neshta | jaffacakes118_samples[.]part021[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_samples.part021.rar
Size 15.0MB
Sample261011-v5hkcsvsc1
SHA256 6d911ae1833c3f5c7c47df1c5abb03fc3e9a849a96bc4de8f31020046dfc0a75
MD5 7e050dec5570f1d85d92d46c0f2a6565
SHA1 517723ec8999ddcc8e8ef572a002ff7bc523f70c
SHA512 c4ac108cab9787fd2f74aa4a1f130f5fcfa20dbbdd683dbb3df791ed1151e04fe6bc53a7f1d644d3718db71843a5c5ddf121973d3692d6fe57659895b8e19d92
SSDEEP 393216:u2coKwcungCsrRNKWWRH79uR24EHLKImd1StG9duz7FN0Nm3G4:h5KwcungZRNCJ7QMrTeOGWvC
TLSH
T156F63336A880780CE5F1E27BC6C61071F7D6BD6A2095B0A65156633E9EA8772C7FF430
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

mediaget

kazya1.hopto.org:1470

Mutex

a797c6ca3f5e7aff8fa1149c47fe9466

Attributes

reg_key
a797c6ca3f5e7aff8fa1149c47fe9466
splitter
|'|'|

Extracted

Family

blackmatter

Version

Botnet

bab21ee475b52c0c9eb47d23ec9ba1d1

https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com

Attributes

attempt_auth
false
create_mutex
true
encrypt_network_shares
true
exfiltrate
true
mount_volumes
true

rsa_pubkey.base64

aes.base64

Extracted

Family

quasar

Version

1.4.0.0

Botnet

2020

localpc.ddns.net:2875

Mutex

9eYfFGqpKrmsmWgGUu

Attributes

encryption_key
BzIpKazdKZENzsJa4Vf2
install_name
defender2020.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsDef2020
subdirectory
Defender2020

Signatures

Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
ransomware blackbasta
Family: BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
ransomware blackcat
Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter
Family: Chaos
Ransomware family first seen in June 2021.
ransomware chaos
Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Family: NominatusCrypto,NominatusStorm
NominatusCrypto aka NominatusStorm is a ransomware written in C#.
ransomware nominatuscrypto
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven
Family: Sorano Stealer
Sorano Stealer is an open-source information stealer written in C#.
stealer sorano_stealer
Family: Venus
Venus is a ransomware first seen in 2022.
ransomware venus
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Black Basta payload 1 IoCs

resource	yara_rule
static1/unpack001/96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be.elf	family_blackbasta

Chaos Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe	family_chaos

Detect Neshta payload 1 IoCs

resource	yara_rule
static1/unpack001/78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe	family_neshta

Detects NominatusCrypto C# variant 2 IoCs

resource	yara_rule
static1/unpack001/47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe	family_nominatuscrypto_dotnet
static1/unpack001/55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe	family_nominatuscrypto_dotnet

Detects NominatusCrypto DOS executable variant 2 IoCs

resource	yara_rule
static1/unpack001/47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe	family_nominatuscrypto_dos
static1/unpack001/55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe	family_nominatuscrypto_dos

Detects Seven ransomware 1 IoCs

resource	yara_rule
static1/unpack001/55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87.exe	family_seven

Detects SoranoStealer payload 1 IoCs

resource	yara_rule
static1/unpack001/63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe	family_soranostealer

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4.exe	family_quasar

Venus Ransomware 1 IoCs

resource	yara_rule
static1/unpack001/78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe	family_venus

Codesign digest Mismatch 2 IoCs

File was altered after it was signed.

resource
unpack001/0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe
unpack001/79494b2b76515207a2cf1a29484096cbf884ea4b0e2b834af07beac7879ce714.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe	ConfuserEx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
static1/unpack001/63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe	costura

Unsigned PE 19 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe
unpack001/123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497.exe
unpack001/41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe
unpack001/47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe
unpack001/48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe
unpack001/48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe
unpack001/55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87.exe
unpack001/55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe
unpack001/55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843.exe
unpack001/63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe
unpack001/67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d.exe
unpack001/72406ec12b191d2fa211cf1899e62c9257379d5bdd1d850c66cc546685f3d8ea.exe
unpack001/74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4.exe
unpack001/78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe
unpack001/78740c6e81c6beb5c8a5429d06697fe4fe5d46d0e6c08d901367a256481fd474.exe
unpack001/81331f7bbcf9c0b0f000ff6ab02dcc40b30c0cce5b3daa23f9efb1bc70fab4e8.exe
unpack001/89566f5dbdc136845cba15979fb9f7184f59385ce014a5f6cdd82e00619d95f3.exe
unpack001/95276f51959260cb55e9f476eb5b334301b789ed91dab04bf8572e5a8bcaf1b8.exe
unpack001/99107b41b352fff203b4363bc38aa703fa949b5e24a91df723e7218a41554cc8.exe

File Explorer

jaffacakes118_samples.part021.rar

.rar 15.0MB
0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe

.exe 163KB
0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe

.exe 37KB
123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497.exe

.exe 1.0MB
41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe

.exe 223KB
47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe

.exe 5.4MB
48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe

.exe 1.9MB
48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe

.exe 555KB
55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87.exe

.exe 363KB
55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe

.exe 2.6MB
55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843.exe

.exe 66KB
56990b801d101923eb89cf71604e9af32d7ce8d074f7dd50bd2877bf906542aa.exe

207KB
63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe

.exe 3.0MB
67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d.exe

.exe 204KB
69417ec104c1dd07e5067110d6e7f3c643c534d14db65a704bc0c14c223c3001.elf

.elf 1.8MB
72406ec12b191d2fa211cf1899e62c9257379d5bdd1d850c66cc546685f3d8ea.exe

.exe 2.2MB
74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4.exe

.exe 403KB
78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe

.exe 265KB
78740c6e81c6beb5c8a5429d06697fe4fe5d46d0e6c08d901367a256481fd474.exe

.exe 516KB
79494b2b76515207a2cf1a29484096cbf884ea4b0e2b834af07beac7879ce714.exe

.dll 1.2MB
81331f7bbcf9c0b0f000ff6ab02dcc40b30c0cce5b3daa23f9efb1bc70fab4e8.exe

.exe 142KB
89566f5dbdc136845cba15979fb9f7184f59385ce014a5f6cdd82e00619d95f3.exe

.exe 1.0MB
95276f51959260cb55e9f476eb5b334301b789ed91dab04bf8572e5a8bcaf1b8.exe

.exe 81KB
96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be.elf

.elf 204KB
99107b41b352fff203b4363bc38aa703fa949b5e24a91df723e7218a41554cc8.exe

.exe 210KB

jaffacakes118_samples.part021.rar

SHA256 6d911ae1833c3f5c7c47df1c5abb03fc3e9a849a96bc4de8f31020046dfc0a75
MD5 7e050dec5570f1d85d92d46c0f2a6565
SHA1 517723ec8999ddcc8e8ef572a002ff7bc523f70c
SHA512 c4ac108cab9787fd2f74aa4a1f130f5fcfa20dbbdd683dbb3df791ed1151e04fe6bc53a7f1d644d3718db71843a5c5ddf121973d3692d6fe57659895b8e19d92
SSDEEP 393216:u2coKwcungCsrRNKWWRH79uR24EHLKImd1StG9duz7FN0Nm3G4:h5KwcungZRNCJ7QMrTeOGWvC
TLSH
T156F63336A880780CE5F1E27BC6C61071F7D6BD6A2095B0A65156633E9EA8772C7FF430
MD5 SHA1 SHA512 SSDEEP TLSH

0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a
MD5 c5b6c3453d14458530ce6b38eb016973
SHA1 884c0cd0125b00e60f9310cb58368a70947fb2dd
SHA512 48b3bcb81730347ea9add2ca3534fa47884323dc8a0b1a2f90ba769006b1742681bba2f34f0bd8aab496cbc4cf6be7664e51b51675f73e8caa1b2bc4eab0ddd6
SSDEEP 3072:1oCFpIr9DEHLPYBtBsGLUS3FTotB5CHcv+q1l3sBJBsbnKFi8zHf4K5ydVX50sqn:ur9DuLPOB1L330ySbm7ynXiNn
TLSH
T178F3F72439FB502DF1B3FEB55FD4B59B9E6FF7332A0A6469109103460B12E82DE91239
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Chaos Ransomware
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7a:70:30:7f:26:c5:3a:f7:9c:ee:f6:60:49:22:a5:e7:3b:dd:31:ba:b1:ae:7f:31:9b:1a:a9:75:08:2e:26:d3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 7, 2022

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

108046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d
MD5 8eedc01c11b251481dec59e5308dccc3
SHA1 24bf069e9f2a1f12aefa391674ed82059386b0aa
SHA512 52388313b21f14aa69c8b37e0fe0b73f66aa92f08651a16c820aae65d341dc1af6b48f3c8d4f657ac990eeaf4b9a01ae769bca4d3625550011708697d22b69cc
SSDEEP 384:HLWZcaCisD/WRdL5kyc/Ss4fzrngNsIhOrAF+rMRTyN/0L+EcoinblneHQM3epzN:iZcID5nc/Ss4HysIsrM+rMRa8NuM0t
TLSH
T156033B4D7FE18168C5FD057B05B2D41207BAE04F6E23D90E8EE5649A3B636C18F54AF2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497.exe

IMPHASH 423af1da39b76874f44f881255726517
SHA256 123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497
MD5 5c6f4f280e5fba76c585b9870dae75a2
SHA1 2fba1d29d3d35975d90c3018d58a7eefcf269583
SHA512 6884829292f13dd2241f4312baef5f566e8171fec1e0be72369396d3e58a202fb3aeeb6c3253e02baa13234b2012775622957b2ebffb109dbcf800d8ba09bde8
SSDEEP 24576:UOkWG4cNwzsU4svqOczLlyr2f7o5ya8j80QZr5l:UMywYU4svqOczLpDza8FQ9/
TLSH
T14D357D5A33A4419AFEA7F0779A56C60BC6B1788E0337972F01E45A766F336701A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

196484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

WSACleanup socket inet_ntoa setsockopt ntohs recvfrom ioctlsocket htons WSAStartup __WSAFDIsSet select accept listen bind closesocket WSAGetLastError recv sendto send inet_addr gethostbyname gethostname connect

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

InternetQueryDataAvailable InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetConnectW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetModuleFileNameW GetLongPathNameW GetShortPathNameW DeleteFileW CloseHandle CopyFileExW MoveFileW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl GetLocalTime CompareStringW EnterCriticalSection CreateThread GetStdHandle CreatePipe TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass LoadLibraryW VirtualAlloc GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW DecodePointer GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection EncodePointer DuplicateHandle GetCurrentProcess LeaveCriticalSection GetCurrentThread ExitProcess GetModuleHandleExW ExitThread GetSystemTimeAsFileTime ResumeThread GetCommandLineW IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetStringTypeW SetStdHandle GetFileType GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation GetDateFormatW GetTimeFormatW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FindNextFileW SetEnvironmentVariableA

user32

RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture UnregisterHotKey CharLowerBuffW MonitorFromRect LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu GetCursorInfo GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic TranslateMessage SystemParametersInfoW keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongPtrW GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate TrackPopupMenuEx DispatchMessageW OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon FindWindowW PeekMessageW ScreenToClient

gdi32

StrokePath DeleteObject GetTextExtentPoint32W ExtCreatePen GetDeviceCaps EndPath SetPixel CloseFigure LineTo AngleArc MoveToEx CreateCompatibleBitmap CreateCompatibleDC Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx SelectObject StretchBlt GetDIBits DeleteDC GetPixel CreateDCW GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject StrokeAndFillPath

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership RegCreateKeyExW FreeSid GetTokenInformation GetSecurityDescriptorDacl GetAclInformation AddAce SetSecurityDescriptorDacl GetUserNameW InitiateSystemShutdownExW

shell32

DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoCreateInstance CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket IIDFromString

oleaut32

SysStringLen VariantChangeType DispCallFunc CreateStdDispatch CreateDispTypeInfo VariantCopyInd SysReAllocString SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData VariantTimeToSystemTime SafeArrayAllocData SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString LoadTypeLibEx RegisterTypeLi RegisterTypeLibForUser UnRegisterTypeLibForUser UnRegisterTypeLi VariantCopy VariantClear VarR8FromDec SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi SafeArrayAccessData VariantInit

41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe

IMPHASH 480e15f1c0ffcaef8e7a03e98c1830ef
SHA256 41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
MD5 c27f23181c3ebd80f3dae27d88b86267
SHA1 12bef40a06323256fc0e903503a49f4623af7dcb
SHA512 b22159a971988198fee78f861ad938dfce12ba5b993593b7bfd4e54938b95d39b6f3d09ed4a9be7081181a8499a7aeac3a47a2edfab52812e7757c6d53d753ce
SSDEEP 3072:8Cut7gBHz/0OUGyQkRACh3Uim7ef10wYaGyeG7sGcMBIGv:3udgBHz/pUNlRAC+bu1iaGy3Jv
TLSH
T10124F801F11FDBEAD69303BC4957A602BDBB36912B208EE783844A705D0B1D57AEDF91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLocalTime WriteConsoleW CreateFileW SetFilePointerEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetFileType SetStdHandle GetStringTypeW HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode

user32

wsprintfW

ws2_32

WSAGetLastError htons

47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31
MD5 6a336059f649a3143b1c68f2bbf41187
SHA1 665532e4743075aae22b958bacab5dd4af4ee39f
SHA512 9019bee8e01d1a48d06216180eb93fc7a0931989f624635dcba9dceb2aa08085cb1faa5472c18aa29df9dc3809400c6d2df10b8573228c8a99219c7bffd363ae
SSDEEP 49152:GjLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:6Lu1TIRtUOV5Zv
TLSH
T161464A05B7D88526D4BF473A593393842371FC939C23876F31A0A26E7E717908D92B7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects NominatusCrypto C# variant
Detects NominatusCrypto DOS executable variant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb

48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521
MD5 40ec0e62856036983be04f31ce670fb9
SHA1 0d04b8139fe71a1736a8168fbf072df61d7d7bd6
SHA512 1094d49d3fcb757fe2d1c49d1e441ab086f4cff80ffd8572b0017546350838dcba83f102796009d811a360f6825928c13e3697b7dd462627bb83fb92534fc806
SSDEEP 192:z/TeYoeb67sc8+otH8SESePujd2kTCMZehZtzMuuQzBLerxA/GWeGMEd022XbTFi:z/yYoebe5JotHESxjuM63KI
TLSH
T10A95B071496B50CCD9FFA4516AC2E79CDE471F442A7CB0AB941C4A6B8B12004EF72F7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2031166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe

IMPHASH 544e4498dc502665883290ca1bc2424d
SHA256 48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb
MD5 eff424376edca5680b90ea9fedad163d
SHA1 3c13c1e54d2d7991c1c3452ae89888a8e7a47763
SHA512 5acc904da2b8f3371a5696194b4a6fa7c3e735b0bbe74a507efb56782e6fc604f9bd3abf7a3af5f57325c7115de3ac9cd499086430d0d4fbe81b46a57539f068
SSDEEP 12288:Y4LNVuczF0QdQsJlehKRwYgJcViFYvgNv+5jGbRFhVoj4d:xvn2sJlBRwYgJcVNE+5jU8j4
TLSH
T168C48E217491C07AD67253F04EBCDB91256EFC340F721ACBE3C4196D1A7C5E16B32AAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wldap32

ord13 ord88 ord14 ord215 ord41 ord72 ord145 ord191 ord135 ord206 ord224 ord140 ord27 ord26

kernel32

FindVolumeClose GetFileAttributesW GetFileAttributesExW GetFullPathNameW GetVolumeInformationW GetTempPathW GetVolumePathNamesForVolumeNameW OutputDebugStringW CloseHandle GetLastError DeviceIoControl SetEvent WaitForSingleObject CreateMutexW OpenMutexW CreateEventW Sleep GetCurrentProcessId CreateThread GetModuleFileNameW LocalAlloc LocalFree WinExec FindNextVolumeW CopyFileW MoveFileW FreeConsole GetComputerNameExW LCMapStringW IsValidCodePage FindFirstFileExW GetTimeZoneInformation HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType CompareStringW GetTimeFormatW GetDateFormatW HeapFree CreateProcessW FindNextFileW FindFirstVolumeW FindFirstFileW FindClose CreateFileW GetCurrentDirectoryW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FormatMessageW FormatMessageA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetStringTypeW QueryPerformanceCounter HeapAlloc GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount ResetEvent IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead GetCurrentProcess TerminateProcess RaiseException RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW SetFileAttributesW ExitThread FreeLibraryAndExitThread GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetExitCodeProcess

user32

SystemParametersInfoW GetSystemMetrics

shell32

SHChangeNotify ShellExecuteA

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocStringLen SysAllocString VariantInit

advapi32

SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx OpenServiceW OpenSCManagerW GetServiceDisplayNameW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigA RegSetValueExW RegOpenKeyExW RegCreateKeyExW SetSecurityDescriptorDacl SetFileSecurityW InitializeSecurityDescriptor AllocateAndInitializeSid

55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87.exe

IMPHASH 266bed6766ee2a20cf7c2dd0d6245d96
SHA256 55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87
MD5 0b02ee2e49b0647393978b3013126752
SHA1 8d12b9bb51c80b99ce39f3bc574d9ad509b954f8
SHA512 1ea076d9afdc3c9728550ef666213aad22fa0a63bdb6162c5557cdec05f9d917b02789516160325b024e2a95e9e5445674850f5f6a21dc207d600adc26576645
SSDEEP 6144:5aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371or:5uTs1gBpQL5kmh0671or
TLSH
T172840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Seven ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

158849

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\admin\Desktop\new version with NO UAC\Release\Win32Project9.pdb

kernel32

GetCurrentProcess CreateProcessW ExitThread WaitForSingleObject GetLastError ExitProcess IsDebuggerPresent GetVersionExW GetVolumeInformationW SetEndOfFile HeapSize WriteConsoleW ReadConsoleW GetProcAddress FindFirstFileExW FindClose GetCommandLineW GetCommandLineA GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP GetModuleHandleW CreateProcessA GetStartupInfoA GetModuleFileNameW SetFileAttributesA CopyFileA GetFileAttributesA GetModuleFileNameA CloseHandle ReadFile GetFileSize CreateFileW GetFileAttributesW FindFirstFileW FindNextFileW SetFileAttributesW GetLocalTime CreateThread WinExec GetLogicalDrives SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale Sleep GetFileAttributesExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo FreeLibrary LoadLibraryExW RaiseException RtlUnwind QueryPerformanceFrequency MoveFileExW GetModuleHandleExW GetStdHandle WriteFile GetACP HeapAlloc HeapReAlloc HeapFree GetFileType GetExitCodeProcess

user32

GetSystemMetrics LoadCursorW RegisterClassExW CreateWindowExW ShowWindow ScreenToClient GetCursorPos DrawTextA MessageBoxW DefWindowProcW PostQuitMessage DestroyWindow SetTimer KillTimer InvalidateRect EndPaint DrawTextW FillRect BeginPaint DispatchMessageW TranslateMessage GetMessageW GetWindowLongW SetWindowLongW

gdi32

LineTo MoveToEx CreatePen SetBkMode DeleteObject TextOutA TextOutW SetTextColor SetBkColor SelectObject CreateFontW CreateSolidBrush

advapi32

SystemFunction036 RegCloseKey RegQueryValueExW RegOpenKeyExW GetUserNameW

wininet

InternetOpenUrlW InternetReadFile InternetOpenW

netapi32

NetUserGetInfo

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0
MD5 51aa11d492b16e856d105368839e9105
SHA1 9800d1db47238cffea6d5581b57bab555b6df82d
SHA512 7385b5eec285d1e1b945555a757c2b055241d913944e32e8384f74da391213e514ada32356ef2a8788b81d5d52d01588e14bcb2a3e83a421db6425b79a999a99
SSDEEP 24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKa:2jLuSh3i+FtvkMzT+A
TLSH
T1D5C55A4977D4C126C0BF0736487392852372F8979E1346AB34E4B32E7E757D04EA2AB9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects NominatusCrypto C# variant
Detects NominatusCrypto DOS executable variant
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\sd\Documents\SharpDevelop Projects\VirusMSILNominatusStorm\VirusMSILNominatusStorm\obj\Debug\VirusMSILNominatusStorm.pdb

55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843.exe

IMPHASH c94b1566bf307396953c849ef18f9857
SHA256 55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843
MD5 8e09e25c6dd51a06b9383457a5ec4b1e
SHA1 bb04c8d83f8946c3e03386269b290fb338c07dae
SHA512 5ff01b4a419f3e25b5b3b154b556dd847a33aff884e25fc2c827bdf7c2d10b77affb7908f46b7400c293470314984ad771303d6468c6909b86093af9fca0414b
SSDEEP 1536:1zICS4AT6GxdEe+TOdincJXvKvWLBjklE:WR7auJXSOhCE
TLSH
T13A6339207181E0B3E466DBF3E70A75A2B349DE3A0D626817E9E80F086DF89536F15D47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8
MD5 43463844f2ca09486f3e74596bd6993b
SHA1 41070fe9ce92b1195ecd3f683d6b160bf0ec301d
SHA512 241504c7f1f9c75d8694997a6c45693bebf47a4548912126dfae70dfb834e67fb0c88437cde09e5d61ddff118de5f481b90037889903c8d5fc242e6567914181
SSDEEP 98304:aqXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5Bemg3A:n405QYtsTEB08T8HehLvt
TLSH
T102E5235128CBDC35CB7A24FE053BAA21E6D12D93D475931B3BA20E652A096B0CF4F4F5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects SoranoStealer payload
ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3211274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d
MD5 671ad98a0e0c83defa386673bed208c4
SHA1 f90e106afe7a980137313a758cf90ab343a73e6c
SHA512 0f7b816e15c7b3a5919fdcde4f4299b89a9eecc78fdc5adc969157e08b9bbd85ec6fd842521d8c8abdb59d13f8a85ec3986a294da86dcac98eeace06a4bc151c
SSDEEP 3072:1H9R99nTRtB7lhy93yr5MgvRLT+Y+SHZSm+MPM+oFKpsE891VI:d9RLRfZTT+c7M+oIt
TLSH
T1AE2479262AF6105DF1F3AEBB47D9709AD5BEE7B2271344A931B103460623D439981F3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

72406ec12b191d2fa211cf1899e62c9257379d5bdd1d850c66cc546685f3d8ea.exe

IMPHASH 9ecee117164e0b870a53dd187cdd7174
SHA256 72406ec12b191d2fa211cf1899e62c9257379d5bdd1d850c66cc546685f3d8ea
MD5 ecf4ccc75a4d40f2b70f3e05b4f0695c
SHA1 fcc5ba39aa2ef5b48e62270bb0a8880856b677d4
SHA512 e719d0eafac81e313b7357aa11d7f60993f7be80d83c99ef938a7bf3ba96ebf634d0d8577d0dd63d5866c7cd8529a2097f781a2fd9aae0dc64b1f1ebcd3d6ce3
SSDEEP 24576:VbLgurihdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTPVXmiHkO:VnnMSPbcBVQej/1INRx+TSqTdX1HkQ
TLSH
T151B523D971AC92FCD2053A74947B8E23E6F23C6D21F96E0F9B404A751C03B5ABB50A53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject InterlockedIncrement GetCurrentThreadId GetCurrentThread ReadFile GetFileSize CreateFileA MoveFileExA SizeofResource TerminateThread LoadResource FindResourceA GetProcAddress GetModuleHandleW ExitProcess GetModuleFileNameA LocalFree LocalAlloc CloseHandle InterlockedDecrement EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalAlloc GlobalFree QueryPerformanceFrequency QueryPerformanceCounter GetTickCount LockResource Sleep GetStartupInfoA GetModuleHandleA

advapi32

StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA ChangeServiceConfig2A SetServiceStatus OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceA CryptGenRandom CryptAcquireContextA OpenServiceA

ws2_32

closesocket recv send htonl ntohl WSAStartup inet_ntoa ioctlsocket select htons socket connect inet_addr

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

msvcrt

__set_app_type _stricmp __p__fmode __p__commode _except_handler3 __setusermatherr _initterm __getmainargs _acmdln _adjust_fdiv _controlfp exit _XcptFilter _exit _onexit __dllonexit free ??2@YAPAXI@Z _ftol sprintf _endthreadex strncpy rand _beginthreadex __CxxFrameHandler srand time __p___argc

74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 74494d60aaa78a3af5ed734f5d981cdf32573eefe4a17be66013af895e2987b4
MD5 801dfa0bfb890082c7e7f0394051f9eb
SHA1 dc9b056cd1367f84b2d4bc03c90bcca6cd3eea8a
SHA512 eb192ce8047787a4fc7e9628aca860ce8802e512ef28c4bafa667a7901c40a94259b1f58f085f035971ca59a710c80f4b7e7fcadd13020dcac8170625930b645
SSDEEP 6144:jKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkaH:WzCGL69zVGkllbka
TLSH
T13A945A2527E8A93BD9BE17B4F53141094BB6FC07B557F38E6A1818B82C1A34981837F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

300094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361.exe

SHA256 78272eae2668169b0afb19168a71d103974da30d597a3f509ccf607c842fd361
MD5 3ac0d935228460fdc38bdab692d71b0c
SHA1 d08f753af5b5d9be3352495189be6fd4914ad8e1
SHA512 04376fc469808504a8071f0b9baa35c4f922d7b69c4d4c6e77309022f95cf916a80b758a6733154f36e8be59d928b93903eec47a6df32e96b2ef3b4b6f0fde54
SSDEEP 6144:k9Pj5XJkcXV50DErs5xgTw7ozFz254WfRgzJmXrQwAN:akzDZGcoxfWfRglerQwAN
TLSH
T1E444BF10E6C290F2D8A70FBD98FA59FE90352A304735E3F7EBD54E9989366C2D138251
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect Neshta payload
Venus Ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

78740c6e81c6beb5c8a5429d06697fe4fe5d46d0e6c08d901367a256481fd474.exe

IMPHASH ed3c2cf4a30e2437502a5d05e29f059d
SHA256 78740c6e81c6beb5c8a5429d06697fe4fe5d46d0e6c08d901367a256481fd474
MD5 f3301ab28c5f18ceabd0f1c47fabde4b
SHA1 4c2f5d2ce6d48ef7bd9b403d12064884e30bf40c
SHA512 6499d11d7afa9032e8bdd28519b8e0a8045bdf685979b0bebe6bf3c851e6edaeb67d9c0afbaee5c281c6631d1d96cad4cb4c6c7f299a3e53be61e94f02324de1
SSDEEP 12288:LwSksTVs9zsprBHWTXcNm9WQj7vDlPpF5C:PWTX2IWQjPJpF5C
TLSH
T1B9B47C50F3E414E5F1B78A358D768611CA767C9A1B60DE8F12A8265A1F33BD18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\deploy\jre-image\bin\javaws.pdb

kernel32

GetCurrentProcessId WideCharToMultiByte FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW CreateDirectoryW FindClose FindFirstFileW CloseHandle WaitForSingleObject CreateEventW OpenProcess GetTickCount GetSystemWindowsDirectoryW GetModuleFileNameW GetThreadLocale CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetEnvironmentVariableW CreateFileW GetLongPathNameW GetShortPathNameW GetTempPathW RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetCurrentProcess CreateProcessW GlobalMemoryStatusEx GetLocalTime GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetNativeSystemInfo GlobalAlloc GlobalFree LocalAlloc LocalFree FormatMessageW lstrlenW VerifyVersionInfoW WTSGetActiveConsoleSessionId OutputDebugStringW GetCurrentThreadId GetExitCodeProcess GetModuleHandleExW GetFileAttributesW WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileSizeEx GetFileAttributesExW SetFilePointerEx ReadConsoleW ReadFile SetEndOfFile HeapReAlloc GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableW HeapAlloc HeapFree GetStringTypeW WriteFile GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection MultiByteToWideChar RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA GetCommandLineW DeleteFileW GetTimeZoneInformation GetStdHandle

user32

GetMessageW TranslateMessage MessageBoxW CloseDesktop DispatchMessageW DefWindowProcW RegisterClassW CreateWindowExW SetTimer LoadCursorW wsprintfW OpenInputDesktop GetWindowThreadProcessId GetShellWindow

ole32

CoTaskMemFree StringFromCLSID

oleaut32

VariantClear SysAllocString SysFreeString SysStringLen SysAllocStringByteLen

wsock32

WSAAsyncSelect socket send ntohs listen ioctlsocket htons getsockname accept recv bind closesocket WSAStartup WSAGetLastError connect

79494b2b76515207a2cf1a29484096cbf884ea4b0e2b834af07beac7879ce714.exe

SHA256 79494b2b76515207a2cf1a29484096cbf884ea4b0e2b834af07beac7879ce714
MD5 b2de8946fb439575f2777559e1a74095
SHA1 1ad2a01982c85718bf883899c3de7d329c8e4057
SHA512 bb6f4f952a8067aab434e45f38565ad3f1d7fb7c78626608ac6fffb08b145ead5d9643e7a88f6cacb68ae45ade644ad6d4be32d4ee291767074006e874147943
SSDEEP 1536:gOY47IHwHDLvujZZmn/tUuNpOLR1aJmvH8GsBjW5BKbOTWgYwJkRG5z:gOt7rHDLvUZmn/t7Npu/GIkRG5z
TLSH
T15345A357D7364DE3C68A8CF4F994097264B8E2EB3F80E8269F683F384AE07614171765
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:6d:b5:c4:0d:a4:8b:5f:e2:12:7e:4d:57:da:33:5c:28:ef:9d:2f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

1241888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

81331f7bbcf9c0b0f000ff6ab02dcc40b30c0cce5b3daa23f9efb1bc70fab4e8.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 81331f7bbcf9c0b0f000ff6ab02dcc40b30c0cce5b3daa23f9efb1bc70fab4e8
MD5 f7aded1fe838c4575a9c79edd4c17c6d
SHA1 4d4c757852cbd46c493841c6630a2615042df61d
SHA512 dfe660908130d1e9a212e09e0aa53708467098354b8c0254ccbbeec845609644a39ebde88432e68de16b406a298702c925eff45460123db21942c0ff0007ff26
SSDEEP 3072:LNOAPUMfM4R2JJ3YGf/B1co8aJ0Pk1eSGkNljeAx5zjuPmu5SokC:BPU4vYQSj6AvzMmu5Sok
TLSH
T193E3CF1133E90706E4BE17F599B6427007737A529938DB5C1ECD11CE4FA3F268AA0B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

150858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\cloudrdp\Desktop\ClickApp Source Code (4) (2)\ClickApp Source Code\Click\obj\Debug\Click.pdb

89566f5dbdc136845cba15979fb9f7184f59385ce014a5f6cdd82e00619d95f3.exe

IMPHASH 423af1da39b76874f44f881255726517
SHA256 89566f5dbdc136845cba15979fb9f7184f59385ce014a5f6cdd82e00619d95f3
MD5 69522c3ff2b86762017ccff2dcd62662
SHA1 fcecd6ff44ae6f67e2f2f1b9c6dda9cbf878118d
SHA512 119395c8ffc83b95f647ee3005c533949cf1a3477d545ea589fee68e7efebefe015907212be6113f76a260b8d985efb1b699b8af9c465aa53ced99b0d6ea50ce
SSDEEP 24576:+JusUaY6HQDq4svqMQ8E8uNofno5ya8j8F8eqLZ:+DRHEq4svqMQ8E4vza8V
TLSH
T1A2357D5933A441AAFEA7F0779A56C60BC6B1788E0337972F01E45A766F336701A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

196484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

mpr

WNetUseConnectionW WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W

wininet

psapi

GetProcessMemoryInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle IcmpSendEcho

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock LoadUserProfileW

uxtheme

IsThemeActive

kernel32

user32

gdi32

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

shell32

ole32

oleaut32

95276f51959260cb55e9f476eb5b334301b789ed91dab04bf8572e5a8bcaf1b8.exe

IMPHASH e2c1b25eb49294e6baed6055b9bffac1
SHA256 95276f51959260cb55e9f476eb5b334301b789ed91dab04bf8572e5a8bcaf1b8
MD5 faeee06fff51027dec9b5492fe32e50e
SHA1 11b12a67786d8ba6dfd3587dfb62d1804f118127
SHA512 9f6c32fe427f52bc20b9e1bc6b3fe8b66843ccc1174e016e23fdda1d41d1cb93622ec0bd48b85a6995ba0b38422d1e329ee7382e5a6eb81431710250bbf9622e
SSDEEP 1536:VTW/lHIvblB3JbS+Sqglp+Agd1kY4zwPuiu7XJ0wLUk538Hg:Vi/FITPNKqglp+Agd1kY2wGNXUk538
TLSH
T1C2834B06FE0B60F2EC2BC97156CBF66FC612F13090244D59EB888857EAA7DE2581D717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CloseServiceHandle EnumServicesStatusW FreeSid GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerA RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyExW RegDeleteKeyA RegEnumKeyExW RegOpenKeyExA RegQueryValueExA RegSetValueExA RegSetValueExW RegSetValueW SystemFunction036

gdiplus

GdipAlloc GdipCloneBrush GdipCloneImage GdipCreateBitmapFromScan0 GdipCreateFont GdipCreateFontFamilyFromName GdipCreateLineBrushFromRectI GdipCreateStringFormat GdipDeleteBrush GdipDeleteFont GdipDeleteFontFamily GdipDeleteGraphics GdipDeleteStringFormat GdipDisposeImage GdipDrawString GdipFree GdipGetImageGraphicsContext GdipGraphicsClear GdipSaveImageToFile GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdiplusStartup

kernel32

AttachConsole CloseHandle CreateFileW CreateMutexA CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteFileW EnterCriticalSection ExitProcess ExitThread GetCommandLineW GetComputerNameW GetConsoleWindow GetCurrentProcess GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileSize GetFileSizeEx GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetShortPathNameW GetStdHandle GetSystemTimeAsFileTime GetTempPathW GetTickCount GetUserDefaultUILanguage GetVersionExW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA MoveFileExW MultiByteToWideChar OpenProcess Process32First Process32Next ReadFile ReleaseMutex SetFileAttributesW SetFilePointerEx SleepEx TerminateProcess TerminateThread WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpA lstrcmpW lstrcmpiA lstrcmpiW lstrlenA lstrlenW

ole32

CoCreateInstance CoInitialize

shell32

CommandLineToArgvW SHChangeNotify SHGetFolderPathW ShellExecuteExW ShellExecuteW StrChrA StrRChrW StrStrA StrStrIW

user32

CharUpperBuffW GetForegroundWindow GetKeyboardLayoutList GetSystemMetrics ShowWindow SystemParametersInfoW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

ws2_32

WSAStartup closesocket connect freeaddrinfo getaddrinfo getsockopt htons recv send sendto socket

99107b41b352fff203b4363bc38aa703fa949b5e24a91df723e7218a41554cc8.exe

IMPHASH b12d4a6c16cf27542a84814bb0e6f8ba
SHA256 99107b41b352fff203b4363bc38aa703fa949b5e24a91df723e7218a41554cc8
MD5 fc213954dfe65c56521c7d3a9860d462
SHA1 0e2ddcbea4abefc3f28641d43609fb2000c62d25
SHA512 692cb5ebd3e0f17ffea53e700fc47540b50b7e89442cbe370ee54a4e20eff038b46fdfa5e8f335fad6c5083ee4647930c68d420c9941f6902cdf3b00ae794336
SSDEEP 3072:rQQYU39IKMM+mTh/f/MNmFN4UNcGr/yryIdXRWy4ZNC92FKnH7mrDhA/:rss9z5T9fENmFNnm2aOpBZw9cKnHG+/
TLSH
T12C241713629420E7D063B674B86FCB6F97727C6F07647B3A531C3F4A9E622809D29631
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

kernel32

GlobalLock FlushFileBuffers WriteConsoleW SetStdHandle OutputDebugStringW HeapReAlloc LoadLibraryExW LCMapStringW SetFilePointerEx GetConsoleMode GetConsoleCP LeaveCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap RtlUnwindEx HeapSize GetModuleHandleExW ExitProcess WideCharToMultiByte GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapFree GetLastError RaiseException RtlPcToFileHeader HeapAlloc GetCommandLineW DecodePointer CloseHandle VirtualFreeEx ReadProcessMemory VirtualAllocEx OpenProcess GlobalUnlock CreateFileW GlobalAlloc FreeLibrary GetProcAddress GetModuleHandleW MulDiv MultiByteToWideChar GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent EncodePointer

user32

GetClassNameW SendMessageTimeoutW AttachThreadInput GetWindowThreadProcessId GetWindowLongPtrW GetParent SendMessageW GetCursor GetDesktopWindow RedrawWindow GetWindowDC IsWindow GetWindow ChildWindowFromPointEx ClientToScreen EnumChildWindows GetWindowTextW GetDlgCtrlID GetWindowLongW GetForegroundWindow WindowFromPoint CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ReleaseCapture SendDlgItemMessageW SetCapture SetCursor EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DefWindowProcW MessageBoxW DestroyWindow KillTimer PostQuitMessage GetWindowPlacement RegisterClassExW LoadIconW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW SetTimer GetClientRect SetWindowTextW SetWindowPos GetMenu CheckMenuItem LoadCursorW LoadImageW RegisterWindowMessageW RegisterHotKey CreateWindowExW DestroyIcon ReleaseDC GetDC GetCursorPos IsWindowVisible ShowWindow EnableWindow MoveWindow ScreenToClient GetWindowRect InvalidateRect

gdi32

DeleteDC BitBlt LineTo MoveToEx StretchBlt PatBlt CreateCompatibleBitmap CreateCompatibleDC Rectangle SetROP2 GetStockObject SelectObject CreatePen GetPixel DeleteObject CreateFontW

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

File Explorer

jaffacakes118_samples.part021.rar

0178461a8373f6147042d0c7ca7febb020dc4f600e639d6a53d343c02899bc9a.exe

PE Signature issue

mscoree

dotnet

0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d.exe

mscoree

dotnet

123227e58b482005a9669c39d31bdb154a0f32958423868a4d0262971e5a6497.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629.exe

kernel32

user32

ws2_32

generic

47913d758d8c6e8395192eaf6928cbe33fde590f2839aa8521d8e83687de1e31.exe

mscoree

dotnet

48586ad6d444978aac4736f05bef2751d49929ce24b187da39ddc4d0c8979521.exe

mscoree

dotnet

48976d7bf38cca4e952507e9ab27e3874ca01092eed53d0fde89c5966e9533bb.exe

wldap32

kernel32

user32

shell32

ole32

oleaut32

advapi32

generic

55219b5a69ccdf7002ca55831e6d04611861847eafb321ef54892d427c586f87.exe

kernel32

user32

gdi32

advapi32

wininet

netapi32

generic

55509a771fe9e7218e8acd9a9ce5150bd1f21956559dd28213a14266e22583c0.exe

mscoree

dotnet

55926e8f3e48c5cc5a1e6279045a5ae39c26dcc79e84411d34f7b2158042a843.exe

gdi32

user32

kernel32

generic

56990b801d101923eb89cf71604e9af32d7ce8d074f7dd50bd2877bf906542aa.exe

63749db0a9eb1a3c20cbeed08aae309ea5be7a0318d954cd3e74f6ffef2125f8.exe

mscoree

dotnet

67628a5f04c7099346dd18957a4bc5179f5c3a07b41ca0d2a9e708dcab54d16d.exe

mscoree

dotnet

69417ec104c1dd07e5067110d6e7f3c643c534d14db65a704bc0c14c223c3001.elf