jaffacakes118_Trojan[.]Win32[.]Agent[.]nezlpo[.]96ad0a531428fb7270e2cf30862bdd8f

resource
jaffacakes118_Trojan.Win32.Agent.nezlpo.96ad0a531428fb7270e2cf30862bdd8f
unpack001/$PLUGINSDIR/AnimGif.dll
unpack001/$PLUGINSDIR/CIEH.dll
unpack001/$PLUGINSDIR/DCP.dll
unpack001/$PLUGINSDIR/EnumINI.dll
unpack001/$PLUGINSDIR/RealProgress.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsWebN.dll
unpack001/uninstall.exe

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_1

jaffacakes118_Trojan.Win32.Agent.nezlpo.96ad0a531428fb7270e2cf30862bdd8f

IMPHASH 9c523d8653da5455667e3f82274f2f88
SHA256 a5c736583da302ece7dce2a808ea5108a942d98200b8edb7f2ce46e57c74ac7f
MD5 96ad0a531428fb7270e2cf30862bdd8f
SHA1 3622b865ee7059eb45c5b3c9c99a6e34bca98d49
SHA512 31f4b84b745b05b95e175ce38a1150ffcb1c6cd09dd94e314d122e47215a8d4d08abc796b3fb898c8b36aa3a2d98a119a120fcecc52a524cd6450da513ef3b22
SSDEEP 3072:YbLpZuEskJIMq6Txeus/f4XjlF0InM1MrtGlzqEMTxg324z949feXZYSZ:YbOvMbjlFJn4MrtGlmD+9SGYC
TLSH
T135E3F21E76C1A963EFA341358C77E32AE677AE90051622D797E07F9738B859188021CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount lstrcmpiA CopyFileA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCurrentProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AnimGif.dll

IMPHASH b4b71331b921e2f441a2b05306cd7dae
SHA256 54ccdcb42fb3e63b7a55e8c0e7d12182a0338ea38b106b793ca048000a189ab5
MD5 11e94fedb34f46458f9dc773a91f2770
SHA1 791cf30880c74df9d6f7c1e637e4fdf5fa88b38a
SHA512 57dd38bebdd7d8fbc4b3daeecabc5c2617d4f5b2f6ad2396a702f1da362bc72deacfea2dd1550b0e00269188676324e1b7dd6ed372211c8bf664af824ac8d950
SSDEEP 96:kVh/i//UrWWXMAb+6aNqRjTwUWo5zFyRH0aTyZekTIVCAEHZNKNy0p:uh/Bl8AIQR/bWSMRH00yQBEH
TLSH
T1C2121907CA0051F7F12EA0F925DEBB3F9259E1B60286BC57C757ED42AE111615F3A207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CIEH.dll

IMPHASH 04ba650cbccf1b453680c05ee1865bca
SHA256 8ce1c14c24711eef4753f3dc54703fdde3950557a542d3a062d35667b8094692
MD5 48a08d0adbe110811801bbd220ad5802
SHA1 b6825225a1ec6a6e3ebaf78a4a5974bad67015cd
SHA512 1cc88cfd772383b73dcf1ab91f01366874ef5b072d7ab7f4c2c49f31db7fa2a5d1b21c1643015cf52111fc9c3800b0eb87d4a6b64c5b380a4a5318af607e4679
TLSH
T1A151D837D3EA08F7E40C43B50B93A86172B6CAB443E6C0111EC60A793941D9CB865F86
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4194

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DCP.dll

IMPHASH 007e81f335a7b1165e2e42f14a838b08
SHA256 1f30b3485f7d39f5197e1969b3aba61d5d12bd6000b0bc9436685633bfd85299
MD5 aeeaf32116912d7c75130f1eb94361df
SHA1 d5050ab2b297ca7b983618732840b523e5069170
SHA512 38dac79b8277eba224ed4f86cd8ca348410e12cb1fbfd04e1c8dac0aaf3db3fd3dc0f69c36342240ef0ea0761685fabc787acdc498ea6da61c8068197c2aea24
TLSH
T1C451DCB7DBD596E3E54C23FA02CB0898B3AF502457B7851E09B6040CA411556CCB3F12
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/EULA.bmp

SHA256 bdbd4282c4fe045c94b8df5f8d57f62c2d25871b205ce89829382e5144bd987b
MD5 5d08f70bf369db1a74393fe69da42a2b
SHA1 51b4df1798eca02de4dcd6734c43c9ffa036aea6
SHA512 51d7b77c1e637f1b621555bf9b55c670c435a0022adf1711cd3bb2f5b99088f81707725b31a1c4a2a0f10fc6be904c8cebf8a2fb6f15c786683cffb7f53e44e9
SSDEEP 384:SS6gvIAKlh8ZZ8HxzYLFIcsIgvfQrZvUz49kPrrf:72h8ZKqLGVAssyP/
TLSH
T126D2F8C130A6C16BFB8A1BD330ED721274CE302608D44B9DBF178FA09777A61275E656
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/EnumINI.dll

IMPHASH f20d0c024c6171e363b99c74cfdb1557
SHA256 6889074663561e735e22cc0b687f956f4f98d51529c7f3db610747bebe74e060
MD5 29dea66f7c3de1b4d84bb26da3616ca1
SHA1 55e0bac541822d3a3a1f03b04b5dd1bb8149aa2c
SHA512 d0063e52165c819801a96467cc26caad6d9effe32128c3d24ca575c600cf866edd88bf915a8aca27f517bd383de12c3c5f6afee66329c4faace37235cc1df74f
TLSH
T1245165B39FE144F1E04F4772914B2C7329F6DA1027664B0E88374E84894328F9DBE759
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/RealProgress.dll

IMPHASH 7bc4765c97bfd307d3b6564dec82f68c
SHA256 e36cb3caabb806b27475080682837a7d379fbe903358aa189bd0e51511ef27f2
MD5 34eb3de90b30d2c4d18ee625ac95369e
SHA1 504dfd3a2e735e94991fa649d4e2defd511a744c
SHA512 640282d943305f7fd4b512b1b8ffd49b4456b3e5987b11e26a208333d051332a93e261fc764add17b2cb7e7127c00d1905b42233354098afac8b1198e0db9a38
SSDEEP 96:KSWAk1J5Qrcic6XMqKL6dwNYVZdVJUygr3A34tYVPK:P0j5bRGMqPdwKVXbUn3s4uk
TLSH
T148C1747EA7D0A6F3D7114B7A118662572357A03043A8441FAA371DCABEA1347CC5E2B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 49b748d037f7faac0be4f9db080d7bc9a997dec23187c5735826e15be2f32dab
MD5 ebff9b02b61df14b06df4fa0b121d0ea
SHA1 a3cb0aacaf26c1812cb8a4aacca6165e7b69aaee
SHA512 eae47042c70ccdf52e9aadcf57f73c03e06e9591db038c84ffe5c8f29229decedc21b27c55e088f9b6a9198a4552da3f2762e90bc2e543e1534bd7630b129427
SSDEEP 192:KOShJI/rmOAIPkWpUybQ9WhP4t5Rwc89XbubZar5:L6OAOkWWycGP4XRwc2qFar5
TLSH
T186225C5502A042F3DC54923C08973D676F787A249EB48EC3CF931441AF299AABC7D326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10381

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/failed.html

SHA256 929f4c09a39b7d1005af55abcb20c9358b69832bcf89c479fd17acd4ce8b5acc
MD5 31190033526afff1aee4816ec0c75520
SHA1 2ca237ec707e7f47d962dba5e384ccff3587ed4f
SHA512 df4ed70853d532cc08c6edc5278658e5a6a84daf1d9d6213109e343ee4f56f2f18c8605da43627dc1681eca898af2aea61e0f73cb0fdfa488bbe7a548d73a382
TLSH
T1A00152227E220E3C8E2782BBF882536CC5244706836584B4A46A1673F5C843ED4EABCC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH b1d5d0b3fda403ed2c73f12bdb356fe7
SHA256 29c3bf7b2946d427824fd01db41c10fe6b5011a184ed0ed3a3e5fb4ba50a5ae3
MD5 312edb3560ebac849ee8cd8396bbc6a5
SHA1 a6159a98775ad286b27a34fc588bc2a019827f39
SHA512 877c79f10988d9cebb5fb2591a7a6b5bd925a557687d1c96c9e40b31d365f0556d590953972259d5def231bb452fd0839f28fd2c124145425b5fb5acc48f7488
SSDEEP 384:TkV3EkbAHbUH1W52u4ZuVlGygT0yl1ViY0Ac9khYLMkIX0+GMhg8ae:TrHQ1I2u408ygTjl1Viw
TLSH
T1B2821A421F714EB3C3A64534B4A927170B7A9F7164A2A09367F31E8C2C99207FF79B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free _open _lseek _close memset strstr strtol strtoul _read _write time strrchr

kernel32

MulDiv CreateThread WaitForSingleObject TerminateThread CloseHandle GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA lstrcatA SleepEx DeleteFileA GlobalFree GetLastError lstrcmpA lstrcpynA lstrlenA

user32

IsWindow SendMessageA GetDlgItem SetDlgItemTextA wsprintfA GetWindowTextA GetParent ShowWindow PostMessageA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA EnableWindow CreateDialogParamA FindWindowExA SetWindowTextA MessageBoxA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA InternetCloseHandle InternetErrorDlg InternetSetFilePointer InternetQueryOptionA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/loading.gif

SHA256 3e199f3aeacc7f422049b1e72bee03592ece0977919d85219ec3699a8464d197
MD5 aa410639cd9c202a795c220fbd594997
SHA1 660f2aeca71a82a242967c01b5d2da500861bc3d
SHA512 4b63ba181efcefad2136323eab53c42abe32680e1b73e9b03f857e7b9e7b230b9692b36edeeba470d9a186a0d5394e741e4ffb9fdf774e454bd5c031f6faf4f9
TLSH
T1F0218B490BC0E0B2F43F16388541AC8C649C78ABAAEE0957A179CC41F4375DD6620A37
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/nsWebN.dll

IMPHASH dd4a272c32d9dcfcaf1d67082bc7edc3
SHA256 33faeecd2c66a9935636acb1a6fe60d931276953d9220c8ed442beb452c3db39
MD5 76587d0bb39396ec23bd6e216236656b
SHA1 e594fa281cd779846b75488447ad32469911b256
SHA512 1085480a639079acf9b465fbbb3a39935167ff93c59d7257ccebbb88de0d5b3e88e2341b1beedf62a1f35d24ec50f2acf9981eb5f77598f3a35ba9f5cc4eace4
SSDEEP 768:2lnPepVOUoYCzM6bLVeIyCtUQ4Bb/lc/qVsYV:2RUoYgM6teOUQ6b/lhyYV
TLSH
T1F8B2181276A044F1D28A193831A76F46677F956423F160C3DF5B28AEFA533E1B935383
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapAlloc GetProcessHeap FreeLibrary GetProcAddress LoadLibraryA GetACP GetModuleFileNameA GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter InterlockedExchange HeapFree GetCurrentProcess TerminateProcess GetModuleHandleA ExitProcess GetStringTypeW GetStringTypeA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect GetCPInfo GetLocaleInfoA LCMapStringW WideCharToMultiByte LCMapStringA GetLastError InterlockedDecrement InterlockedIncrement GlobalAlloc lstrcpyA GlobalFree RtlUnwind MultiByteToWideChar GetOEMCP

user32

CallWindowProcA PostMessageA wsprintfA GetWindowLongA SetWindowLongA GetClientRect DestroyWindow DispatchMessageA TranslateMessage GetParent GetDlgItem CreateDialogParamA MoveWindow SendMessageA GetWindowRect ScreenToClient MapWindowPoints MessageBoxA ShowWindow SetFocus UpdateWindow IsDialogMessageA GetMessageA

advapi32

RegCreateKeyExA RegEnumValueA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegDeleteKeyA

ole32

CoTaskMemAlloc OleCreate OleUninitialize OleInitialize OleSetContainedObject

oleaut32

SysAllocString VariantClear SafeArrayCreate SafeArrayAccessData SysAllocStringLen SysFreeString VariantInit SafeArrayDestroy

urlmon

CreateURLMoniker

wininet

InternetAttemptConnect

BadDudes.gif

SHA256 fbf102e20fa7e3bcd4494d3bc48bfbf55568211fd0bf27d8390eb9aa31c6a183
MD5 70e1d06e5a82fb4cd7e5cd29dc764b08
SHA1 0cd2ac9e8e8620dde3e79a81de00e2e91c305ac5
SHA512 d05ad62a1c30a88f437fb23b3b218a587132bb299160bc16069dfd2744a187e1047ad7221156bf598af21f21f05acaa0504ed35928709a6b7bd28e2e083617de
TLSH
T1C6413C99E83E7225D930EE3ECCE315C96A975FC2A2055CAACF2111CEFC78B942D05B04
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Bomberman.gif

SHA256 9ed68451cc407d1f48d0deec028a0c610867c23f717a4074252431e5a8362348
MD5 5ce51c09fdd85adf04784a14b220201f
SHA1 014375d8a689b3557f4f3f3e1b532c5addd1ded4
SHA512 7173c206c930e1d2bd363becd8d4bb4782051d14416334a7eaf6cc1b0c03a776f834bc14542b554f612640d41186418a3c427662de191873f5bb1c4aa4f76c21
TLSH
T13F21EA577564B25DDE6540B1996D5380099CBDECFD63558F081CEC9272F6A1348D2CC8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Contra.gif

SHA256 8adc93851fd362a2751f6660b005e9378a31dfa14eeb815a3b5b0603c446ef6a
MD5 34252a00759a2cd7516ce938e26132fc
SHA1 74af18098f93c4eb88f0a7086c0d5cdef50a1b1a
SHA512 7096362e84bbf2125317d7a3f7669731bc3fdcb7b211cef364058d5fa623a1b3371893c6dc978720612f1005988ab860e7ce912546d3b60114e40d16544f4c1c
TLSH
T1335119EDC2ED128DD00FD4B33F84E575322C2D936E52942D3597FA0534B4AA1556B524
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

ContraForce.gif

SHA256 a606380c532d278625f24a710a330601e24452a6384b6984b64718828a1d3182
MD5 2b54dd0bee54edb494db480c7f519f69
SHA1 907dae1fcb21f81c77ee52e48b17ebda79eedc3d
SHA512 ab023d94f6c765e74e1c581b9642b35286d523eacaa2f85c2910a48a2bc20fbe0286ae9b1d036c68d3cae479395db829d81bde673ec368ea4c1761181ce1ab53
TLSH
T1C621E664EF8DCA2FD32084B9243BD1206F863C8C11D513A8A7386A74802C0A087EB84F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Contra_2.gif

SHA256 abf6f2407ad5004c9aff66ab8b2314dd0c237067954294e713ebf2aef2cb44ce
MD5 32cb27f70736796f624e032343783ee1
SHA1 345730887886802a7e9a37dd2fd0b8b145866a4b
SHA512 ff35feeaf4bdffb3101a0b4232c41c828ec597717c8c9a0a40b7db12b2582de0d79a5bd6e8b9bb650511640e23158126f237269e1c7298f67b3d894e04527160
TLSH
T1CE313A330105E989C228BC3076272BBA1248EF39F931BB03D044FD922CC1A293B01D5E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

DoubleDragon.gif

SHA256 f57cb4c6df363e90e94392f9b8db437bceffef43761710f2a8146ff8072d06ee
MD5 539243fdd0244e4ef436b7436ba031ea
SHA1 8164e9642cb62774852a57391b8c2ec423eba6d2
SHA512 26b10a376f2ba4ed01a528a1f37302d33ac11722c6f80c1bfa7900d581839a5e8a10c95d0fa8b2ab4b66680099dd965baf4b786d7ea97f9a4385897bb84a713a
TLSH
T1F2310B36794F897BF294A479C7CEDC751AB79B084EC5281F0AF7853E531180EE4C0155
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

DoubleDragon3.gif

SHA256 67cdb59fc8b0d5551700d75cee5a9320337b60527948cde1683681cb6a6b2db0
MD5 e04a6de3bd7bd57014324f34766e5041
SHA1 8e8c935294dcb51c37dff0a4b3f931aa335c7969
SHA512 0d7e78a0e4ddd00a123375eaeb013a4e623b17ffa261fa88dcd909a754cbcb972cd07ca992ffdc3a1586540d3d257cc2233d6c9562610c06d67d55e2686f59e6
TLSH
T17231BA12E5576C35E733E5B2FD62A9680210B237CC6E8F8268EB63A44AC014D8016217
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

DuckHunt.gif

SHA256 879cd13be533329e4af8dfcda7123a86c7e47c0887dc50f9b2bfdcac68fddbee
MD5 e4febabc60e345e629d36354fefba39b
SHA1 0fd4b0e7026eb83f20ddf7648441a818036ac59f
SHA512 1a662a560618a7cd26759ac236d1a49296f25120d32a4572905d1017dc1f0170eff50f51d1a67373328af68e8824bef0043834d2d3701d294370b2799ce7d8a6
TLSH
T132E0C02C868EFC76E2022E32A49FA2859EC5F52659104D7D32236ECF4E055721C985E4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

DuckHunt_2.gif

SHA256 9a5abdbdddca857a863f55c9ec8af9a6bd355c285ae731245e26ecda1633a041
MD5 20189375e1fe7b591a0b41fba8050a7f
SHA1 62398ab98cb48b0f741a825b706373a2c9ed9241
SHA512 9ce434a8ba5a86cf6a1a7760ccd2d63e81150f1248c779d3507a12b4f577f1d34d0334c51b4b3c37b2ca875a659f411b5a68d4363e1eecc66ac9ae4b0426884e
TLSH
T1FA21EA14352CE557D110DB3E917F58164AC7038452EB07C252CBC1B4121B6ADA5695FB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Jackal.gif

SHA256 5e69b0e92ddb649da82dbb1db6fa64fa2792bff9797e245a7cec6fed81b9b69a
MD5 f47d8b64923d79c5ef02eca4d25b1e2f
SHA1 266c838e9011bd2af74b4b2497f241c07456452a
SHA512 56c6f73b94e49fe4dd407d4cb97c64e1c5d2b2a764a9b41f78ef3645bd913a70f27100c104e817ca6dde806c0ceb6630ec726b00fd85bd6cd947b9705f53b0e2
TLSH
T1D731EA8DC4E5B9D61972067F218034421CA452ACECB0C5E3C8448F23EE81D1A128C97D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Kirby's-Adventure.gif

SHA256 4fdb0322fb3c6c4d9a74dcbdabb31ec11381ec19509f4f66a9070e40bfbffb19
MD5 59da2c32239b82a4f3662116aa07a24c
SHA1 139e9691eed0d4653e1d69dcffd1ae091f441533
SHA512 42b4591fbc9c626b63c5269797268e57212d452a9c2e89e1bbcce039d8c7c744e8b722a550e464a7bc5161fa89640ce0fdb66f6e5909ec9da1e35f7a5e1b05a3
TLSH
T1ED414C62B47BFC61FED39C45D004E06AF90D90C9612317B702B64BCCB276BE60811D75
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

KungFu.gif

SHA256 1cf9abc86fa0ca8277a3fd20728028cb50e5f405d2d84af82bcd410c901e40c7
MD5 1a34406b1c7189b91acab91c319b00f6
SHA1 497564a5a6ea9ab64bb63fab2a6f45c4c42b64e3
SHA512 93d4fa292cc74b68f2a5df28df43ed6095dcdbc6141cbf1d5dcd6da79ee8c5d2b446bbed8b53df667f3a46a01bd1af80be63852ba9374f771a38ed5f4f3eb842
TLSH
T1FF016525C127C033989F9935549AB66C1405B29426A80F6E7059F08EE65893605709DE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

KungFu_2.gif

SHA256 a4f09843ec6d74a5d86855dff917e56e4f9bc9bf7884c4d812d60d8341421b09
MD5 5fc3d316d82e43e69a0556f2a0198e76
SHA1 5e84ce4538ed99a9023c60da84142f6120953350
SHA512 b3ff101aaaacfda1d203d322b6edd10a9feebb8fa7b31c9f0e2a1c2e97e284f0fcca813cae868d3b1682527f6fa06e4b6e7f78ea7e0725282d9f13909346a75c
TLSH
T1ED31D616957F3AB5CC623AB4BA888FFA64D83B00B52B20023DD374CD049BA8238018A0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

MikeTyson.gif

SHA256 7594ebb3f7e850d208893352423902ea7fb75c249ce18d3136d1e53f3495b2bb
MD5 3ad94ea29b33015fc6b2fcb98c9c91a8
SHA1 c31f9cccd432caf06740efb1bc74b889be5dd884
SHA512 c0fb91dd2e0f24210c4cf62da83193fddc679bf109d6ec0fd256be90d40ee25d45f2fee3956f5f7f5510cd7e0f9df44e6d26d080ea16344b195cb4f72b178f1b
TLSH
T1F6018691F09EFDD4C5A60E705D75F4834404C2EB5021A8169BD80812D059F2F94364FA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

POW.gif

SHA256 7b0f030a0c84a75aa5246ec3bfb30da518814f13b8c1847069d82009adf4ad78
MD5 a6ead33c217f78c54de4618445127469
SHA1 b89fab1b5ce207eafaf3cf7082f05e1072faecc4
SHA512 88d60b0aeb7640707e8a050b8ec547f7f08e48fc7e6945a9c79353edacea5a0b8a3163d27b20ab483f6da41fd26b8daf602505d2fc0c98fd82279e36db9cc46c
TLSH
T1BB31E95F609DD1B6D0A65031BD8300C8662B2F6849DD05214D7679F1A427F5809FC55A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

PunchOut.gif

SHA256 7f1fe767de192945d318dc33634b409ba8dacfcd7332d2c003b47e145824fe99
MD5 eccd9c53fbc988ecf04f1319cafadd58
SHA1 859642c56b28567d5554765d044e456f9e9eaa8a
SHA512 036fd2fb3711fca67e55207a8b373b503aa455cef14c8ae42ead05a627321df369ae27ab40147ac8338c4570f31391095177f345e916b345846382147c3838eb
TLSH
T1B12162A78F98861BCC4136B6380270790831B478B2FED92EFB086E36198213222D6D10
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

RingKing.gif

SHA256 cf27dfc5c235f3e1a876422ab74d33f2a47c1f7cc1aafd36e0d25783b6027e5b
MD5 199358602a88305574d200be68c25eef
SHA1 6863124bedf9e87b1276572ee8e0fba909d7fcbc
SHA512 ac928492084c5a6f54491dfa1c5908050e9b3c24de205583f4faa2f7f3e81c9b1deff593644a042088ed0f6ec1c80bcc3101ef996ae386ad9c2e5649c39022c0
TLSH
T10B31A5DB8AD12A8DD02034B48BC6FA4BBC88BC0265221C8F7F45B2C7597DDD550A4E73
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperC.gif

SHA256 24e2bf0c5bdd9c22d2aaf1486ce2aa167eb7c0cef1a9ff50a42e7505f3c5db34
MD5 e1c153ca1973a8d6e94896981633ba12
SHA1 e704d92121dc71eb4451e961cbd286cd59ec3354
SHA512 6892ecbd34889e829b6cccb00e4776a3e709f06321e33ae3574a9b75b2b65d82c0fcb1ba60f8ab4f1fcfc4461e8bf4566901cca777b15c04ae45a2be03c96653
TLSH
T19E31B91595419ED4D32E00609EA061835BA70FD559DF15313BC97B1347741D0BF9C556
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario.gif

SHA256 31a0012f788452aee737e927f438d37ca86d72606795d89bc519521313ef2f10
MD5 5ba48e44234b384de58aa1b87afe0bb7
SHA1 18f5688be93eeb4a6c5b775451bd8b06d499e26a
SHA512 a0f47e2dd83a4aa3082fde624715f35fc092940b4f64f8248a6575b93991a74bd5076a2b6021a7911325624648edf338ec17ec2a35bceea9d96c3ccad8018b0e
TLSH
T1073163B055A158C3FAAA8899F58652F49F02DC8C543D9ABBA0C1BB4B913892024538C9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario3.gif

SHA256 c17257d12641631a327d4c6f38d766f934a84bc891278cf02c36e0237a423abf
MD5 eeb1386bf317a4729dbc40ffac61cf7f
SHA1 aad8d7dd5169a98bea53ae42d2186a6aa6a81259
SHA512 2f8daf54c550e1b102c592be3550f99475df1b7724bba87e6dfee477e35d63c06f65245105e98bc62c830f8f5dbc2c23c8d5ef371d69b06bcc19cadf134fbd29
TLSH
T1A7119801F98CF306C1C7EB716151F05668CFBCE446B474296392755A3BB58740A0E5B9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario3_1.gif

SHA256 f5e161630f479e96c4622803225603886b8ee408d310b396df950229db8b5c57
MD5 6b8a48098116d2f86bf44b00742468f6
SHA1 de855304dc36d82645b0775c86da23605998fadf
SHA512 c3fdca8435c718b26f0873a3ae5bab07ff9f1b1f53de519917a097bea9b86f39e13e599da4c255db17d2d2e3813ae4288f34fac94ef887b8a9ca71ebb50cca6f
TLSH
T1C101C5B0D8C44F02D9C6C8B22C1470CEE6480FA8F84CBC19960CF357433A0E525C6800
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario_2.gif

SHA256 c116a12406ff426aae3803571ed2c82ebb5b5b86a5d5ff84d88663f8a521ed6e
MD5 52b10c093d01c7bdb8d78a1d4b73470b
SHA1 33d690c476db0778d6d511fce720a931a55db917
SHA512 0d6e827493ea939d3e52dd74696ad1fe7c1539acd6e2cd1be32b20199c987a6688f77e1aeefb4dd1b6a5f3fdf7e2eb96f1f06becbad8aa99db36f78f0171e117
TLSH
T1B121545C00D291C8A16C303859D5C1121CA75C4893917582B084B89661F8DD8C080FCC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario_3.gif

SHA256 73016b3f10c13086bb5d5eb82d2b1aabae9edd9fc2b080d09dc672d44d91ca23
MD5 ecad537370bd0b1d8c72f205d9f4f16d
SHA1 09496b50fb50bb9d1f86bb01d7cac8b6baec5ec1
SHA512 1cbd9b4195c06cd4b66f4685c0ee3f63ded63a7b35cef6aa305b639272a5a6af69a33672f34c7cd2a7dc3eec3a845089880c79d904d842863adc0e6f1ec3501f
TLSH
T1E2014416CC4AA095E4E17ABDDC97C0A842431F5956C5879D5B22B29C6233C9F60327EF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario_4.gif

SHA256 bd337efe2151c1747d4396108cc0a0353cc70536837603c1b8bf2ff58e354a8e
MD5 8c26c6ed94e56347e43bd4e85bd6e91d
SHA1 14aa615376a82598130981221565cb084eee97c5
SHA512 42f559571fe9fbdf79d2d692e6aea34a124dfe4f2c3fa68bf857a5f49128afeacd47a8fb95d31a9b91cda14e1d950ae52af5928eafbea5af4f21f7063f90a52a
TLSH
T15F0186C37FB05002DDE00E29BCA64C6922D19DC603EC9F4038A9F46266F83BC4E60061
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario_5.gif

SHA256 44ff04371cf5fe2a705e7c38b7a23a5d9cae631950d34d3a9ae3c55113f715df
MD5 94867ea71fb5bd89fa417f0b5cf54893
SHA1 11b9e66469203199f5b50f70347b6deee789ac17
SHA512 023b236a21456468b0a42688fbe8d351c60680c5afca0107d67dc3af36fd14428520584360e9159e47282a77e0e6b8a317241ed21b99d9c7fb4be96d4e9a11a7
TLSH
T1D21186348D5A4388F10317AECEC3E0053A3EFD9CDED19126410BBAB72AB55209D54102
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario_Bowser.gif

SHA256 d9f812662637953c87d01593a34a91936b47e0255e3a84959d3de75effef0b04
MD5 58c66b67a328f4819148c617b4935a1a
SHA1 0f28524614dea84ab8806d612e76c0518988ad0c
SHA512 0c2c882899f2f90c2a01b102fc46e8302aa763e82ab810f7a9d9b10115ab1b27719099d0466719fa9c05f579feec3bb4b656b75e4034ed9d68d6382d561e2702
TLSH
T1462154A6A8A802E996792670322274310C226C01987CB86DFDCABA160CBD7D2E424715
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

SuperMario_Enemies.gif

SHA256 86c04e26316a23195bbc4776f719584c9c10889e84edd80123a5ed82286d47f1
MD5 054010527dd709aa041455c9f45fd1d6
SHA1 a3236411c069091b151d15986fed5495afc1c09d
SHA512 1210098ce544c0b34c94ead42d39e413c46637378bebf064b7a4197400559b2313043bd743a91234112b044c5e47b4e345cc71ef6417202df1eb119d39c26891
TLSH
T14331654698428590FC4D92A6830691097D703CD6DF1E56983CEFBF886839DD0926E433
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

TMNT.gif

SHA256 666f221230d84c70abf1df1b2ff8ec1f04b2709d17d3c1325001c3d10bde1505
MD5 f65ad20b9b395b2a1d4c06cbe2bf8de2
SHA1 cc5561e3be42fb0dc29cfd5ce3c2a3e55f65da6a
SHA512 8eca6285bae1ca80366af7eaa532bf494de29caf05fff166c6313092fdb8b1c83bea9fd4dfa9e6e0ea4fc181ea84e8b908be6f5efed5bdb4c8dff371e5f8b7f6
SSDEEP 192:XwWp2H8pXnUt1nmQ3bn8rWlWNn9GvBQt5OpopXtoCu1qE:gW4H6UtDlWNnEviVFtJu1qE
TLSH
T1CFE1AF763E528E16C4309F48B8E3064BB2F93F6437848453C46B0AEF8242CF61995760
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

TMNT3.gif

SHA256 1af68099e421a4eb6cdaa8fcea0cccc5d3b3cd969cb9addc3de1eb18145b534d
MD5 fa19616d35bc394243ccf02b35816ed4
SHA1 2aefac247d1b319ee2422de5edee498e65405a9f
SHA512 7b976824dca125371a668ac06af6d777dd8a2365bbd1a44010bda4f55fbe0be34441c9489872f3a0d84f9f6efe75ef9b85d4b5feba05d526130afa75b5e7c240
TLSH
T1CD2198B6E0ECEFD0F9DA1C3AD93B5215B4417348911376138314442219780C746B9821
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

TMNT_1.gif

SHA256 272b62b8bf1305197a3fd9bd0bc118b8be582d2d2a5a43fd088ce203b3fc1508
MD5 b731dd2fa6efadea61f1ca14aff0910d
SHA1 de02426822e54865698044507a6a9866f777f484
SHA512 45cd420d42aacd30532d7f2d46da5dfe6ad6ba60680fb108e20f02c0a85a957741d6cfed881719c750be363d487ea7b809a39c0d9b8ad86b313f6df445c97375
TLSH
T19341BA4F974C4037C1D918C2EC5664463634BD9C4FEB6C9EB944BB48D2781547154D21
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

TMNT_2.gif

SHA256 efc9134b819b5229a4d52273fa3c122a5c5eb61c5fde05477a9c53d125f91e9e
MD5 c9094c34f36cf012763a125279210259
SHA1 56b39e5d41b82592bf13261d123015848670faae
SHA512 a652e1fce0c1bc398f68091b0beb0a1edac10cdc4ec097fdde672ba998b93c3094ab556616c49bd75503e06f90eb4993e2433b73e85bef16df8f179d73f0c419
TLSH
T1712196CAD962ED598092A6A19469303A9B17DEB7660E4146E1C712059D74076C28FA0A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

TMNT_3.gif

SHA256 590db17527f66430ce68a6be4c910f35bbdfdba1972b132b66eeadfdc71269af
MD5 9c328352f55cd775c4e7ae54208642eb
SHA1 b754d164124e8132d710cb74747c4bf7f2bff183
SHA512 a85610da8b811063c17777177fa3a69b0d961abe3836a2989477b9aecc1fa7ffc379fe8da8dc22e6359a74506d73d4ca42e0e48d7310d096da856f8e0b913c86
TLSH
T1FF411A6F5DF204F481E07CB4D316690195027D21BF0E978C71167E1C9CBBC301122C01
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

TMNT_Logo.gif

SHA256 1d5339973b32b2b02bdcb893eec59c90f659d086311edbbf6bd0eb5a632867d3
MD5 e83dd9166463ab495ad900dd1c9a86c7
SHA1 0aa5313e5aa5106f0ff2fe526b92ad6e8160aa6d
SHA512 0601eab1b07a8756c8d8c190056a34e99c17a1af8b49ab01979102a419183909a3edf528f9bf762ba6f749d68a7ab3b308da2cea161c3dec68d868419eb5e97e
TLSH
T148F0260574D2D01DF16D097971228B53DFDFA16565CC7641C54D861B06F127ECDC53A3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Tank.gif

SHA256 3b97841d1593ae14d6d7f90825f5db821e0a7f9955c70ec051fd9b927ba583ef
MD5 bc654283cb72d994a9fbb56dcd454e17
SHA1 99df483a96c9986c4482097c065665b3f123b1b9
SHA512 4b13491a3752436540b30595c7b863355616563e73dfe224da51abd632324edae38f7ccc3aaee66b78ee5b4810082fcb16a93904a4d7dc58ad7e04e331e12deb
TLSH
T1872195C71E76FC49F247B178086A45E8A4DA42733D520AAD450463B56A29A2D388501E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

nes_contra.gif

SHA256 56b50b5f960e8ae81935a645e20420044eac6f98c7e247f2048be0948dc51825
MD5 b07638e5d2e0196504a6b64eb88f056d
SHA1 159b951710d017863740baf0d42dd99a8184600e
SHA512 33aa10dd8a107a8057a5c170e9e776776170b4f8eea4e6934a4787852403daaa7e907651e3957c52e7edc83242163c9ea98ac41b193afa7fc56ebcd2a7ad3554
TLSH
T1C1512B114052E75DFA45DA30804FD58E6CEE7CD23738AF4070CA58E96B59692D9709E0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

uninstall.exe

IMPHASH 9c523d8653da5455667e3f82274f2f88
SHA256 de020f6856d9b047b868015a69994954c68ec031179107ad216c39935ff2e84f
MD5 ebcf8cdfaa9172e7358fdc65656a999d
SHA1 3278eb5d3158dd1afb670b13f8b753ffb460f185
SHA512 e27aac2f81ed46e2b34ee52b76ce4d6e4667f510d0e5277bc57cd5eb8f012f2dcb8d3cf256ac21b72039879d9e2f59a9c956af60d0afc8272d9690edf36fbfd0
SSDEEP 768:tebbuV4LlKWVJd9dxVh1qAOYwXzBx2JqF86eWkJdFcc35Sx2ELVgq8RiUmMF:YbSqZVJdThUxmskJZJMVGqiiH6
TLSH
T16B236C1632D0D4B7EAB346705D7BE33AE377AE50021156C727F0BFAB787958289052CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount lstrcmpiA CopyFileA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCurrentProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Agent.nezlpo.96ad0a531428fb7270e2cf30862bdd8f

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AnimGif.dll

kernel32

user32

gdi32

msvcrt

generic

$PLUGINSDIR/CIEH.dll

ole32

generic

$PLUGINSDIR/DCP.dll

user32

generic

$PLUGINSDIR/EULA.bmp

$PLUGINSDIR/EnumINI.dll

kernel32

user32

generic

$PLUGINSDIR/RealProgress.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/failed.html

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/loading.gif

$PLUGINSDIR/nsWebN.dll

kernel32

user32

advapi32

ole32

oleaut32

urlmon

wininet

generic

BadDudes.gif

Bomberman.gif

Contra.gif

ContraForce.gif

Contra_2.gif

DoubleDragon.gif

DoubleDragon3.gif

DuckHunt.gif

DuckHunt_2.gif

Jackal.gif

Kirby's-Adventure.gif

KungFu.gif

KungFu_2.gif

MikeTyson.gif

POW.gif

PunchOut.gif

RingKing.gif

SuperC.gif

SuperMario.gif

SuperMario3.gif

SuperMario3_1.gif