jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]NSIS[.]ConvertAd[.]gen[.]134dc607ad6ed7e76f190

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.ConvertAd.gen.134dc607ad6ed7e76f190
Size 59KB
Sample261014-ejxt6afy7k
SHA256 f549203d84a01bef31898cb530278d9508e5f212e0d679bb575efc013e5628ff
MD5 4542ad83cbc134dc607ad6ed7e76f190
SHA1 064b02034f53b5318ca0c9cad278444721f0150a
SHA512 858b7e51eb3762836c80690615d462bfe6f35fef1ecd3af72c857434c60d84e59c7c0915667f8d3e20c7308814fb47685fe1c1c12d810c5e7477c7fcc72fce66
SSDEEP 1536:jQpQ5EP0ijnRTXJtMSfwxmWMwjmCm4uLr8hBOZH/:jQIURTXJtMGww6jh0r7
TLSH
T12453C05A32C584BFD5A35B310A779BBADBF7E305251145436F902FBB2D31283DA262C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.ConvertAd.gen.134dc607ad6ed7e76f190
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.ConvertAd.gen.134dc607ad6ed7e76f190

.exe 59KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/inetc.dll

.dll 20KB

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.ConvertAd.gen.134dc607ad6ed7e76f190

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 f549203d84a01bef31898cb530278d9508e5f212e0d679bb575efc013e5628ff
MD5 4542ad83cbc134dc607ad6ed7e76f190
SHA1 064b02034f53b5318ca0c9cad278444721f0150a
SHA512 858b7e51eb3762836c80690615d462bfe6f35fef1ecd3af72c857434c60d84e59c7c0915667f8d3e20c7308814fb47685fe1c1c12d810c5e7477c7fcc72fce66
SSDEEP 1536:jQpQ5EP0ijnRTXJtMSfwxmWMwjmCm4uLr8hBOZH/:jQIURTXJtMGww6jh0r7
TLSH
T12453C05A32C584BFD5A35B310A779BBADBF7E305251145436F902FBB2D31283DA262C2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
MD5 f02155fa3e59a8fc48a74a236b2bb42e
SHA1 6d76ee8f86fb29f3352c9546250d940f1a476fb8
SHA512 8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399
SSDEEP 384:voJLJVqG5WLJgu/Emx1Ywxd2ZmX66vwUhU7ya4LC0Ac9khYLMkIX0+Gv8gcLom7:AJVkN8mHYwxdWmX3wUhUua4LeT7
TLSH
T1E7921B02AF572AF3D36A4430F42C23574ABEAE751421648766F32FCD186A147FB34722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

14753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.ConvertAd.gen.134dc607ad6ed7e76f190

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic