jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]NSIS[.]BrowseFox[.]gen[.]e1c1647e2a46cfd9190abde0e66f29f3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.e1c1647e2a46cfd9190abde0e66f29f3
Size 291KB
Sample261014-ejvpssfy7j
SHA256 affe4820a579343b655f16590d5941af3f4e37e37de1b69a283cbfdc897e91bd
MD5 e1c1647e2a46cfd9190abde0e66f29f3
SHA1 fa7b6eb75dc7881674278340635d0ed1f7f50bcd
SHA512 10fc48040bd7df2b8012d7e9d8e40f1e1c53554a32b9bd7f4d34262f7c2244edb22a904ed12cbe6f5b19615d3a95abaf541e5e8517bcbe4da30271050420f3a3
SSDEEP 6144:a4LFHsN18PdACJ7bm/Aa02vn8Jo2pBpvf+wy4FqYHq0ITUBbQ:7pHyuPKCJ7iz02v8fpHLqG3qUdQ
TLSH
T13554128B2DC16057D6A3CA74CAE7C6A7D9B2A3845033476B5F708F722E21152CB616F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/7za.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.e1c1647e2a46cfd9190abde0e66f29f3

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.e1c1647e2a46cfd9190abde0e66f29f3

.exe 291KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/inetc.dll

.dll 20KB
7za.exe

.exe 523KB

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.e1c1647e2a46cfd9190abde0e66f29f3

IMPHASH b86507c06cdbcec3edd95e095bc5f436
SHA256 affe4820a579343b655f16590d5941af3f4e37e37de1b69a283cbfdc897e91bd
MD5 e1c1647e2a46cfd9190abde0e66f29f3
SHA1 fa7b6eb75dc7881674278340635d0ed1f7f50bcd
SHA512 10fc48040bd7df2b8012d7e9d8e40f1e1c53554a32b9bd7f4d34262f7c2244edb22a904ed12cbe6f5b19615d3a95abaf541e5e8517bcbe4da30271050420f3a3
SSDEEP 6144:a4LFHsN18PdACJ7bm/Aa02vn8Jo2pBpvf+wy4FqYHq0ITUBbQ:7pHyuPKCJ7iz02v8fpHLqG3qUdQ
TLSH
T13554128B2DC16057D6A3CA74CAE7C6A7D9B2A3845033476B5F708F722E21152CB616F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

42:29:6a:5c:7a:ee:76:41:3f:95:17:c3:55:53:de:37:2b:85:b3:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Range Picks,O=Range Picks,L=Escondido,ST=California,C=US

Chains

Jun 14, 2016

CN=Range Picks,O=Range Picks,L=Escondido,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Range Picks,O=Range Picks,L=Escondido,ST=California,C=US

Serial Number

41:b7:41:2a:b7:d5:0a:1e:9e:2c:4e:80:e1:5c:48:c7

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 23, 2016 - May 23, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

13132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread LoadLibraryA CreateProcessA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion RemoveDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

ScreenToClient GetMessagePos CallWindowProcA IsWindowVisible LoadBitmapA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuA CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos CheckDlgButton GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA LoadCursorA SetCursor GetWindowLongA GetSysColor CharNextA DialogBoxParamA ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumValueA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 88d8a4a9c21e345682f6b1fac45c4679
SHA256 9bb31f7f02231e3166bf52385d804c06da9740e9c6f0bda807b01052ae9fdcd4
MD5 7fbda5b7be6256996d4e59e5f6949918
SHA1 2d36c0e0bfbe450675c6ed044e715abaa85a252a
SHA512 bc0d36aa6f50041bad05cf48d909ed5a387bff5b111f657591161a288c1be5c20b8c5d69e557b5ea395726d91601b9e6303da81555e053090cfcbf5d44be7f82
SSDEEP 192:cR9jFtTLkreShqlyXMUspRRFtvD4feuy9mt2h8pGfhn9:crjy+2MFmfeuyaG5n9
TLSH
T109224C65439082F3D894823C1D627A371B7D362091F34E93EFB358D4DD6AA427E3A356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9625

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
TLSH
T1C1921A01AF5566F3D3A90830F569375686EBAE742530A4876BF31FCD186A283FA35703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

7za.exe

IMPHASH a27a282eaa8dea8ef01eb4bdd213fffb
SHA256 fa252e501332b7486a972e7e471cf6915daa681af35c6aa102213921093eb2a3
MD5 e92604e043f51c604b6d1ac3bcd3a202
SHA1 4154dda4a1e2a5ed14303dc3d36f448953ff6d33
SHA512 ef396d94d83fd7a588c6e645ea5fcfe24390440a03b3bf0ecd05ca6749fd3f9561dfafe725ee0edea51a34d52af26cd311e768aa72f75686cc796abee4757d43
SSDEEP 6144:JuVUUjwolg4owroOvHlq1t423ykka8dX+wWAZF5ULT0pny+6BTXQ02kAfpkKu/Ti:JuVUpob/8OvHs3tbP0pvxkep5ZN
TLSH
T159B46B213EF5C179D2429171CA69ABF690F59BA80F3208C327D4CE2C1B75995D33BE29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

401744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CharPrevExA CharPrevA CharLowerW CharLowerA CharUpperW CharNextA CharUpperA

oleaut32

VariantCopy VariantClear SysFreeString SysAllocString

kernel32

CompareFileTime GetStringTypeW GetStringTypeA LCMapStringW SetConsoleCtrlHandler FileTimeToLocalFileTime GetCommandLineW SetFileApisToOEM GetVersionExA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection MultiByteToWideChar WideCharToMultiByte GetLastError FreeLibrary LoadLibraryA AreFileApisANSI GetModuleFileNameA LocalFree FormatMessageA FormatMessageW GetWindowsDirectoryA GetWindowsDirectoryW CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW lstrlenA GetFullPathNameA GetFullPathNameW GetCurrentDirectoryA SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW SearchPathA SearchPathW GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetCurrentProcess GetProcAddress FileTimeToSystemTime GetSystemInfo GlobalMemoryStatus GetModuleHandleA DosDateTimeToFileTime FileTimeToDosDateTime SystemTimeToFileTime GetSystemTime GetStdHandle WaitForMultipleObjects OpenEventA UnmapViewOfFile MapViewOfFile OpenFileMappingA LocalFileTimeToFileTime GetTickCount GetProcessTimes QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId VirtualAlloc VirtualFree WaitForSingleObject CreateEventA SetEvent ResetEvent CreateSemaphoreA ReleaseSemaphore InitializeCriticalSection RaiseException RtlUnwind HeapAlloc HeapFree CreateThread TlsSetValue TlsGetValue ExitThread GetCommandLineA GetVersion ExitProcess SetUnhandledExceptionFilter TlsAlloc TerminateProcess HeapReAlloc HeapSize GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr SetHandleCount GetFileType GetStartupInfoA FlushFileBuffers UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsBadReadPtr IsBadCodePtr SetStdHandle InterlockedDecrement InterlockedIncrement GetCPInfo GetACP GetOEMCP LCMapStringA

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.e1c1647e2a46cfd9190abde0e66f29f3

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

7za.exe

user32

oleaut32

kernel32

generic