jaffacakes118_Trojan-Ransom[.]Win32[.]Zerber[.]ezzq[.]b65a73263102c6d13301d1d889897cea

resource
jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.b65a73263102c6d13301d1d889897cea
unpack001/$PLUGINSDIR/System.dll
unpack001/rivages.dll

jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.b65a73263102c6d13301d1d889897cea

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 6ffc30be8c3d202eaee11f0961d752c9e7762f48f2ed3e2fd22d69f9e9b96ba3
MD5 b65a73263102c6d13301d1d889897cea
SHA1 8d8386e9b37c46cdb65265ef130c15aa8f47c588
SHA512 dac1e3a0fbd951550f5f57ea6122492af8e24ecd2f6b28b12e28f5af33e086fa6cb387c375d54537da8070ad6ce3680a2ef64f4f72e70abb598c20b27c12bda9
SSDEEP 6144:DUjRwJGL/MDs5ZdeFSXeuU1WIukjTW1tMtcQ+Fdhzi:DqMGbMdFSXBU13uk8tMtcQKf2
TLSH
T158441211A9C0D9B7E8B296355D77F73AEBB862261020134F57581FAF3F34380950ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Connections_incoming.txt

SHA256 f86ef138e9bbafd691ab7c3fa0917d9b5584759fc96a09b4807f8258e149f09c
MD5 6fb9b819d1c8c077663d396e4a4ef376
SHA1 b88d81e93c9a4368f5fd4c37387accafe8c13f40
SHA512 5a90d1ac2c67b8106d4cf0f7dd0bdec77e4a97e7df611ed5b8ec59d3b675fc0ae0f6512464d3cbfeae3a5583d1f4a01cb02bd05bac223c3eedb2a0d1a8cec389
SSDEEP 384:HAgIzFxT27DUuTTW3be85jtSLTBtGnOnbUw/xm7tmy/j8ro24cfJT+TjmnJl:HpIn2kuTTYb55jwLTBtGn5w/xm709
TLSH
T1A2F2CF54EFF27BA04C4025C92EBEDE398E7E3074B94681176B6F7B28EE445068EF1650
MD5 SHA1 SHA512 SSDEEP TLSH

History.txt

SHA256 3ab13120dde5c943e6c7cb594990ab7cc83ab2d7cc4f3f1be88de56354ea4ff9
MD5 1491e257c42bb375ccd49b1c79af18c8
SHA1 c07da5db4b8cf2b32d502f2c5ef1e9499ff35cc6
SHA512 adcfafc6edb217f793268d4abf12dcb2e36a0104bf2cdc609293ab18f83f4310d5d7d4d7eb76ed0fb34656cee6ce8f0e269d3a012302b526d1812f54a5c64699
SSDEEP 384:9Lm7J4acEIGJR8oqNP0B2G4QmH2MiZ03gblOeVKrX0v6d90+rsLKYsIGY4KYK2:9PNHGco4PPbiZ0OOeVC0vk90HOYssYK2
TLSH
T10D1385A76D12F3353377E1A327156609E761A3AEAA0546C238BE43D43B214EB43DF49C
MD5 SHA1 SHA512 SSDEEP TLSH

Tideland.kKxy

SHA256 9f80f3b856355fdcdec1f930fe7603e4a7dfecd16293f074fca58ed8eafa2dbe
MD5 7655fe342b8a961b11d464a0c00aff91
SHA1 b611156efb48afef8eeb2d84e408b8c33c14989e
SHA512 9a3052e972b22ae59f88ed37591a87094499280de04998e695e87523847116889c837e0af56aa9742cf17e5d0dffda72be990ce2ea764efa07b00c337e1c3cae
SSDEEP 3072:DDAhlL/MDsSE2PEdeFSXH+uU1AwiGq8kWuqPV0OTWzZF0mE+:SL/MDs5ZdeFSXeuU1WIukjTW1tx
TLSH
T17DF31211CCD49DA5FCBAB1398935E22CCFA4457AA15622CAD2CD23DE3A743B02847F75
MD5 SHA1 SHA512 SSDEEP TLSH

co.txt

SHA256 eec122de8b88727a6eb9069d3297ee8aea792eedbc47b7f587de0e66c57dc266
MD5 280c6601ec968152d326994075201a3c
SHA1 ab018ed0711a6907b399fce4bb670f4dd6165e78
SHA512 2f57a5069af7c3e2584cb8850cfd0693ab2e82df0135f747ad16fc37d9cc05ab85b4985cbee4cf92d564cd5419541e59df7cd265831691ad2a571dd07b9c7e45
SSDEEP 192:iKomSy8V+eLHX3uAQbu8damcflup8oq/uoYTIiPpwXSiFdzERE7K:iZMDeLHX3uAQC8da1f+qmoYTTOXS4z8L
TLSH
T12122833116EC48113BFB5389D610B568FE335818FF933548EAB8878C334EE65AB5191E
MD5 SHA1 SHA512 SSDEEP TLSH

da.txt

SHA256 9ece6bbcf7ac8441781de46f450e73f894d2c8c2001404d9ef1309c4f6073c57
MD5 30738309c46b5ad8e6a73fb580ff2129
SHA1 5728164fa17108b91af05d3ed26445a366ae2975
SHA512 b1eeead7f97f5266459295e3154bd46cdacb200461c03a5537a9f2b5ce8b34de1b11d4ff41b88e737040611bc05d1e280575a7255f6681d6b23369334e29e2d5
SSDEEP 192:7l/wJCMNUyOu3aOm4SBiL97/IYgxvsyYwY5ckP6oxtMSVRELZFrLKcgrQcwJ0:7l/wJVWZBuwYwsyYwY5cqTtrVyZFrLlu
TLSH
T173F1D605CF84A36372A76ACEE5119876CBDF88311DA1064F36C4E19EB15B88423EF393
MD5 SHA1 SHA512 SSDEEP TLSH

kk.txt

SHA256 f2e6e55c102485e232daad00f68d8905f7a54f8ae2128db6afe25231c17acd69
MD5 f4c46b450a580ad5abf0b638dcdcc6fb
SHA1 750dfddddadee9cfe0e8f651f1c6cc38cf1fcd78
SHA512 24b6dc7b491302b905c1e20e67ddab16af9420820b6c83406618e017fa84d952661087e2ea577831441e8a3c82ef697de713597e33626aed787f3485dd9b1f7d
SSDEEP 192:iwHw0jjl8sq/UDEAY40JI0lkMPK+K4ppfdMMda764a:iwHw0jjiRUD8kMPJqMdj4a
TLSH
T16222DEA0614BF8EF6342EDCA2D04360ABD96147CFED723A115617C7F34FE2644A3A216
MD5 SHA1 SHA512 SSDEEP TLSH

rivages.dll

IMPHASH 338611d9e9203eebda3e8db719fe85ab
SHA256 00c9037adfce0c649c02fe5ecfeb998f3a3e44ab637fca01efe5826d880a3f3a
MD5 ad71a3a39d2b59c493f1158353228ab4
SHA1 a27a4c87131769ba65963b08835b191745647a53
SHA512 eeb490576728a2cb8586e19aa4c4809d4dcf5bd999f47397cf86c6f54da486d6ad23366720ffdc3ccdb0c9c6371522e4992f0024cbdb5a1473d314fac136cedd
SSDEEP 768:qmDdydrW5kQF/7LY7NWeWN+bEJmYKHZQa3vGZ+jIdKR:VDdydrMV7ie+bEJmLea3vaKR
TLSH
T1CC73861232EA365EEAF237B81CBD23525F7B3D529DB4D74F0A60305C0DB5A819921B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

sa.txt

SHA256 a44e8c328bf809890aa6ca883e2cb82b6c5207d9636e9a91253da4cd893668c8
MD5 9fe4da297163a84fe9d0b0289b1af077
SHA1 d14a6a318a50f2f13e45b2269ea2ad8fc5e3c44a
SHA512 a6fee2f3d6448f1f5be6ec88b51fb65ebd07c7ba3dbaf2f7a801fef54b9da410e6b800094853180a884889b304ea9a54672781fa7d0f1067af6c4a63c494a44b
SSDEEP 384:isw3ma17q9ntvNTsld5VFxxwMkAGO310F0klrfofmR7HOwPyng:HwQvVnQg
TLSH
T13692918DEBB8F3742CFC789E264D4D3BD8B86975C7B652564CE4B3EB4480CB044562A2
MD5 SHA1 SHA512 SSDEEP TLSH

sl.txt

SHA256 e433f867ddce2b0eafbb2cc6267026979747590028405d833bdfb8b16a4ba77e
MD5 e1f3b07d836df4031f4abc718cf375dc
SHA1 2ba325c6d68948b9261c8927ef925839730345f8
SHA512 f9bbb977aeda257adb2e0e030746d291bb67c5f5371cd79ef16ac887f4ba5eba5529132f8c9469f7e1b4c138e9c80c4975bbe0ee147e889bf01e3c7ad8a3e85d
SSDEEP 192:iS8TgU2+jtY7Ssnv+0bBktWSQCuHb8FXoTXpGhtPS+UVseBAoIy:iL2+jqratG62XddIy
TLSH
T15BD195B4D29B868502FA71DE937108C3EFFD8514FFC26899BC5E730D1255CA1263A92D
MD5 SHA1 SHA512 SSDEEP TLSH

jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.b65a73263102c6d13301d1d889897cea

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Connections_incoming.txt

History.txt

Tideland.kKxy

co.txt

da.txt

kk.txt

rivages.dll

kernel32

generic

sa.txt

sl.txt

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.b65a73263102c6d13301d1d889897cea

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Connections_incoming.txt

History.txt

Tideland.kKxy

co.txt

da.txt

kk.txt

rivages.dll

kernel32

generic

sa.txt

sl.txt