jaffacakes118_Trojan-Ransom[.]Win32[.]GenericCryptor[.]jnu[.]ed441acec18afa29fe57d4b9e66ba126

resource
jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.ed441acec18afa29fe57d4b9e66ba126
unpack001/$PLUGINSDIR/System.dll
unpack001/isogamy.dll

jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.ed441acec18afa29fe57d4b9e66ba126

IMPHASH 2b0b308f8b60d9352318c75e4bab2335
SHA256 2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78
MD5 ed441acec18afa29fe57d4b9e66ba126
SHA1 ee063b1146b855dc5f276228918fe0dee35c15cc
SHA512 9c64de1d74eebc52ccde7d0cd40dc3d40c15d3c25f0852ef4959b9a42022eaab80ae91d2922cd37be80af6407889f8bb5fcab6042f7378469d4c0fa7f32bf391
SSDEEP 6144:j+bxZqpbDY+SbL176/3Dc4qTjv7vzxY89zij5iiPDDjUr:j+KpbDYBR6bDKv7ra8oiODjUr
TLSH
T15B440208E7E9D063F9B34B312979C4625FBEF8102875525F9720EE4D3C3669AD41A336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13917

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW CloseHandle SetFileTime GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW WritePrivateProfileStringW SetFileAttributesW ExpandEnvironmentStringsW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW LoadLibraryExW FreeLibrary lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc SetErrorMode GetExitCodeProcess LoadLibraryW GetCommandLineW MulDiv DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer MultiByteToWideChar ReadFile GetPrivateProfileStringW WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData CreateWindowExW SystemParametersInfoW GetDlgItem AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA wvsprintfW DispatchMessageW PeekMessageW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW SetWindowLongW IsWindow OpenClipboard EmptyClipboard TrackPopupMenu FillRect DrawTextW EndPaint FindWindowExW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ord17 ImageList_Destroy ImageList_AddMasked

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
MD5 3e6bf00b3ac976122f982ae2aadb1c51
SHA1 caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA512 1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
SSDEEP 192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
TLSH
T1C5325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Ashgabat

SHA256 b4acd883b629ebffd787afd809ba81ada7df5cce380dbd47afcb7f087c1dd940
MD5 2be036ed1b2c3be1a2e2dbfe0c84c285
SHA1 598c81469655ab0c1f604d855a79b96c2a1ba21e
SHA512 c9576f8707a9615400e72707bcc25ff35302e0c04e78a0d7d1ac300c18a5329b4bc3ff6c419fcdc2d55c98fbe7b8dc192b5cffd9de2b0c6a366bfd3f40bea9a8
TLSH
T1C0D02BC204E9536C9E6D281A4872026E6134ACB6ADDA1F527112007238356365F98999
MD5 SHA1 SHA512 TLSH

Chamfron.qiNb

SHA256 991b7266b76adaaea57dd9afe3949917229a629c41768c94b4eb8fd49b0b5873
MD5 1afd54b1afe321e620b87eb6dc538b0b
SHA1 39f7c37846edcd0c42f46958f55ebf37f390a7c0
SHA512 acbbf5c32f131b108b6c7a71ea3bc6faf7895875c9346951778cb5dd506ec477905ad03662a1bf1a793e1536b5a28f92ecc08df9086a66f33ceec5aab20c993d
SSDEEP 3072:e8Ho/G0U+e5bL12N5e6l3aAXHXDc4qTjv7vHB7Fxf4hJMp9nP7hMg1AJ58xNL:eDY+SbL176/3Dc4qTjv7vzxY89zij5iZ
TLSH
T1F704125DC4EBA8F12A668B1D3149C4624AEED81C146A52F9D828E58C1C393FEF45F33D
MD5 SHA1 SHA512 SSDEEP TLSH

Darker.blw

SHA256 8b0ad7bce04323a4acd8f7344e3af3c9ca028c6aeb9b385b661da906f603f69a
MD5 c0614311afccbd9e7227bc466fd71fc6
SHA1 e02bad28ce44113d858c8494a87dd3a7b91831ba
SHA512 0f9457c60fb891b973f9a17548984e1301b21574a70ce5f8b1b9aa339e3b891a1709d85b3198c016430d2855bd63b5fc6263f24334bcc385c56748f5578bd00b
TLSH
T15BE02E0EFA710B82FC04803E828B0F4B2E20688845F9B73289F400E839C23E3B029249
MD5 SHA1 SHA512 TLSH

burn_in.png

SHA256 fa01bcf879a0e0392c0442397f1014bbcbabfa9e66e154d5f037764e94f845b0
MD5 ef099c909fddb968c36c5d96ef53e91b
SHA1 9062d30e3e7ef67c76e5d592bd10b047181373b7
SHA512 ed1b62c7fb02a17da0953bc8c1f9adc61cc92ce695d80d15dd5a0db3f143e4d13c4436a2245047775fa42c8dd4c4170592de18f4d92023060021d7ef759d93d5
SSDEEP 96:SSMW8R2tcvegZ6avIp+GntburoEgCWVRKymGY3LfQAAm/mOZvTs:SSWTvegZ6ckZioDCYRKymfbfQxKY
TLSH
T10CA18EB643888919E712E1EABF970860343D8EAA240FFDCC91B9F82605A53155342BDF
MD5 SHA1 SHA512 SSDEEP TLSH

cmaple$1.ico

SHA256 aab697b920176dea0c5a35c7eab8d8a861df8371f91c134a0cca2020618abd81
MD5 90f78031e2fe0ababcc5b5dfebb574fc
SHA1 cad9b3db7cb9686b9e3d3c0e6b7c1b53fa063edf
SHA512 14f5522b194df5bbdca295d8cf45d9836898449d388c84fb26afa0ac829ca73cd976a2063caa4a7c0d3765669f7ab27d1bc8fabd51baf1b5c1d9bef5a51a939d
TLSH
T11E41D003AF0BA0C6F4246A7115AB53262621EB4D3F53960F69772D7FCE365D76C026C4
MD5 SHA1 SHA512 TLSH

gray 423 bl.ADO

SHA256 2996b7db2a2c9f4635c900114ea79a2be2ae92141f22b5353dbb4b041c6db4a8
MD5 71b0428a6dc459fd172a66bfbc24b623
SHA1 c8da2b04a8fec74a0305ed397422727627d31f03
SHA512 003d04e16cf9b35209e576575186bbcb7d6540413baf86bf746ad0a16e70501554e45aa34194f50a6fde5bb4699965e9625808ad5e21554049dd8fbebd9d1427
TLSH
T180F092407000C408EC10CBBB2C8BE8D0E68A3C606D3A03A33AECBF2FE97F68184C1800
MD5 SHA1 SHA512 TLSH

isogamy.dll

IMPHASH 8dd989ff205f35deacf2ca53831f84fa
SHA256 28d518d8ff4e62b02b31d605f7285d57d9ffae62d49141278f9b8cb9c373adbc
MD5 e156b330371d62e2820b2613ca5c05ff
SHA1 b91d5b78944428c1f3e9ea47cb94708a602752fe
SHA512 84f7d48ca9e8794750edd07fe70d55e90d5261a56ecd2b75c27f7df4b7dd0d24aad94ccf4db5d8d205dcea3b00900f6eb4f53c97ff48201eda477b810954e631
SSDEEP 768:QL7TmGP76rtOwAC5j9HFxePrrFyscYuRArf9rka5Kg8X0e/LnFxp:QLnertzAC5xHODrosfT55M0e/Lnx
TLSH
T17883B710F6E5C3D1D0FB2E795072923A4624FC1D5A31831ADF93728E393AF01A9A9B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

36KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

722B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

4KB

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

4KB

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.ed441acec18afa29fe57d4b9e66ba126

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ashgabat

Chamfron.qiNb

Darker.blw

burn_in.png

cmaple$1.ico

gray 423 bl.ADO

isogamy.dll

user32

advapi32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.ed441acec18afa29fe57d4b9e66ba126

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ashgabat

Chamfron.qiNb

Darker.blw

burn_in.png

cmaple$1.ico

gray 423 bl.ADO

isogamy.dll

user32

advapi32

kernel32

generic