jaffacakes118_Trojan-Dropper[.]Win32[.]Injector[.]jgwu[.]7402b138b5be4063e1cbc101e5c4ef97

resource
jaffacakes118_Trojan-Dropper.Win32.Injector.jgwu.7402b138b5be4063e1cbc101e5c4ef97
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/Slots.dll
unpack001/Slots.exe
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack001/aminstall.dll

resource
unpack001/$PLUGINSDIR/GameuxInstallHelper.dll

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_1

jaffacakes118_Trojan-Dropper.Win32.Injector.jgwu.7402b138b5be4063e1cbc101e5c4ef97

IMPHASH b711f65a9aff6a22fb2f57f0ac8bda33
SHA256 22c57147988dbff199b09ad4dce8ce86334c704e40d1907a483585e88c837451
MD5 7402b138b5be4063e1cbc101e5c4ef97
SHA1 0e851d86ea814b5cbe25c395d3c61ef221bb4cf2
SHA512 c156baf819c054743936d23ba2d34cc66ef10687e4aa08c1bfc1cc699d537b528ba2fea6dce79808b10922da00580d3191f95e2b9fb3cc00e75b0f03436ef120
SSDEEP 49152:ZV6B0d7jWQPR85DsFrkxI/22XcusOQdf433ilmT3mE3H9DRCud8BUrbwF/h0e3Kr:ZVENQpusFrkxI/22MVNdfw3ilmTWmH9p
TLSH
T196E533DCE8E0D7CAEBA285B74137E9FB54A4223444A550DF0730EE6DD5F6C20D8A261A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess lstrcpynA SetFileTime GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA CloseHandle lstrcmpiA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA MulDiv GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCommandLineA

user32

SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData CreateWindowExA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx CreateDialogParamA EmptyClipboard DestroyWindow SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint GetDlgItem

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Dialer.dll

IMPHASH b34e411b555c469d4deeeb6647de46ee
SHA256 39b9f9e1ff6c4f4ea9739cad159448b6bf5f570b09b839d5f43f2abd79c16771
MD5 de4b7820e03027762f0255059dccef1b
SHA1 b5545c72537fe89d4db4286a8448db62edc56c2b
SHA512 9152538cf1ea8c9f1a6b082f4cacb97cb05be915ff608125d4c705a8611a1e9368930e5284c820ff0f1106075a65e14d45052de6a75d7878ad5f75111d134455
TLSH
T1BC7112235A6845F5E503137F6887655E60F7A85103A3C50C99CC57207E632D0FD77B11
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/GameuxInstallHelper.dll

IMPHASH c044a03479a0bf13759a4b9b7e23900d
SHA256 9ce7213567d8310e69c82f88586fcd38b5dd26a21c851b5d6f9c73bf46ff1429
MD5 b225e2a7fa0c597b68cd7b06bfcd7fa2
SHA1 fd3df3532c38b8fc750248a91839f8653498084f
SHA512 0c14370373472113a57804097490acc6c490bf3db1c4a41dc0421dcfbdc79156397e6eaf60fd33e12809bbd4e8b87538546a7d5373eeeaa8573a8a871c5d7f32
SSDEEP 1536:IOY/mBRLy0VN5sFAjNsLKapmxQZfjCGOOc1ztWhiFhsHaevt:IOY/30r5sFAJsjkr1ztWsFnEt
TLSH
T1FB734B6176D05031E4E39A7806ECA260693F78721B71D8CBE7046ADE9E337D1B63871B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

4c:fc:e0:0c:e1:a7:87:6f:5d:be:e1:34:b7:07:b9:23:1d:f9:24:45

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 8, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

2

Major OS version

5

Entry point

27054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GameuxInstallHelper.pdb

ntdll

RtlUnwind

kernel32

GetFileAttributesW GetWindowsDirectoryW DeleteFileW MultiByteToWideChar CloseHandle CreateFileW GlobalFree GlobalUnlock GlobalLock GlobalAlloc SizeofResource LockResource LoadResource FindResourceW LoadLibraryW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap ExitProcess GetProcAddress GetModuleHandleA TlsAlloc SetLastError GetLastError TlsFree TlsSetValue TlsGetValue Sleep SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree LeaveCriticalSection EnterCriticalSection GetACP GetOEMCP GetCPInfo VirtualAlloc HeapReAlloc InitializeCriticalSection LoadLibraryA SetFilePointer GetStringTypeA GetStringTypeW InterlockedExchange VirtualQuery GetLocaleInfoA LCMapStringA LCMapStringW SetStdHandle VirtualProtect GetSystemInfo FlushFileBuffers ReadFile GetCurrentProcessId GetFullPathNameW GetVersionExW WriteFile DeleteCriticalSection

ole32

StringFromGUID2 CoInitialize CoCreateInstance CoUninitialize CoCreateGuid CreateStreamOnHGlobal CoSetProxyBlanket

msi

ord70 ord74 ord145

oleaut32

SysFreeString VariantClear SysAllocString

shell32

SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW SHFileOperationW

shlwapi

SHDeleteKeyW PathAddBackslashW

advapi32

RegSetValueExW RegQueryValueExW RegCreateKeyExW RegEnumKeyW RegCloseKey

$PLUGINSDIR/InstallOptions.dll

IMPHASH 9d433976e02d79532f0d635ee81d0b20
SHA256 2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4
MD5 57db62366ef11fdc47922a02031f0492
SHA1 6d30db5285b653025f94e74b9b045870dc0aeb7a
SHA512 d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5
SSDEEP 192:gzixixDOHhG9db9rd+oSVPECMlh3I8tqDynq7hwbbHF1QuCb:gOx0DOHqrdwTY6+nq72bbMum
TLSH
T105422A622384DCF3E789423AB45237136B96962679516ED1C7330FC66A2304D7EF6353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH 8fc31e88f4e2f35a7d6873d897a2680d
SHA256 9a2d4add45790a47d56aa67b9199b66119ec0a21185f3df6fabbc56a9b47cb88
MD5 51d66dbc791228d8411159379523d971
SHA1 029981130567cd45cb98cff5041acbec13d6ba3f
SHA512 c224b16c27869767f7fe403094797bc580b4710c92f05f7fad5fc405e834bd12b2c5022fa6e380ad7e2f58650115afe8792ce8bfba932c4fb46e8d27d99ccc7d
SSDEEP 48:SHEnz1tBa/XC1TQO50vwovgxVLrh2TpXHW+iJ/L9Cp+0rf1uapRkdfhhdJcN:H9UXC13C/ovLrh2cD/L9NochjcN
TLSH
T1DFB1867163C005B2E281067B9193679339A3D5343365D10F8B33625A6885DB7DC3DB83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH d79c2fe1aafe446fbd9b984f61377e3e
SHA256 a0de27810988abaa75ef1a3b8035a56f6632ee9bd9412918dda608dfe1ad6e4d
MD5 e32c7911814ae37f75ad9340fce9f46c
SHA1 a24483c292fc1a89fe34962cc6fb685d16b42e97
SHA512 1201782253eadba8381d660e9e67bf2c74fee92955802e569d8172613d4ef8524985b3a747bb17d0ff256c2ca43e329d1414eacf3491092f4d12efd5b53927e2
SSDEEP 192:BTed/9E1XMNUrW7VymsS9W+7HaQM7zFSnQXiCVIXuZsav+zPzrR2RMi:BTqE2UrW9tWeaQ6zF1NIXu6a2DP8Ki
TLSH
T127423A169E1018F3C392103971AF2BBAABB3453309444D83CB335A59AF667637E36787
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 7d85f9c30f9e87a65fff848de2c96ac1
SHA256 95cf100fe8ce66189514002965c6274d2c9d3089fe885fb9230aae547a9e4012
MD5 7e45b2485d98ad5a44514b6df4fa4544
SHA1 bf000b012b341925aaddb546331064bd6949816c
SHA512 01fa8e8cfb85243cc7ea89ede30aad21eed56508cc39e327c847a0c6c2121c3882d5b7068a1d56bf37d576d589697a58c1de8fa168707aa25d5e3aaf0486fa0d
SSDEEP 96:JLJdRZk8OkmE+WHw0FMXF6CWhFxKpKsxQhEfP0:JLjPk8OT30FFA2CP0
TLSH
T192D1D7B6F3C184B3C64743343957BB13AB259A312325B253A66792C7BA834E7DE35312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 9dbe958fd425903ffc2197a112bec4fa597284f9637fe8fd5685016f32e21334
MD5 b21538d9f049d3e3e8b666744d7ca36d
SHA1 b97fc58f9aa238758a7574a2e32dac4e97392f47
SHA512 05d2c660a43519fd35daa3b4310419b33e61ce8557bde55942315ca59c3b9cb9fdeaea42c403ad78a54fa9923eaa712bcf5a10dea83619a18c4ef0c451e6d533
SSDEEP 192:ROSsJI/rqmIDNLU0dq51EgAiNbubv6xLZ:/HQQ0d01Egbq76x
TLSH
T18F225C51426442F3DD55823C08A739272F787B249EA18EC3CF9364465F299BABC7D33A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10319

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 48cfa0ea7e353e4a7dd23572da8374ef
SHA256 fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d
MD5 593345196fcd1c553b0702cc026ccccd
SHA1 84446849c10e0c4d6683072f4c2eea5a085bac2f
SHA512 b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306
TLSH
T19A81EC3B43E496B3C05A473B4ACB4CC723B2E8342706512F5903489514B1E1FFE2EB2A
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 9d71148240669ca8cf83d8e66dcd3b8106b6c88461430ffba077f12f57cf9522
MD5 e1b5227d2c062b1d2b659d4327920a1c
SHA1 cbefa3b793e3935f43e28a1ae478163a5b113be4
SHA512 9c020ebb05f97e2ae3d75a13e9cbcdfc02a561e1858127f383b09d4a279c5a891ac064d2cf874de5a2e05cea983bcde72bbf0b047c9db6c57073b9f8e5b178e9
SSDEEP 192:pTsW4xkwDlN+ALq/+LjB14HTztP0ojsPF33gu:pTv4RxN+aq/+BItPNYmu
TLSH
T14AC2A1907889C226CD606E7ACC18C8FD5165BD14FDA5FA9B3960BBCF77332D19C8A046
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 bd123eb1a1ecd12d373f8b9488d63b38b8349880032e48c458884be921f74217
MD5 e9b0ae12c08ba5a6480a83584d92a8fb
SHA1 51420f8899d31b4f091d2327b94458aa15b89abc
SHA512 b448795d0c804d334ebeba64fbbea64afb2278a32fe51d103aa62327194ca0ab34a711629e4d2a178c88e637dedd13e54ef76a91179a7204b003d758735e1d53
SSDEEP 1536:jl+fEuehdzmN6nVU0z/e1rIq4R7fMT2Ne6OFx7OSpoMNoMaKeIthLpwqGNAXmy:j6PIzNG0TDt2Me6Cx7cKaAVOA
TLSH
T19414F86F0B3B440F82567A686ED692E930BDDF2428CCC9C25562BC7D9C74D94F0D62C9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Slots.dll

SHA256 b7096a858523dc92446be4c376df6022942a7089f95af45a7575fc40f6f618a1
MD5 66b5147de8b659f8cc57becd0c8acf56
SHA1 2069bbce423b8988b0f9f91fd544a8341cb19c5f
SHA512 8fb7e3cd5b0708146a401661aeb6927fae00151785cc7c3130955be2b911fb8a3e5cde05222e5f249437c530c06cd908fcc08ea2131ceada0778c4418b689f1a
SSDEEP 12288:3uroi4lUhPR13V6JnC87CrMJen/7/6R/JlnhY9iSss99Ip9+emuG:3uqeR1lmnbyMg/7iY6KIvc
TLSH
T10D152326D7570B62ECBB47302C5BC6837E09FE0DACA36A3F024F645AF502426AD17365
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Slots.exe

IMPHASH 51c4e98e76bd946f81a1a9c26b55ce8b
SHA256 7f03be071c3902c9e3e01cc0cb63b974c9ba15adbd40ef36dd746fa2ec8d17f9
MD5 d817da14c66923fdbbfa194f4eb9b08a
SHA1 9e283d6c078b998e6892479e0080e6b8630fb5ad
SHA512 45eeff02c848fd2d9e354b21eac7eaea85ac52366a3a48a8d8829cc2bae891f46158e16fd9b66e903bbaf9bb57ae81b68611704f13efb50cc9a09cab3fb52a92
SSDEEP 49152:jMsIDTVxKvrBvxuSSLsZNgWlksuvr27ikf0a:eTTS1TeGMa
TLSH
T16195237DDB8A1B08D949C236CB161F0A1678C60D45A7C7FAF03CD5D5249FB83EA02E28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5759077

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

7B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

1002B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.extls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

162KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

35KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Uninstall.exe

IMPHASH b711f65a9aff6a22fb2f57f0ac8bda33
SHA256 963902b9288444249654488fe2fdf24cae5c641d66a37700fb0180d0e0e901e0
MD5 33d20cdb4050e28f16064b22d256d398
SHA1 624206581569cc026991c4626bcf8859c6d95e31
SHA512 510a8a8f237a8f7d62d1593792fa6f37f5182469000985fe93bfc8e0f88c75e153b214832332f072d18af42b8a864297714c234d49f3480391d1cab1b9204def
SSDEEP 3072:zk5+bFdkJqzoCICVJAdbRvCQX8Irzm3CReyzKxi:s0RzoCIygbuUy3CQLi
TLSH
T190D3012635D6DFB6C11345B0043BB6BBE3B1EF111115224F5B706FADAB36882D91A2CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess lstrcpynA SetFileTime GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA CloseHandle lstrcmpiA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA MulDiv GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCommandLineA

user32

SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData CreateWindowExA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx CreateDialogParamA EmptyClipboard DestroyWindow SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint GetDlgItem

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 9d433976e02d79532f0d635ee81d0b20
SHA256 2338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4
MD5 57db62366ef11fdc47922a02031f0492
SHA1 6d30db5285b653025f94e74b9b045870dc0aeb7a
SHA512 d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5
SSDEEP 192:gzixixDOHhG9db9rd+oSVPECMlh3I8tqDynq7hwbbHF1QuCb:gOx0DOHqrdwTY6+nq72bbMum
TLSH
T105422A622384DCF3E789423AB45237136B96962679516ED1C7330FC66A2304D7EF6353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 48cfa0ea7e353e4a7dd23572da8374ef
SHA256 fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d
MD5 593345196fcd1c553b0702cc026ccccd
SHA1 84446849c10e0c4d6683072f4c2eea5a085bac2f
SHA512 b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306
TLSH
T19A81EC3B43E496B3C05A473B4ACB4CC723B2E8342706512F5903489514B1E1FFE2EB2A
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 9d71148240669ca8cf83d8e66dcd3b8106b6c88461430ffba077f12f57cf9522
MD5 e1b5227d2c062b1d2b659d4327920a1c
SHA1 cbefa3b793e3935f43e28a1ae478163a5b113be4
SHA512 9c020ebb05f97e2ae3d75a13e9cbcdfc02a561e1858127f383b09d4a279c5a891ac064d2cf874de5a2e05cea983bcde72bbf0b047c9db6c57073b9f8e5b178e9
SSDEEP 192:pTsW4xkwDlN+ALq/+LjB14HTztP0ojsPF33gu:pTv4RxN+aq/+BItPNYmu
TLSH
T14AC2A1907889C226CD606E7ACC18C8FD5165BD14FDA5FA9B3960BBCF77332D19C8A046
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 bd123eb1a1ecd12d373f8b9488d63b38b8349880032e48c458884be921f74217
MD5 e9b0ae12c08ba5a6480a83584d92a8fb
SHA1 51420f8899d31b4f091d2327b94458aa15b89abc
SHA512 b448795d0c804d334ebeba64fbbea64afb2278a32fe51d103aa62327194ca0ab34a711629e4d2a178c88e637dedd13e54ef76a91179a7204b003d758735e1d53
SSDEEP 1536:jl+fEuehdzmN6nVU0z/e1rIq4R7fMT2Ne6OFx7OSpoMNoMaKeIthLpwqGNAXmy:j6PIzNG0TDt2Me6Cx7cKaAVOA
TLSH
T19414F86F0B3B440F82567A686ED692E930BDDF2428CCC9C25562BC7D9C74D94F0D62C9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

aminstall.dll

IMPHASH c70bd01b6674ac7a6333f53641687d7e
SHA256 2a7ee893990dc65bdd4865e0ff3295fe331c82981a5cc40751c8fdfe90d1190b
MD5 cec88cfc2853cf5490d23af767f3aae4
SHA1 642b38211d1c18def13b9d6b76b622f7b36779a2
SHA512 9dc4ed2fcbdf1f01f0a873a7607a705d80f8621b08aa18ef56ea8b8b5cce29c304507bed6096a28bfdde4a15dd76a57ffcdd20b175157682add98d05db354b52
SSDEEP 3072:8oy/SJZ1bsvb7EX3jUzrK9TBffJqteZDXwtep6+:8aosXmK9TBZFK
TLSH
T183F39E1131D0C8B2E579017E48D2C729DB67B5F09AB58AC73FD81B896E36291DB363C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegSetValueExA RegCreateKeyExA RegCloseKey

kernel32

GetCurrentProcessId RaiseException RtlUnwind GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap HeapReAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FlushFileBuffers GetSystemTimeAsFileTime GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings Sleep WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection VirtualAlloc WriteFile SetStdHandle GetCPInfo GetACP GetOEMCP GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSection MultiByteToWideChar GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetCurrentThreadId GetLastError GetSystemTime CreateFileA SetFilePointer ReadFile CloseHandle GetModuleFileNameA FreeEnvironmentStringsW SetEndOfFile

user32

MessageBoxA

eula.txt

SHA256 ab53e205cb572fb43e09a1ee204080d6d953d449d3519bb160528878e3273ea3
MD5 85a954b04a2f29ef210876589fdaf960
SHA1 4ea38a7df3038eb6858252e26c5961649e0035a1
SHA512 a31487ba25e649a1b8933b3a3d6f767ba618d783a91ffdb208aee2b8a6af9f5d3cc83096f62712442ee3364b901ec76a56ed1a003c82d200f40cb4c3397079ca
TLSH
T1FC6197B9F36A033306C00355295651C5F22E79B47ABF5690B16CD29C23A5D3843FB6DE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

loading.jpg

SHA256 c418f866f0a46b9dc05d7485089e2bc3d37d924822b2e386f5e8f8982d2008fe
MD5 dc46b5218b99d1d86cb6f299cc0876c7
SHA1 0a2febd0d5be4e2a87c6d4c56da407c20976445a
SHA512 bede4f4bb2ed6a27233f5cdfb1595be1ec6220e978cb91f90c9479ff6ae34889ea33b5c0335ad6298c192b000937d672c1429b83088c72f65225417c6ed3fcb8
SSDEEP 1536:gYWX9qLvKclr/m7x0IMdxsMiLbtt59rTUp70+06X4rwkmHkaKhSC8V/YtUSrRo4:wNqucl+u7Yl4BfX4gfKYC+/EFi4
TLSH
T143A3F1E182431D0C74345F67F4309672B39559192F233A9BDFE83CEB24AEE2AD5221B5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

readme.txt

SHA256 eccb839dfd329d5b5758528e87b26b872b146ca14abefa922b988d809fe40ad9
MD5 95049c46a9262479c4956ee275bddf10
SHA1 c85ba0c7421888258a2846f831f834e291e1dabd
SHA512 9ada8a4967d09aa8535d5557af05d158bb47d6aad9d5d8d5f7f632b25b55b38771b84f347c563225d9c712131e589b9761804154722666bac04adb2e144d94dc
TLSH
T11931841EAF9BB02A557AC360710160A2FE5A6D621B7F554034EC126C4B6B7E207BDACC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Injector.jgwu.7402b138b5be4063e1cbc101e5c4ef97

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Dialer.dll

kernel32

generic

$PLUGINSDIR/GameuxInstallHelper.dll

PE Signature issue

ntdll

kernel32

ole32

msi

oleaut32

shell32

shlwapi

advapi32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

Slots.dll

generic

Slots.exe

kernel32

generic

Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic