jaffacakes118_Trojan[.]Win32[.]Agentb[.]jlxr[.]6e254a3f3e7577af82f77f7b1fe0d7da

resource
jaffacakes118_Trojan.Win32.Agentb.jlxr.6e254a3f3e7577af82f77f7b1fe0d7da
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/Microsoft.People.Controls.winmd
unpack001/$TEMP/todos.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jaffacakes118_Trojan.Win32.Agentb.jlxr.6e254a3f3e7577af82f77f7b1fe0d7da

IMPHASH 93acf6b7ee07bd39e60132c2edfcea87
SHA256 569fe7d6e951ee7701c3a32d3e35884a27698ee5762c24decdbbd60e0beeb44c
MD5 6e254a3f3e7577af82f77f7b1fe0d7da
SHA1 21735f27db87e415367eec63eefc154f178aae4f
SHA512 e6277b3b79bd5c13f150006cb8ae3d980984defb2c100dc1cd02ec06b7d59e370e5423ed6d593b223e47dfbf2c2b86032923b3dc82d64825e998fd59599a78e0
SSDEEP 6144:rNPxmmbvO4CBri9tC5FmEQZdX9gX5bwtIGngYhVai:hPImb8mtKFiZR9G5MGGngji
TLSH
T1BE44122737A6D876D81A72B0093347B39BF1A52213FC13A79760EF1B7CA32568D0E095
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13636

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess SetCurrentDirectoryA GetFileAttributesA SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode CopyFileA GetLastError GlobalUnlock GlobalLock CreateThread CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle lstrcmpiA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime lstrcmpA ExpandEnvironmentStringsA GetDiskFreeSpaceA lstrcpynA GlobalFree DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MultiByteToWideChar FreeLibrary MulDiv LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

GetSystemMenu SetClassLongA IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard ScreenToClient GetWindowRect GetDlgItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA LoadImageA ExitWindowsEx DestroyWindow CreateDialogParamA SetWindowTextA PostQuitMessage SetWindowLongA ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow TrackPopupMenu OpenClipboard AppendMenuA DrawTextA EndPaint CharNextA SetForegroundWindow SetTimer

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
TLSH
T162324A1503904AF3F996C13C14263ABF7F792A218BF14E939FA39481BE2D5D96D39312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/1113_20x20x32.png

SHA256 d5e017f20afd36b904da966b53c1065466e669c126081bdf51f687c0f052c1e8
MD5 9ac6d6fbbefaee0733707c9e1326914f
SHA1 3cd0e21b6eb1a0609ae51555e1457badb7361166
SHA512 b0b77fa3f788c468fbd8002c8d24414e76c3de564d0d290b1e58f02caed126371fda883cb05fd464ed58e2a728e1ed36757618f752c89b1cd8ddd28e75cb5bc1
TLSH
T172C0C0C1927D045CC78940A683E28810F93B13FF3223130C6D74D0251018DC815DD2D3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$TEMP/1x1transparent.png

SHA256 5ed6547d1f2291d301f8e99f4b6f209d8820321c42dd194cb12af96ccb892cd7
MD5 a3fa23f8066053cd1926fa30e0757ed6
SHA1 619e00db7e2f720ed7dfaae1c4287340a92f4380
SHA512 b00ede1e83d96cab1cd6341f27442833ef96eef28a20cb4628e309c4af93b0489ae2d1eca91ef946ddc3e5b0f5ea6af5500fd56dd54d6ab00702d70ddecf9491
SSDEEP 96:ASsm2jkTOwqicgBUFhU2JkUR6DyNvw5Hh4lgqWbkEWmsWcBV0BxNXrNMfNsc57+R:AS7vBGqvDyNvQ0gbk695CUR
TLSH
T190821830BEF032A1C94995312EC066010CB78AC3D9C49C86FBDE4A166F02B8C8D9F282
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$TEMP/BuiltinJotSpy.xml

SHA256 fa4bffea89d7c2ed3a057bc7d3f079f1fbdfdc60aba39334c26a11ae0cfc6214
MD5 99b283b631df0705427c1848d9b17ee4
SHA1 f27dd75357701533cd6bd9e4b79111cca635bf96
SHA512 8bffcb7a6f2ea5471866c1682880be55e9dbbe52bfe25a5f51e9b0f62f5ce35847fcc2794d19ebd522e0f4c1d0ae9c921c3ce340ce37503eb2a318d55c422c5e
SSDEEP 96:unJ0m6nAMyyox+CqAa96cz7Tb8czLTfgEkjCXM:unJh6TCPg96g7Tb8gLTfgEKx
TLSH
T13391EC1A742CB9318202100367BB98C4EE2FDE7B5031CA69F17D90739B632E5D5E7B66
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$TEMP/GetStartedAppList.targetsize-48_altform-unplated.png

SHA256 d7ef91d521c5ffddf5c72e410974ec84bde35e50616eb757671f557ef825735a
MD5 e10b1b357f9f2b461d6db374c2ad6e1d
SHA1 362cd21ba7a70d341ee10df852b50d667174cf35
SHA512 3a971aa6dde4da132e0d5daa1af1686be9ee5985c8ff5a38da97d3b530971fa586a904b6f522356fe9f3f87ee328cff9f2ebb78363ab60ff8f7b59ecfa3a0c3a
TLSH
T178F0759E6E598C04C23D233A0F625034591B3195A60D020937B35D744B3182CC66A98D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$TEMP/Microsoft.People.Controls.winmd

SHA256 f1a2661b9f052543f3ac7f37db00b20e4390f0bc98c0a8ecbb4b8c50ad0eefcb
MD5 b55c25828c7fecbcd4f377bddcaab9c5
SHA1 6b6c9d57f6581c83178594c3e2886125e5ce10dc
SHA512 3c792a4e4c9682c2ddce4a928b44792feeadfc39b858622b804c6d2f76073dac053d8d839cb780e4cb8d4afd343da3eb3f081388eb1380c364fb2027252a2a56
SSDEEP 192:OSSpC3sNX1WbnPEOEW6z46I60brrLlKPpHTJUx0n0orwCX1XTpKYLcTFop60N6eH:OVCcNX1WgOE5zfP0brrLlKPpHTJUx0n0
TLSH
T1FE020E8376E6C767C4BB17369CCB5F81E730A36947875B1B42E4783AECDA7CA0902095
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Miscarriage

SHA256 ae9582eadf56374f56e02528497504c18d2564d3079adea64ce2675aea1b2bdc
MD5 3ee0bef76df7355f794cda5dd82a211a
SHA1 4d61d1e36a5dac1362b382997945c0d50040416b
SHA512 45ef566fe6cb8352d9e0f8e59f8b48b6d82e3fbd92d21183ed4caf59f2bf3cb21eb61a3afc4271281f59071331d621af2b22a89a1d6fecf3ccf4e64464e1ba9e
SSDEEP 3072:/6nMfirP0j7VVWnYK37OD/PMYJIDAshJJSfZGfFekA1im2MCtIIsSoK7MWNFM6H+:ljnWbO4YJInBSMtru2MbXKAmF1MP
TLSH
T1B91402571C222A91405B4D42B2961A6B21FCB3EBBCB6E10A09C59F03F3735257FEBB15
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$TEMP/PhotosAppList.targetsize-80_altform-unplated_contrast-white.png

SHA256 0b1e634ea943d79de894162debed898088708f5c30e11aae0f47dc46202ba076
MD5 71c861fb238f617e613edfe49b06694c
SHA1 cca88c0a9523ed13ce936be8632a45cb9c99f73b
SHA512 0d4ae6b223ffd99e88c20d07a78a8dbb42f02851587213b279e8238de07e6255a2b7dd68f238284b35603a5fb5df47fed6568b541c9976303a4b27b22c62f4c3
TLSH
T15AE02BA30EB7B9A8C19F0572402404E8FE352A3122D0261CA926E8F18801AD144ED2CD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$TEMP/RemixThreeDWebViewControl.xbf

SHA256 87794478564ecbcc605ceb59e1b2b1359fdb1fddee2dc5374714f05f4d55454b
MD5 72e4ad090c760f5786582c325910b69e
SHA1 da0ae7dce603d9e42f7446392967437455854842
SHA512 d199ad3f4f66eff5a2c30645f5c86833baea36afd36f07032d7c480b05162115c96bf9b10d7d519b5be54dddfc29d3e3a364d5c17c5ba7517e760fc00696b692
TLSH
T167216A51EFFE1305F2F38EBD69F6051658BABD259D05D3AE40B0020D0962E9189E4F37
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$TEMP/starttile.dualsim1.smile.scale-150.png

SHA256 43df15a6dd77ed21d1ed4dae2ffd5de8e44d461d386d518f871878792ba12ebb
MD5 ad5a42719b394bcd938ea797f846c3d4
SHA1 021b6a385cf3a80153826758b78b6f72d80dd231
SHA512 6695afec1389e55beaf998a91a0ec4e065572a15be37e126b140c1282f713474dbf4686172b870034f7e1967ec697cfe6d3624dbcf7eff7aef7f40049a5f4b70
TLSH
T12221D73B61A8F45FF127107B30873A20EDF72417631A2CA9C17934C93E48B801288EC0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$TEMP/todos.dll

IMPHASH a7f80c1ed4c9e95f038f1b67458adde2
SHA256 a1aad689d65c92d994cfda19f8344818e772a51f342388226147d8fb4aec39f1
MD5 34a5933218df974825080aa79f70c81c
SHA1 375f5de4b028648a149ffdc3130e6582f6a4970f
SHA512 e138bebcea14944c4210ceeba34af66136f3191acd1c382328c50959079e985f28eec96161170d31cda0275688936c678e1160c648322da5225b7d53f9d438fc
SSDEEP 1536:z5uppHPXaCHDCT2X5o2iR+50HWdgcwHj+ArXmm3ygN:/SOblHWb6j+Ar/3p
TLSH
T196439EA079C045F7D9DD113902AA27162AAEEC5407F48343DEA71ACE5BA36F0BD32746
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

19267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jaffacakes118_Trojan.Win32.Agentb.jlxr.6e254a3f3e7577af82f77f7b1fe0d7da

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/1113_20x20x32.png

$TEMP/1x1transparent.png

$TEMP/BuiltinJotSpy.xml

$TEMP/GetStartedAppList.targetsize-48_altform-unplated.png

$TEMP/Microsoft.People.Controls.winmd

generic

$TEMP/Miscarriage

$TEMP/PhotosAppList.targetsize-80_altform-unplated_contrast-white.png

$TEMP/RemixThreeDWebViewControl.xbf

$TEMP/starttile.dualsim1.smile.scale-150.png

$TEMP/todos.dll

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Agentb.jlxr.6e254a3f3e7577af82f77f7b1fe0d7da

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/1113_20x20x32.png

$TEMP/1x1transparent.png

$TEMP/BuiltinJotSpy.xml

$TEMP/GetStartedAppList.targetsize-48_altform-unplated.png

$TEMP/Microsoft.People.Controls.winmd

generic

$TEMP/Miscarriage

$TEMP/PhotosAppList.targetsize-80_altform-unplated_contrast-white.png

$TEMP/RemixThreeDWebViewControl.xbf

$TEMP/starttile.dualsim1.smile.scale-150.png

$TEMP/todos.dll

kernel32

generic