc6b72abee3c38b11252e5b76006575ac4039d5c27fb
SSDEEP 24576:VSPz6gtnqXtnr/AwQOdOwRVlN3L1qC0EFl:Ozj0XZTOwvn3L1qEl
TLSH
T1D5258C42BAF1C17AE5A342700D76C719A672BD955B3586CB73C03E0F7E312D29A3A316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

installer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack002/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack004/$PLUGINSDIR/md5dll.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/$PLUGINSDIR/md5dll.dll	upx
static1/unpack004/$PLUGINSDIR/md5dll.dll	upx

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__6ddcef131154ebf4843161cf11c72a3a
unpack001/$TEMP/svchost.exe
unpack002/$PLUGINSDIR/NSISArray.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/blowfish.dll
unpack002/$PLUGINSDIR/md5dll.dll
unpack003/out.upx
unpack002/messenger.exe
unpack004/$PLUGINSDIR/NSISArray.dll
unpack004/$PLUGINSDIR/NSISdl.dll
unpack004/$PLUGINSDIR/blowfish.dll
unpack004/$PLUGINSDIR/md5dll.dll
unpack005/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/$TEMP/Set-up.exe

NSIS installer 5 IoCs

installer

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/$TEMP/svchost.exe	nsis_installer_1
static1/unpack001/$TEMP/svchost.exe	nsis_installer_2
static1/unpack002/messenger.exe	nsis_installer_1
static1/unpack002/messenger.exe	nsis_installer_2

File Explorer

jaffacakes118__6ddcef131154ebf4843161cf11c72a3a

.exe 1010KB
$TEMP/Set-up.exe

.exe 793KB
$TEMP/hosts

1KB
$TEMP/svchost.exe

.exe 154KB
$PLUGINSDIR/NSISArray.dll

.dll 19KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/blowfish.dll

.dll 22KB
$PLUGINSDIR/md5dll.dll

.dll 6KB
out.upx

.dll 8KB
messenger.exe

.exe 91KB
$PLUGINSDIR/NSISArray.dll

.dll 19KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/blowfish.dll

.dll 22KB
$PLUGINSDIR/md5dll.dll

.dll 6KB
out.upx

.dll 8KB

jaffacakes118__6ddcef131154ebf4843161cf11c72a3a

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46
MD5 6ddcef131154ebf4843161cf11c72a3a
SHA1 139dedb0697382fb5acee003472969ce8cb9d694
SHA512 13bbf957e507de33258be7685d940202321cf14194f2513246a2e77bf4ea6c8f90c1b64f216567b956d6bc6b72abee3c38b11252e5b76006575ac4039d5c27fb
SSDEEP 24576:VSPz6gtnqXtnr/AwQOdOwRVlN3L1qC0EFl:Ozj0XZTOwvn3L1qEl
TLSH
T1D5258C42BAF1C17AE5A342700D76C719A672BD955B3586CB73C03E0F7E312D29A3A316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

14335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$TEMP/Set-up.exe

IMPHASH aa0a3995fe40cce990b245a8e4b8c6d7
SHA256 6be35fe8543aecfe21ece4a1077373a760e6d22012b32fb19a7a53ef15445b3d
MD5 9209338186015547dc9cd90258da09e4
SHA1 a6f17d98b85ae07d2962296a25a9e04f35463dae
SHA512 d7fb31b050dfa7bf31bcdf35650076ba431aca2af293efa0ff85936c387ed70eacb05820b796130b8d7e35307b7a217c1b4eed20298e1c53ed272f19c37855db
SSDEEP 12288:C/AwQ9izQ46IOwAyKm9vRlN3LUcqC0EWUl:C/AwQOdOwRVlN3L1qC0EFl
TLSH
T194055A41BBF1C17AE5A346704D76C719A672BD915B3196CB77C02E0F3E312C29A3A326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

b1:99:bf:35:3a:7a:71:07:7c:44:6b:72:cb:53:dc:35:83:e4:42:a4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Mar 5, 2010

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 5, 2009 - Dec 10, 2010

Minor OS version

Major OS version

Entry point

204616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\oobe\main\c3p0\dev\target\win\release\Set-up.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

kernel32

LockFile UnlockFile SetEndOfFile DuplicateHandle GetCurrentProcess GetVolumeInformationW GetFullPathNameW SetErrorMode GetFileAttributesW GetFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetStdHandle GetFileType GetSystemTimeAsFileTime RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode GetTimeZoneInformation GetLocaleInfoA SetEvent LCMapStringW GetStringTypeA GetStringTypeW EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA OpenSemaphoreW ReleaseMutex IsDBCSLeadByteEx WaitForSingleObject CloseHandle WritePrivateProfileStringW GetThreadLocale lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection GlobalFlags GetTickCount GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange FileTimeToLocalFileTime FileTimeToSystemTime GlobalAlloc FormatMessageW MulDiv GetModuleHandleA lstrlenW GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA SetLastError lstrcmpW GetVersionExA GlobalLock GlobalUnlock GlobalFree FreeResource ReadFile FlushFileBuffers FindNextFileW FindFirstFileW FindClose GetFileSize GetTimeFormatW CreateDirectoryW SetFilePointer GetDateFormatW WriteFile GetLocalTime CreateFileW GetUserDefaultLCID GetDriveTypeW GetVersionExW GetUserDefaultUILanguage CreateProcessW GetTempPathW GetSystemDefaultLangID GetExitCodeProcess FindResourceW LockResource SizeofResource GetModuleHandleW LoadResource CreateThread GetModuleFileNameW RemoveDirectoryW FreeConsole SetFileAttributesW GetCommandLineW SetCurrentDirectoryW GetProcAddress DeleteFileW GetStdHandle CreateEventW LoadLibraryW FreeLibrary GetEnvironmentStrings CopyFileW GetLastError GetCurrentProcessId CreateSemaphoreW CreateMutexW LocalAlloc LocalFree ReleaseSemaphore MultiByteToWideChar InterlockedIncrement InterlockedDecrement WideCharToMultiByte ResetEvent Sleep LCMapStringA

user32

UnregisterClassA CharUpperW ReleaseCapture SetCapture GetSysColorBrush DestroyMenu RegisterClipboardFormatW GetMessageW TranslateMessage GetCursorPos ValidateRect SetWindowContextHelpId wsprintfW EnableWindow SendMessageW GetClientRect GetSystemMenu IsIconic LoadIconW GetWindowRect SetWindowLongW GetWindowLongW LoadImageW SetTimer EnableMenuItem KillTimer GetSystemMetrics GetWindow PostMessageW DrawIcon GetDesktopWindow GetFocus IsWindow SetCursor DrawIconEx GetDC InvalidateRect GetIconInfo FillRect ReleaseDC DestroyIcon IsWindowVisible GetParent LoadCursorW EndDialog GetNextDlgTabItem IsWindowEnabled GetDlgItem MapDialogRect PostQuitMessage SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState CheckMenuItem GetWindowThreadProcessId EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx UnregisterClassW PostThreadMessageW MessageBeep GetNextDlgGroupItem InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableW CharNextW GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetForegroundWindow UpdateWindow GetMenu GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx ScreenToClient EqualRect CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow

advapi32

SetEntriesInAclW RegSetValueExW SetSecurityDescriptorDacl AllocateAndInitializeSid InitializeSecurityDescriptor FreeSid RegCloseKey RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegDeleteKeyW RegEnumKeyW RegQueryValueW RegCreateKeyExW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleInitialize CoFreeUnusedLibraries OleUninitialize CLSIDFromString CoRevokeClassObject CoTaskMemFree CoCreateGuid StringFromGUID2 CoInitializeEx CoUninitialize OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CoTaskMemAlloc CoCreateInstance OleRun CLSIDFromProgID

shell32

ShellExecuteW ord680 SHGetSpecialFolderPathW CommandLineToArgvW

oleaut32

SysAllocStringLen VariantChangeType SafeArrayDestroy SysFreeString SysStringLen VariantInit VariantCopy SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect VariantClear GetErrorInfo

shlwapi

PathRemoveFileSpecW StrRChrW PathRemoveBackslashW PathIsRootW PathGetDriveNumberW PathFindExtensionW PathFindFileNameW PathStripToRootW PathFileExistsW PathIsUNCW

gdi32

GetStockObject CreateRoundRectRgn CreateSolidBrush DeleteDC CreateBitmap Rectangle CreateCompatibleDC CreateCompatibleBitmap SelectObject GetTextExtentPoint32W DeleteObject CreateFontIndirectW GetClipBox SetTextColor SetBkColor SaveDC RestoreDC SetBkMode SetMapMode SelectClipRgn GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn GetDeviceCaps CreatePen CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox GetObjectW

msimg32

AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oledlg

OleUIBusyW

$TEMP/svchost.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 0bab3a2fafdfd026026ed1f3e689febfff17e61d7f1c23501a5accebc8300119
MD5 024a2fbda97eeed3d5ee557739760c60
SHA1 81f98ba5358b08eab4b83937306364b9160a69e9
SHA512 e0fec6e5cb70f3377c5995ed532c29765e98148fa9892707c72614392b557a50d3cf5fb20932443b166e2be09950b2aa77d899c34a36339c508e8d7d1e6b154f
SSDEEP 3072:bgXdZt9P6D3XJT6bFQP5Kyx3tnviuD1AUlSjRtVkk5Kyx3tnC:be34d6SUyZtnviu1AKkUyZtnC
TLSH
T162F3F19691D25857D4D603306A3B5735B3B18EDD4360918317BC7FBA0FA63A3CC2AA92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISArray.dll

IMPHASH 8772d66326aa6d7b2a9d5c4b0a7afb36
SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
MD5 14b848866035dea39b912da628307231
SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
TLSH
T14A92D9BB4710A4F0D37E2879FBC99A1F897E311064A5D4E7CB775F898F1014A1B76212
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4839

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/blowfish.dll

SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
TLSH
T10BA2AE87D9E0CC71D1DADAFB4E92D10DEBF235302D8A151875FA2CCB489B2D70A1C656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

906B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

89B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
TLSH
T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
TLSH
T1D7F1A525A3E912ADF1FB4E71ABA3353257353D65AF23E23A1B01014B54716F4DC32B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

messenger.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 66474cbf47bf554c5bfdd62ea39b864096667fbb7d77c5103eb874e0c81cbe97
MD5 fc6e4175f214b4cfb15504d6c43f5e66
SHA1 fba7ae4e5ee7a5c13e37688856abe8052469f788
SHA512 ecc99c27c9f8c0f0edc0a6f87119675725f7028b86f27c1ee53169ec29c0f406b1cd1ee43b655dd62295a71bef012e61fdc23eef845d0f82c10a3f07fcac741f
SSDEEP 1536:hpgpHzb9dZVX9fHMvG0D3XJHZzkF47BLPkqIzjbanya/x6s+bMnb:bgXdZt9P6D3XJ5zkFQP5Kyx3tnb
TLSH
T10793E056A1C148A7C9D6033065B7A739F3F6C6DD03A15A430BAC3F7F1D21293CC1A6A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISArray.dll

IMPHASH 8772d66326aa6d7b2a9d5c4b0a7afb36
SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
MD5 14b848866035dea39b912da628307231
SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
TLSH
T14A92D9BB4710A4F0D37E2879FBC99A1F897E311064A5D4E7CB775F898F1014A1B76212
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4839

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/blowfish.dll

SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
TLSH
T10BA2AE87D9E0CC71D1DADAFB4E92D10DEBF235302D8A151875FA2CCB489B2D70A1C656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

906B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

89B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
TLSH
T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
TLSH
T1D7F1A525A3E912ADF1FB4E71ABA3353257353D65AF23E23A1B01014B54716F4DC32B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__6ddcef131154ebf4843161cf11c72a3a

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$TEMP/Set-up.exe

PE Signature issue

comctl32

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

gdi32

msimg32

comdlg32

winspool.drv

oledlg

generic

$TEMP/hosts

$TEMP/svchost.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISArray.dll

kernel32

user32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/blowfish.dll

generic

$PLUGINSDIR/md5dll.dll

generic

out.upx

generic

messenger.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISArray.dll

kernel32

user32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/blowfish.dll

generic