jaffacakes118_Trojan[.]NSIS[.]Inject[.]rnn[.]c677c326168aac424820a36d7b83df9b

resource
jaffacakes118_Trojan.NSIS.Inject.rnn.c677c326168aac424820a36d7b83df9b
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/gladiator.dll

jaffacakes118_Trojan.NSIS.Inject.rnn.c677c326168aac424820a36d7b83df9b

IMPHASH 91ee5e6bfb97a170f42f9cf6e9a4878d
SHA256 46b6d9d284accad6ed3106eb2651cfbf350242523ff1a41bb0585b47f71e5b06
MD5 c677c326168aac424820a36d7b83df9b
SHA1 e93de597761d91fc609e5246a1514eacc3c4dcd1
SHA512 c8f843a451abd0b5c0846e386d77b456179b22877c7430fc635b69ab0a5fa68d54041600c2c7d6f5388131a61e989c57f45e9231de8a94989868fe6afd54683d
SSDEEP 6144:acpnM51pcOKTzwiRTLsGe15WehLIppFfPl6duYREwgacXxZ+pd8lM10lVmhRr:acNCcOwzOGi9PUcEwgacXxoPKM10lU7
TLSH
T1E284120461B45427F5F60E720EB58726DFBB7D221C30C6595384EE1E3E36B12EE26B4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14357

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError SetCurrentDirectoryW MoveFileW GetFileAttributesW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion GetShortPathNameW GetFullPathNameW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc SetErrorMode lstrlenW GetExitCodeProcess DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer MultiByteToWideChar ReadFile lstrlenA MulDiv GetPrivateProfileStringW WritePrivateProfileStringW WideCharToMultiByte LoadLibraryExW GetModuleHandleW FreeLibrary

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog GetWindowRect CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA wvsprintfW DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW ScreenToClient CreateWindowExW RegisterClassW SystemParametersInfoW CharNextW GetClassInfoW DialogBoxParamW CreateDialogParamW ExitWindowsEx GetDC PostQuitMessage SetTimer SetForegroundWindow LoadImageW SetWindowLongW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem TrackPopupMenu AppendMenuW EndPaint DestroyWindow wsprintfW ShowWindow SetWindowTextW

gdi32

SetTextColor SelectObject SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHBrowseForFolderW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
TLSH
T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/CloseButton.png

SHA256 4f51a2eaac5670449bb605f7508730567418a5f073cf0a33b868876d3c500925
MD5 4016a948da933576a77f92949c73d5dc
SHA1 cc5b22d4f0b64a10a166601064a85cc6c1a28150
SHA512 b05745ec41e8e7f9ff85ef17f7926f787fbc5fedc81277c0942ff45da335bcf17ac12ce9d46ab1ca233e5e5e3aa8b8924abe41e231337c715a67c2312dcb8448
TLSH
T19321E9B687CECC859DF69C98294AC125B17C485CA11C5FEA0F2088F902C2BFB6944904
MD5 SHA1 SHA512 TLSH

$TEMP/HxCalendarAppList.targetsize-48_altform-unplated.png

SHA256 a8a2e849c76eb05fa09e79b61985b4fe6fa8141c2aec2a76b49f24cebedc0862
MD5 8c20983c2fcaafea933551b0a6319cf5
SHA1 4c6f6d72422a942c3737c34f66ec02c271b42be5
SHA512 bff0de9f67c4fdb8e27a5e2d31c95001383c08d0e02e5a9abb704145ed683ebc1c00ac7f7f33a9b9d2585bfa7cb05c62d517fffd5130190da97876a2a046d062
TLSH
T147D022C325295E3DD74B0C2308B84E02CC33C023CC0A71541312425536B03725CC4E82
MD5 SHA1 SHA512 TLSH

$TEMP/INTRO_300px.62.png

SHA256 627a3f7e38d7501aa48715e107d68618b0d62c3b6ffe8ffa088310ad2cbc1f5c
MD5 6cd07c6d378f418de406f60b34e0f1b2
SHA1 3c309bc3473967f7b0e6996826b51e9a496e48dc
SHA512 53461eb33072a9b5ee20f45d7fb41fad1efda823f9b014ea50f2ee2704b0d758856e6e54b959b8b3f424c91ac2c48ce85b572f0dc36e37a2bc24c70906df7a95
SSDEEP 192:58J9+cTv4AleruOpK+qxZE21BqUs9be47nCTJD1FiKB6I6:587+cTv6zMx7Bq9beGCTV18h
TLSH
T16BF1A0984838E277EB5498D0C180B5247EB1DA0A729C7C1114F2C58715294FE8C76ECE
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/InsiderHubAppList.targetsize-96_altform-unplated_contrast-white.png

SHA256 bb5ba3888ad4b2fcdba207facf8e7d4aae667717e1dcd0a39830564b5bf10257
MD5 b9bc8c67af7c5da1acb963269ae8263b
SHA1 86a25f557d398228e5daeb08b3afbb804681dfb2
SHA512 6ea6b2e684ed8d5031fc0c2d0862d5b77a45f69776ea64265e453be7d0ac4221538d381658c5a8d7c9d2edc3b950cc8d16fdebdc95cfb98facdd575ce7d5db2a
TLSH
T12AF00254DE05182C86374A7AC363D2EC39C5565FEB5952C44E072BD11880C34C447793
MD5 SHA1 SHA512 TLSH

$TEMP/Overstrain

SHA256 deec447624a651451924d45a62f9cb785f7ab678e6f4f59eef72a1dc2d5ec454
MD5 c6f3932a7b9306fc59345d2d9468cbb1
SHA1 3f875c133b60abf3a238b903a4b9c1204bc6c272
SHA512 bf712fe63addf650ed3ab08b02f0d6d8baf5280492f2725acb9dded4a0fabab39e0de19d8121cb16df914d625f93578b4adba6842628cc537f08724b7501e233
SSDEEP 3072:Xp1IIJbDCgDWZCf3O/ft4yon4/ajFsEw0rIu6QzxEVMtByBhc/3MEd+51tSh:51IIJbRWof+/ft4yM4/AtswEVMOjc/37
TLSH
T1FDF313399E396D7B1B0F9CDBB17110A93322382213F691D5151EEAA173D243E7B65053
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/WindowsCameraAppList.targetsize-48.png

SHA256 88a4c477f8318726ac107ab19c48c99cefabe7c5b777f9d19ea09ee6e69d015e
MD5 ed665670f8140e41620c7790093d675c
SHA1 4a1c6bcec352a696a1c9c22398f2c37f061c3a50
SHA512 5b0fae62e398fd6e12d84ee99b164714ecb26af06a7046c22554c8db72faef01c28ce1df48c2cd43f85d7702818463d7eef71f90bc05f1a202eaaac9ff793266
TLSH
T1BAD02B574657FC78843F1AB5506844E2EE526276D10305848019DB7B186F41A578C1C2
MD5 SHA1 SHA512 TLSH

$TEMP/WindowsCameraLargeTile.contrast-white_scale-100.png

SHA256 e71f40185a543685d58237dd52a4d826a24fbae4d6038ee83d08c5cd0a03a4c9
MD5 4b99646de6ade059436267cab30707a9
SHA1 fd7ff8d0bcdf0d3eb5edfe6767aafeebcdb9f571
SHA512 6e8dcdeaaa50553d9b97751d278902844a68a941f14fbf2d0b39838c6f99fa4bb52c1c68ed62f6b9c68d401df2497c72416e493739cdd2920b65bd1e7775ce73
TLSH
T19111365563F88EEFBD70CE21C265E6215FD22930B608195B218DD171649809BD07E2F8
MD5 SHA1 SHA512 TLSH

$TEMP/db_w6.sig

SHA256 afda99c49f0c2f99eff367629ed63f56cbe6db774c2c70957aba7788e5de17bc
MD5 0e125a414a6201da937da46791b50c3c
SHA1 244ea231fa9ab0f0db48f6d9df63fd2fb5ffe25b
SHA512 2f47184fb058e9331764e4c7f141941d4406e61e49adf35ee664726420249d5a9af6493a6093c27cc33fcdb3ee5b74ffdabb8aaef440c9712e4cdef77f5fd6a2
SSDEEP 384:prQjWKKjl77GDyKZvg8m1pkp4AjFtYXb+Nt:lkJ3GKZvg8m1I4CYXCN
TLSH
T1BE520A63E6508EB0C4A0717CA272970C3FB5FD8541F5FB0645A862376DB3416ABB72B8
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/gf2engine.ini

SHA256 dc484f59dd2a38a84dde10f218693dd0cba040008ef60c4df1bc091dac496f01
MD5 e3647754b69292a5200f456e0ab33efd
SHA1 f52aecdf0d3fae3f320caaa3f2c9040db05c79bf
SHA512 a8e8406babbeb12c71ee6d99b558855baa33b9f96c186ececf79cd4516c70e25cb49d06d8925fdd2bc8c5983379b900071ff9b1a41ef14ca898c41ee945be486
TLSH
T1E81160514E2A868CCA31C8D40D7D11E9AB6F83E8B547B16174E738C9AFB4B0148BECB5
MD5 SHA1 SHA512 TLSH

$TEMP/gladiator.dll

IMPHASH 94c9c26c075b8d9a854ce5db3f0872d6
SHA256 33ab92d51cf8a1901e2cbfcf3d432b508bb07d94edfa8e1f94985c808bb632dd
MD5 c0fa146fa77f33ba4aca523a30e8ae0e
SHA1 4f514af1f10abff7169bcc3df3bfbae42fb480ed
SHA512 c70954442e6518ba3fc29738dbaccacd492a3448b9e3a92a3918f380c923ea69d9746777320fa547fc460e5a31ad97507d20a7bcd4b3aefd2bde7fd96a1a9c19
SSDEEP 3072:xm283B6CsLw1CoY2IbZboqMpy8qkGHmE2vv8G1jEaMVuQwGI+NSSytt6W93AW:xmjyU1fnINc9oJzq0G1jEaIwGbNpWG
TLSH
T1D8244A25BBC4FDA1E56E847235B2EBE10466F0F24A5F5A027B800F8D653129EDE35B07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

127178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

SubtractRect GetKeyNameTextW MessageBoxExW wsprintfW

ole32

CoCreateFreeThreadedMarshaler

kernel32

DeleteCriticalSection HeapSize CloseHandle GetLastError OpenProcess GetCurrentProcessId SetTimeZoneInformation SetDefaultCommConfigW GlobalDeleteAtom GetThreadPriority VirtualProtectEx SetSystemTime GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP WriteFile LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection VirtualAlloc HeapReAlloc RtlUnwind LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

$TEMP/updFD23.tmp

SHA256 704a23b0ac20c7540df953e3bca485febb5f217ec60252aa39f1382f83ae5687
MD5 a01ee3a7e3373a0414027344c7fc185d
SHA1 234823dd55af55309ba4b947110f1b75cd44120f
SHA512 ad63c33550e9b5b285ac9e430e25b4d8c0b3c489c34c4908f5d074abe7c106bb37cfe99437b8bd51c65a9a790030c70d5af2edaa4c5003995b52b99186c5fe7f
SSDEEP 384:hFY2dGJa6u3tDjlgwEnHdOFLbHHqxoPbd5:h1wQvRlgsFfHaojd5
TLSH
T1D1F2A0095EAF463E7D5CEB8804B948F5EEA824B10CB7DEAB49D2D914501F7E7629C230
MD5 SHA1 SHA512 SSDEEP TLSH

jaffacakes118_Trojan.NSIS.Inject.rnn.c677c326168aac424820a36d7b83df9b

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/CloseButton.png

$TEMP/HxCalendarAppList.targetsize-48_altform-unplated.png

$TEMP/INTRO_300px.62.png

$TEMP/InsiderHubAppList.targetsize-96_altform-unplated_contrast-white.png

$TEMP/Overstrain

$TEMP/WindowsCameraAppList.targetsize-48.png

$TEMP/WindowsCameraLargeTile.contrast-white_scale-100.png

$TEMP/db_w6.sig

$TEMP/gf2engine.ini

$TEMP/gladiator.dll

user32

ole32

kernel32

generic

$TEMP/updFD23.tmp

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.NSIS.Inject.rnn.c677c326168aac424820a36d7b83df9b

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/CloseButton.png

$TEMP/HxCalendarAppList.targetsize-48_altform-unplated.png

$TEMP/INTRO_300px.62.png

$TEMP/InsiderHubAppList.targetsize-96_altform-unplated_contrast-white.png

$TEMP/Overstrain

$TEMP/WindowsCameraAppList.targetsize-48.png

$TEMP/WindowsCameraLargeTile.contrast-white_scale-100.png

$TEMP/db_w6.sig

$TEMP/gf2engine.ini

$TEMP/gladiator.dll

user32

ole32

kernel32

generic

$TEMP/updFD23.tmp