jaffacakes118_Trojan-Ransom[.]Win32[.]Zerber[.]eymm[.]b5a9c302c3c1a2fd91eb9a97ff898abd

resource
jaffacakes118_Trojan-Ransom.Win32.Zerber.eymm.b5a9c302c3c1a2fd91eb9a97ff898abd
unpack001/$PLUGINSDIR/System.dll
unpack001/underdrains.dll

jaffacakes118_Trojan-Ransom.Win32.Zerber.eymm.b5a9c302c3c1a2fd91eb9a97ff898abd

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 c26505b5b75a888d19999cb170e8ad9334a0f8db6d7465577edb0bc8ebd304f0
MD5 b5a9c302c3c1a2fd91eb9a97ff898abd
SHA1 ff5fd4bdd6152d8b089eb15f798bca8ee20cc68d
SHA512 0a1d626ed91f2321331f8a6b74dc66627bb828c0d0b2809c1d73158e55ec60670a3ed2689e43ee531ec51e51daeed7e953688d485a47607cf430c73b5f860659
SSDEEP 6144:lpkXch98aOfZkeAL/aeulpt2e3YvB2uZSiW8wV6zl:8uufZzALyvlpt2cYvB2bDVal
TLSH
T14D341240F3A1C477D9A3CB711ABB7BB78F66D92199155B0223142F2D3E06B52BC2F251
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

INF_default_option_changed.txt

SHA256 d511e442c286fb2ca031d634a1be3ac99138176e91298b944a5337b07419c551
MD5 9cfb44fb5049088b91045d4da99dee08
SHA1 87d99c71f5c11abdabc379378e3131a5a7a457be
SHA512 26e53eb5e3048e5969484c78a165a366753ad7a81f58dd9e2b1d2d603b7fa5e153cd087adeebf8c528bb118e4dcdef4c3fc1b59c84fc6da89594aee78cc7be8e
TLSH
T112D02E60BC87860900F7C081EB4A012FCB0FA2DEA92E60333A04540C319C43DABAE60E
MD5 SHA1 SHA512 TLSH

Neurobiology.SZPt

SHA256 9cc0abdd1a9a51057a9943a8a3c15e24ef3cb0d16909bd44c072e77ff9d7c33b
MD5 6c86ae20a12e8b0b0acbee58619bfd61
SHA1 a62a2900119132874b7ea10f922938d2cb7dd443
SHA512 5ad13d89c01f5a11eef5cbe2641b219ede0dd3fd9a520534e9cb3e3ee05684e6714c0b871723fbed34257a4b3cdfc9d9d5a90575b8c137d868747796be313fc3
SSDEEP 3072:YN181eFOfZBCeAUBCkWHaABPulpt2qh1JYvBg1V+t74uoObcSzaGU+gcALE/BN5:9aOfZkeAL/aeulpt2e3YvB2uZSiWc
TLSH
T1A50412D4F2A69AB45693D6B303FF7BE249295922DB015210286C1F3D2749F3ABC7F214
MD5 SHA1 SHA512 SSDEEP TLSH

bn.txt

SHA256 216cc780e371dc318c8b15b84de8a5ec0e28f712b3109a991c8a09cddaa2a81a
MD5 d0e788f64268d15b4391f052b1f4b18a
SHA1 2fd8e0a9dd22a729d578536d560354c944c7c93e
SHA512 d50ea673018472c17db44b315f4c343a2924a2eaa95c668d1160aa3830533ca37cc13c2067911a0756f1be8c41df45669abe083759dcb9436f98e90cbb6ac8bf
SSDEEP 192:iM+g4O23sZEstg+lTr++0Mx148IiZaXTXEU10bXYc+4/rexX4:iMyc2stg+lTr++0MQ8DZRDYc+4axI
TLSH
T14362AC5688AE81B1A5F4CDDD0388A370C5536D839B66F388DC17B114385DEFD88AECB9
MD5 SHA1 SHA512 SSDEEP TLSH

fy.txt

SHA256 9fe460264af4abd9ff23eab79387ebb52b4498758645cd5721e75fd7b747e536
MD5 0111890c0137974fce2d79b6d22e5686
SHA1 98ab055fa8bf5f410cad55627424d6512338a4a1
SHA512 86acdb4d62bf9c784bf21999cba5fa3674e70fe5647fdf1dc6a9c5b3cf9c182a18272d9c8400d997bb09e12c908e08a87a951c3d0156a134802e00f70dd1ad90
SSDEEP 192:ikdpohFyPI4mHJR/eVMIBNgjJdMe1bEIVo5XT3EVULQ:ikmvpRGVwj7Me1bEQgDEV9
TLSH
T1C6D1E6940995878B47F3207C6C5836B2EBA8C808DDD9852A39889FBD7156D1E8A1AF4C
MD5 SHA1 SHA512 SSDEEP TLSH

ko.txt

SHA256 5241a5c706960fa183f591434a0d7eebf21f569d2cf12f4fc783d0146800056b
MD5 fb25f8f6087eb8465afab4344fe2563a
SHA1 391c9335e0ac7988ce3722ccd96a1e401aeee335
SHA512 a497a70acbb8c3eabaa6f8c8d3671f3050ff2136e4f7d68d832d13cc3a1bc480bc385bd94565c125eb52285cbb4a935d308d4f9c14d40dbcbfb9b59fae442b27
SSDEEP 192:i36sSE/u96F/JVLsMsdSnBljdM98iQ0iK8Kn9Ws3I3q9FGcUBy6:iVSE/u96hnLsWBljmf9ilK9Ws8AGcqy6
TLSH
T16512B6B2A9D312D43597885A1CFAF495C9C16AD32BE71178BEC04F2DC911887098F9F3
MD5 SHA1 SHA512 SSDEEP TLSH

ku-ckb.txt

SHA256 19af39960142b8599153a09ef4f03f944fc00999beb9fe2399f5f8b236716eef
MD5 c90d029172a8533946ef7419bf383305
SHA1 7b3d96899f5935e559626d215517315c04207627
SHA512 b0a711161ce233e5b9231c21abfd721bca6a85567debc6cc9c033c68d0a6e1292f369dbf1ea52b4088658d13263c245ea37752e87abd8b2aa878b5270ef0b1be
SSDEEP 192:igHCpEmyIRe0g/OQMEuDP9Y799boVTiUaml4hSf7UAlA+cA90s5bKlcRBfwCiIEW:ivjQMTDShMTiUaTSfwA90sglMRMj2z/
TLSH
T1B742AFDB627CEB31A395FB9A97567571CBE73C137059D892AC2149820E0B6012FCC47E
MD5 SHA1 SHA512 SSDEEP TLSH

mk.txt

SHA256 78f5cb9345ab258cf745eaa90d44c7a7a73d3fe06ea182b1298a989135ffa11f
MD5 71d42abe45803ac9c3da5fcacf9cc59c
SHA1 98a1049906972abb480abaf1f5658c1b8c10f27c
SHA512 a0096575d6f911cc2600dac93d6fd7aa8d9e2f9f71a92571a76996fb4c47bdb714bba453c862b3f42cc5f4baaf2aed1dff3c9d6f84a3e2053ff2037c56ab85a5
SSDEEP 192:ia3g0F7SHayJ5vKVEB3Bxg5GteGIxpWNMll39oWvt/i4drxJ4MrZEXSW:iWg0zyJlKVEB3A6SM2mWvt/i4dtJ4MNO
TLSH
T1F40206B66B4B70DB1240DC5FD845BE0A3CAE05FEAFE7035226501EAC37E51B885A534E
MD5 SHA1 SHA512 SSDEEP TLSH

pl.txt

SHA256 371a1b036c5155bb4d0ede67a8111433d56980bc848256b657fb100447359a3b
MD5 12926001214ac303a7878669a7868b26
SHA1 cc51e3d7373de0ddacd9b2ef0cc2dc5e44b0a425
SHA512 2c4d1b3e9dbc54857535dc24cab61ae4a502e4706f8c84bc489a348745e5893d839021ac5510dae7c818acc55714fb5bcc5fa61fc219b5b1537d76d2835cbad1
SSDEEP 192:inl0xONXpVdHc+XmSxGk1s6i+6rELzFI6+0FVEHeeNRChH6ufZfjp8Rb:inSxO9vXmUs5+6QLzdjUHX2rp8Rb
TLSH
T19002186D936AC9C7B575A5DFA4D1EAAAA8CD4104B4C5A047944E004F02A86EB0F3F4DF
MD5 SHA1 SHA512 SSDEEP TLSH

underdrains.dll

IMPHASH 7e9b2b847a02c07a6fabdaf645fd4eba
SHA256 e586459138cc3e0d446fb9dc82eedecc31d12955205dafda75fa70932e3aec57
MD5 bf9d50c36761e349775603819eb874cf
SHA1 c62da19f33e518be5bc20cd650cfc4c73eb76114
SHA512 3ee543f801c1b69096f541cbc1445910afbd7d375e14c1b78d51937378cc9ade7f75643a0eaf3c1e7aee44c8876892339ad1d96a8fd6537a30b72f0eaadf64da
SSDEEP 192:Vfvem/YmbO/oiUAnqt8ilNGe3u5I7WvY9JTLtumyEC:VneEbqYbNR3MRvYPomg
TLSH
T112320A427F4141F1FBFA02B8EC77325A4617ACAC67D6C5119A934B4DBE6211231EC63E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jaffacakes118_Trojan-Ransom.Win32.Zerber.eymm.b5a9c302c3c1a2fd91eb9a97ff898abd

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

INF_default_option_changed.txt

Neurobiology.SZPt

bn.txt

fy.txt

ko.txt

ku-ckb.txt

mk.txt

pl.txt

underdrains.dll

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Zerber.eymm.b5a9c302c3c1a2fd91eb9a97ff898abd

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

INF_default_option_changed.txt

Neurobiology.SZPt

bn.txt

fy.txt

ko.txt

ku-ckb.txt

mk.txt

pl.txt

underdrains.dll

kernel32

generic