jarona[.]exe | Triage™

Resubmissions

30/09/2026, 01:51

260930-b96cfacb637

30/09/2026, 01:46

260930-b6ys7asxht7

Sharing

Copy URL Twitter E-mail

General

Target
jarona.exe
Size 24.8MB
Sample260930-b96cfacb63
SHA256 1d903cf44e9b197b2de7f65ef87e03b813a9c6cd3ef79411d9b81dd69eeeff33
MD5 aab9be395bc6f2ea6b41625a31b280e7
SHA1 12eabd6c1e5b28287cc67802781b8775745c9045
SHA512 9f0fe68536e2e3703f23e9b4f587d9f6348e6630e3bbfdf8484cd5e2c335362004eb8f5d52932a547c68c8a2701a344d9662ca1bfed01fe9fc229fe99ea8c877
SSDEEP 786432:HubUy9Kyu0Vgyv5vokZD2tMT8mWDACjI421oy1:HUzu0VgyvokYtYHXCE4U
TLSH
T16D47334CB32C8509FB617432EB6AD53942853E1FC42A847299C43F9F7BF2DC9411B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
jarona.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/jarona.exe

File Explorer

jarona.exe

.exe 24.8MB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/ioSpecial.ini

193B
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

150KB
$TEMP/vcredist_x86_2015.exe

.exe 13.1MB
Uninstall.exe

.exe 231KB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/ioSpecial.ini

193B
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

25KB
bit_flowery.ogg

398KB
data.win

1.5MB
flower_castle.ogg

6.3MB
flowery.ogg

794KB
jarona.exe

.exe 7.7MB
license.txt

2KB
options.ini

27B

jarona.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 1d903cf44e9b197b2de7f65ef87e03b813a9c6cd3ef79411d9b81dd69eeeff33
MD5 aab9be395bc6f2ea6b41625a31b280e7
SHA1 12eabd6c1e5b28287cc67802781b8775745c9045
SHA512 9f0fe68536e2e3703f23e9b4f587d9f6348e6630e3bbfdf8484cd5e2c335362004eb8f5d52932a547c68c8a2701a344d9662ca1bfed01fe9fc229fe99ea8c877
SSDEEP 786432:HubUy9Kyu0Vgyv5vokZD2tMT8mWDACjI421oy1:HUzu0VgyvokYtYHXCE4U
TLSH
T16D47334CB32C8509FB617432EB6AD53942853E1FC42A847299C43F9F7BF2DC9411B6A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetFileSecurityW RegCreateKeyExW RegOpenKeyExW

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

DispatchMessageW wsprintfA SystemParametersInfoW SetClassLongW GetWindowLongW GetSysColor ScreenToClient SetCursor GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu GetSystemMenu GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW PeekMessageW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW SetDlgItemTextW GetDlgItemTextW CharNextA MessageBoxIndirectW RegisterClassW CharPrevW LoadCursorW

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

WriteFile GetLastError WaitForSingleObject GetExitCodeProcess GetTempFileNameW CreateFileW CreateDirectoryW WideCharToMultiByte lstrlenW lstrcpynW GlobalLock GlobalUnlock CreateThread GetDiskFreeSpaceW CopyFileW GetVersionExW GetWindowsDirectoryW ExitProcess GetCurrentProcess CreateProcessW GetTempPathW SetEnvironmentVariableW GetCommandLineW GetModuleFileNameW GetTickCount GetFileSize MultiByteToWideChar MoveFileW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA lstrcmpiW lstrcmpW MulDiv GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW GetSystemDirectoryW MoveFileExW GetModuleHandleA GetProcAddress lstrcmpiA lstrcpyA lstrcatW SetErrorMode

$PLUGINSDIR/InstallOptions.dll

IMPHASH 06a4f1236d62b715e2a75887755952df
SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
MD5 6f3098fb5f3db26f3bb84f5481109e39
SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
TLSH
T14E621A527AC120F2DDD6A53037E77F236FB2B52094D58C1B97633E4B5922212BE39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcmpiW lstrcpynW lstrcpyW lstrcatW GetFileSize GlobalUnlock GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar CreateFileW GetCurrentDirectoryW GlobalLock GlobalAlloc GetModuleHandleW CloseHandle WriteFile SetFilePointer SetEndOfFile GetPrivateProfileIntW ReadFile lstrlenW SetCurrentDirectoryW

user32

EnableWindow GetSystemMenu EnableMenuItem DrawTextW SetWindowRgn SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW SetCursor MapWindowPoints GetSysColor DrawFocusRect PtInRect GetWindowLongW CreateDialogParamW LoadCursorW LoadIconW DestroyIcon LoadImageW IsDialogMessageW MapDialogRect SetWindowPos ShowWindow DestroyWindow CreateWindowExW CallWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW GetClipboardData CloseClipboard OpenClipboard GetDlgCtrlID SetWindowLongW wsprintfW GetDlgItem CharNextW

gdi32

CombineRgn CreateRectRgn DeleteObject GetDIBits SelectObject SetTextColor GetObjectW CreateCompatibleDC

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
MD5 ea00e2678e4679ba28b0f560baec9776
SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
TLSH
T110425C496B618EF2F62A463729B77F264B38EE1411E446DB8FD38445E8A01E721363C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/vcredist_x86_2015.exe

IMPHASH 8e2588a9cf43886de3449dfff03137b6
SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
MD5 1a15e6606bac9647e7ad3caa543377cf
SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
TLSH
T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ab:06:cb:ec:52:d7:a1:69:63:80:49:01:2e:f8:86:a1:5e:87:65:11:a6:e9:90:cd:1f:7b:f7:ad:25:14:e8:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

df:f2:e7:17:7c:35:2e:2a:10:e7:c1:35:9e:a2:41:d0:98:70:74:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 26, 2015

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:6e:9d:da:5a:a6:f3:1c:5b:00:00:00:00:00:55

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Minor OS version

Major OS version

Entry point

165012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

gdiplus

GdiplusShutdown GdiplusStartup GdipDeleteGraphics GdipFree GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromResource GdipCreateFromHDC GdipSetInterpolationMode GdipDrawImageRectI GdipAlloc

advapi32

QueryServiceConfigW CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegDeleteValueW RegQueryValueExW GetUserNameW InitiateSystemShutdownExW CreateWellKnownSid InitializeAcl SetEntriesInAclW DecryptFileW ChangeServiceConfigW ControlService CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW RegQueryInfoKeyW RegSetValueExW SetEntriesInAclA SetSecurityDescriptorGroup RegOpenKeyExW GetTokenInformation CheckTokenMembership AllocateAndInitializeSid FreeSid LookupAccountNameW SetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner

user32

GetMessageW PeekMessageW PostMessageW IsWindow PostQuitMessage GetWindowLongW SetWindowLongW DefWindowProcW UnregisterClassW DispatchMessageW TranslateMessage IsDialogMessageW MsgWaitForMultipleObjects WaitForInputIdle LoadCursorW BeginPaint EndPaint GetCursorPos MonitorFromPoint GetMonitorInfoW ReleaseDC MessageBoxW PostThreadMessageW RegisterClassW CreateWindowExW

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

gdi32

GetDeviceCaps CreateDCW

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoInitializeEx StringFromGUID2 CoInitializeSecurity CLSIDFromProgID

kernel32

GetCurrentProcess InitializeCriticalSection TlsFree DeleteCriticalSection CloseHandle TlsGetValue Sleep GetLastError ReleaseMutex TlsSetValue TlsAlloc GetCurrentThreadId GetVersionExW GetModuleHandleW ReadFile SetFilePointerEx CreateFileW GetCurrentProcessId GetProcessId WriteFile ConnectNamedPipe SetNamedPipeHandleState lstrlenW CompareStringW LocalFree CreateNamedPipeW WaitForSingleObject OpenProcess lstrlenA RemoveDirectoryW GetFileAttributesW ExpandEnvironmentStringsW LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress VerifyVersionInfoW VerSetConditionMask GetComputerNameW GetTempPathW GetSystemDirectoryW GetSystemWow64DirectoryW GetVolumePathNameW HeapAlloc GetSystemDefaultLangID GetUserDefaultLangID GetDateFormatW GetSystemTime InterlockedExchange LoadLibraryW InterlockedCompareExchange GetExitCodeThread CreateThread SetEvent WaitForMultipleObjects CreateEventW ProcessIdToSessionId InterlockedIncrement InterlockedDecrement GetStringTypeW SetFileAttributesW FindClose FindNextFileW FindFirstFileW CreateProcessW SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess SetThreadExecutionState CopyFileExW HeapSetInformation MapViewOfFile CreateFileMappingW CreateMutexW SetEndOfFile ResetEvent SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA GetSystemTimeAsFileTime VirtualFree VirtualAlloc DeleteFileW GetThreadLocale GetTimeZoneInformation TerminateProcess UnhandledExceptionFilter SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GlobalAlloc IsProcessorFeaturePresent GetTickCount QueryPerformanceCounter HeapCreate SetLastError EncodePointer GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW GlobalFree MoveFileExW CopyFileW GetFileSizeEx GetModuleHandleA RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode HeapSize HeapReAlloc LCMapStringW MultiByteToWideChar SetStdHandle WriteConsoleW FlushFileBuffers GetLocalTime UnmapViewOfFile IsDebuggerPresent DuplicateHandle HeapFree FormatMessageW GetTempFileNameW GetWindowsDirectoryW CompareStringA FreeEnvironmentStringsW GetModuleFileNameW GetStdHandle DecodePointer ExitProcess SetUnhandledExceptionFilter GetStartupInfoW GetCommandLineW GetFullPathNameW CreateDirectoryW GetProcessHeap

cabinet

ord22 ord20 ord23

crypt32

CertGetCertificateContextProperty CryptHashPublicKeyInfo

msi

ord88 ord17 ord125 ord116 ord115 ord118 ord8 ord171 ord205 ord45 ord137 ord141 ord238 ord190 ord169 ord90 ord173 ord111 ord70

rpcrt4

UuidCreate

wininet

InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW InternetErrorDlg InternetReadFile HttpSendRequestW InternetSetOptionW InternetOpenW HttpQueryInfoW InternetCrackUrlW InternetConnectW

wintrust

WinVerifyTrust WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData CryptCATAdminCalcHashFromFileHandle

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Uninstall.exe

IMPHASH 3f91aceea750f765ef2ba5d9988e6a00
SHA256 3ab65699b4a324fdef04192acf122edd0710e91b64ebe433c61a288e756efbf9
MD5 afdf6a29be2f617f82ac5a0950f4ab9b
SHA1 ff53aa68e8b1de6b99df791788e1492b987d99a6
SHA512 13577889711a451ee538855a6b0c3c36d955671897fb7d54ecb3258d880575a556f4e9855dff9df1a37d8644df9fa30963833ba96789e7620e27c21a55a4eb9a
SSDEEP 3072:c4MrfWdbcDWToWNWnwtzc3EsizzAQ26rTUzq:JMrudbcDdc5zc3EseR2OUG
TLSH
T1DA34C289B6184086F7717935EB3EDA7A82697E5B086A843265D43FCF37F2CC08457272
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

shell32

ShellExecuteExW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderLocation

ole32

OleInitialize OleUninitialize CoTaskMemFree IIDFromString CoCreateInstance

comctl32

ord17 ImageList_Destroy ImageList_AddMasked ImageList_Create

user32

gdi32

SetBkMode CreateBrushIndirect GetDeviceCaps SelectObject DeleteObject SetBkColor SetTextColor CreateFontIndirectW

kernel32

$PLUGINSDIR/InstallOptions.dll

IMPHASH 06a4f1236d62b715e2a75887755952df
SHA256 f90a0893c0b0ce2ae3f8bb65f383bf656ce33381d6cbac2b25a7d82b34fde9bd
MD5 6f3098fb5f3db26f3bb84f5481109e39
SHA1 9270793e404cc42c6f5be1eb1eb4305f166c656d
SHA512 0462beae0fbd882dc0b6a09547a7959c051928b828e28125b433794de0258f90f3dec8f1920290f114970d2540a113224b8ab372fcee4dfe87f139be4ac0c0d1
SSDEEP 384:lgw9eYfMCU9oJNJJjL3bhLNdSDL6o5VrSRLmCvl:39AleJNbf3tNgDLn28wl
TLSH
T14E621A527AC120F2DDD6A53037E77F236FB2B52094D58C1B97633E4B5922212BE39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11501

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

user32

gdi32

CombineRgn CreateRectRgn DeleteObject GetDIBits SelectObject SetTextColor GetObjectW CreateCompatibleDC

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 4f33ea844b96a31c8f4690530ba63854
SHA256 60d4a86f65e141d4b6b778e5f448a0c818bd2fa28db7b9dabc1395d354b19cc5
MD5 ea00e2678e4679ba28b0f560baec9776
SHA1 f9b647b1ab50cc2de981757ac914a5787bccd95a
SHA512 2ee7a4a0af955ba376c66d13e626ca135b2afd13277a006f523eb2fdc1133a12ea35b065a8c119843fbe82f89190cdb2b769329af14e4313a2419b739b27337a
SSDEEP 192:UA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6gn9Mw:MR7SrtTv53tdtTgwF4SQbGPX36g9Mw
TLSH
T110425C496B618EF2F62A463729B77F264B38EE1411E446DB8FD38445E8A01E721363C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6730

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jarona.exe

IMPHASH 83d57b956a5bade45030cf18da8dd06b
SHA256 f634b45f97996fa53c4dc206094ecd9bd22c9ab4a812a6b2a30306348c593977
MD5 e629464fd5a27d3f2108a718a970e784
SHA1 913404f0d0b6b4778f2813bc10f203f017f9ad73
SHA512 e8badfa7808a6988253da471773fe409441e1288d931ab1a65fa5b1b3dbb23ef9e4ca81b00a3bddf47a7a265dd91244a04780c4375f389cd4ddcce9be631dc7b
SSDEEP 98304:eeMcXBD3p4LZgHsTD8NoqUA6vtXdEM0Vb:eeMcRrd8INoqUAQhaXJ
TLSH
T1C9866B8572A0C1CDD1678039C256A6FBE6723C45CF5086EB66A03F6D3F73AD049BA712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4930048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\GameMaker\GameMaker\GameMaker\Runner\GMS2-Runner-Main\VC_Runner\x64\Release-Zeus\Runner.pdb

rpcrt4

UuidCreate UuidToStringW

wininet

InternetCrackUrlA InternetSetOptionA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetCanonicalizeUrlA HttpOpenRequestA HttpQueryInfoA InternetOpenA InternetGetConnectedState

d3d11

D3D11CreateDevice

dbghelp

MiniDumpWriteDump

winmm

joyGetPosEx joyGetPos timeGetTime timeGetDevCaps timeEndPeriod timeBeginPeriod

ws2_32

listen bind getaddrinfo WSAStartup WSAAddressToStringA send socket ntohs connect recvfrom recv getsockopt freeaddrinfo sendto ioctlsocket setsockopt WSAGetLastError __WSAFDIsSet select getpeername inet_ntop getnameinfo htons closesocket accept inet_pton

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

avrt

AvSetMmThreadCharacteristicsA AvSetMmThreadPriority

propsys

PropVariantToUInt32 PropVariantToInt64

iphlpapi

GetAdaptersAddresses NotifyIpInterfaceChange

api-ms-win-core-path-l1-1-0

PathCchCombine

kernel32

GetStdHandle FreeLibraryAndExitThread ExitThread PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindFirstFileExW MoveFileExW SetFileAttributesW GetFileAttributesExW GetModuleHandleExW HeapWalk HeapValidate TlsFree TlsSetValue TlsGetValue TlsAlloc WriteFile RtlPcToFileHeader RtlUnwindEx GetProcessHeap HeapFree HeapAlloc TerminateProcess InitializeSListHead EnumSystemLocalesW SetFilePointerEx IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent GetConsoleMode ReadConsoleW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetStdHandle RtlUnwind RtlVirtualUnwind RtlLookupFunctionEntry FormatMessageW GetLastError LoadLibraryW GetProcAddress LocalFree MultiByteToWideChar FreeLibrary WideCharToMultiByte LoadLibraryA OutputDebugStringA SetWaitableTimer CreateWaitableTimerW CloseHandle GetConsoleWindow SetLastError GetFullPathNameW GetFileAttributesW GetExitCodeThread DeleteFileW CreateThread GetCurrentDirectoryW GetModuleHandleW ReadFile SetFilePointer CreateFileW GetFileSize FormatMessageA LoadLibraryExW CreateDirectoryW FindFirstFileW FindNextFileW RemoveDirectoryW GetModuleFileNameW FindClose ResumeThread GetTempPathA CreateProcessW GetTimeZoneInformation WaitForSingleObject GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter GetTimeFormatW K32GetProcessMemoryInfo GetCurrentDirectoryA SetCurrentDirectoryA GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoW GetVersionExW GetSystemInfo Sleep VerSetConditionMask VerifyVersionInfoW GlobalFree GetCurrentProcessId DebugBreak GetEnvironmentVariableA ExitProcess lstrlenA GetVersion SetEnvironmentVariableA CreateFileMappingW MapViewOfFile MoveFileA SetPriorityClass GetCommandLineW SetProcessInformation ExpandEnvironmentStringsW GetFinalPathNameByHandleW SetThreadPriority SetErrorMode GetCurrentThreadId GetCurrentThread SetUnhandledExceptionFilter WaitForSingleObjectEx CreateEventExA HeapReAlloc RtlCaptureContext CreateEventW ResetEvent SetEvent GetStringTypeW GetCPInfo LCMapStringEx DecodePointer EncodePointer GetSystemTimeAsFileTime FlsFree FlsSetValue FlsGetValue FlsAlloc GetNativeSystemInfo SleepConditionVariableSRW WakeAllConditionVariable TryEnterCriticalSection InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount InitializeSRWLock DeleteCriticalSection InitializeConditionVariable InitializeCriticalSection LeaveCriticalSection WakeConditionVariable EnterCriticalSection SleepConditionVariableCS LoadLibraryExA VirtualQuery VirtualProtect RaiseException GetDateFormatW CompareStringW LCMapStringW IsValidLocale GetCurrentProcess GetUserDefaultLCID IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetEndOfFile HeapSize CreateDirectoryA WriteConsoleW

user32

MsgWaitForMultipleObjectsEx EnumDisplaySettingsA TranslateMessage SetProcessDPIAware SetDlgItemTextA MessageBoxA OpenClipboard PeekMessageW EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable keybd_event GetAsyncKeyState IsWindowVisible GetWindowLongPtrW GetLayeredWindowAttributes DispatchMessageW CloseClipboard IsDialogMessageW GetCursorPos SetCursorPos IsIconic UpdateWindow EnumDisplaySettingsW EnumDisplayDevicesW IntersectRect GetMonitorInfoW ShowWindow GetSystemMetrics GetWindowLongW GetWindowPlacement wsprintfW GetForegroundWindow GetActiveWindow ClientToScreen SendMessageW SetWindowLongPtrW MapWindowPoints MoveWindow CreateDialogParamW GetDC EndDialog SetWindowTextW SetDlgItemTextW GetDlgItemTextW GetDlgItem DrawTextW DialogBoxParamW ReleaseDC DefWindowProcW PostMessageW DestroyWindow CreateWindowExW ScreenToClient CallNextHookEx RegisterClassExW FindWindowExA SetWindowPlacement UnhookWindowsHookEx EnumWindows SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SendMessageA SetParent SetCapture SetWindowsHookExW SetCursor GetClientRect FindWindowA ReleaseCapture SetForegroundWindow LoadImageW InvalidateRect MessageBoxW AdjustWindowRectEx MonitorFromPoint GetWindowRect SetWindowPos MonitorFromWindow GetKeyState

gdi32

CombineRgn GetRgnBox GetDeviceCaps DeleteObject CreateRectRgnIndirect SelectObject GetStockObject

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryValueExW CryptGenRandom CryptReleaseContext RegCloseKey RegOpenKeyExW CryptAcquireContextA

shell32

ShellExecuteW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateInstance PropVariantClear CoInitialize CoCreateFreeThreadedMarshaler

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmGetCompositionTimingInfo

imm32

ImmAssociateContext ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

528KB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

jarona.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$TEMP/vcredist_x86_2015.exe

PE Signature issue

gdiplus

advapi32

user32

oleaut32

gdi32

shell32

ole32

kernel32

cabinet

crypt32

msi

rpcrt4

wininet

wintrust

version

generic

Uninstall.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

bit_flowery.ogg

data.win

flower_castle.ogg

flowery.ogg

jarona.exe

rpcrt4