jaffacakes118_Trojan[.]NSIS[.]Inject[.]rmv[.]5eaec4c04c16dbbf894e0ab791fb98cf

resource
jaffacakes118_Trojan.NSIS.Inject.rmv.5eaec4c04c16dbbf894e0ab791fb98cf
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/Venussflytrap.dll
unpack001/$TEMP/msadomd28.tlb

jaffacakes118_Trojan.NSIS.Inject.rmv.5eaec4c04c16dbbf894e0ab791fb98cf

IMPHASH aa1bddb976cc14514caf3362a94d13f7
SHA256 f071dd3805dfa0d51994b786af825c9e5454d2fca098e82163669cc2dec725e4
MD5 5eaec4c04c16dbbf894e0ab791fb98cf
SHA1 51c8b565faf2a358648f740e16044aff80a95936
SHA512 f0485a2c6f226b5c411470f7637a3ba23f31a5d416bfe427a111b235c06d4a0aa2f6fe719e5fdd04c25cdfd0504f83e2a35ec9b55837992ae4ed23d18756a1e7
SSDEEP 6144:OmIoA8eNezQFsHobi30/gJIjPKCu/RW3Rw5+1Ntta65HQH:OmIT48U73QQIrKHpWBwkDvA
TLSH
T1BE44029A92F4812BC9B78FB11D374257B6B57A442C71970F2304DE6C3C33B85CA49BA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError SetCurrentDirectoryW MoveFileW GetFileAttributesW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode GetShortPathNameW GetFullPathNameW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA ExpandEnvironmentStringsW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc lstrlenW lstrcpynW GetExitCodeProcess DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer MultiByteToWideChar ReadFile lstrlenA MulDiv GetPrivateProfileStringW WritePrivateProfileStringW WideCharToMultiByte LoadLibraryExW GetModuleHandleW FreeLibrary

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog GetWindowRect CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA wvsprintfW DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW ScreenToClient CreateWindowExW RegisterClassW SystemParametersInfoW CharNextW GetClassInfoW DialogBoxParamW CreateDialogParamW ExitWindowsEx GetDC PostQuitMessage SetTimer SetForegroundWindow LoadImageW SetWindowLongW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem TrackPopupMenu AppendMenuW EndPaint DestroyWindow wsprintfW ShowWindow SetWindowTextW

gdi32

SetTextColor SelectObject SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHBrowseForFolderW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
MD5 75ed96254fbf894e42058062b4b4f0d1
SHA1 996503f1383b49021eb3427bc28d13b5bbd11977
SHA512 58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
SSDEEP 192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
TLSH
T1E0327D1293E044F2F191853C086B3B5AAB7A65099BE24EA79FE381817D15AD6BD3D303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/29.rsrc

SHA256 5f232e74103626f8f59a6b96eb5fd734e2a7968544202f931aa42b39fe3c2515
MD5 54070efa1b162be1fba9e9035da5a571
SHA1 070a4134d6bd04ec4375b8624074069ea19dfc25
SHA512 f804300777523fb28eae427ff21efd94a6b6fca861dd52e8a8c7cecee4e51603e6d1c50af5b2d51691b52bbf01a27dba217f1aacd9dce7cd5f6c1e29d06e97a2
TLSH
T1C351E0A1C4EA563583324227E7901B50FA1009F7876DA0E8799D223B1FF6C47177B76B
MD5 SHA1 SHA512 TLSH

$TEMP/8041_32x32x32.png

SHA256 f6b02974a8aa15e1c2ea6681104edef661f138aa28970d65694173fc2a46f862
MD5 2c6638518a9f5855beee206e4edfca3a
SHA1 b1c7858f228563f64abd64d0ae18924ab9133698
SHA512 50b7cd6c9aac4cfc13de48c0609976cc71f2f55399c7fe4c42798b3bae095141bee223208ae72683071577849ac8370ba5fd34c5aab3939e210d70866eb8f8ae
TLSH
T150F06260922704AFEF55CA3F2BC3FDC0AB9BE1D321A41B8A1D12C8012D08AC15B872F5
MD5 SHA1 SHA512 TLSH

$TEMP/CalculatorAppList.targetsize-48_altform-fullcolor.png

SHA256 575dc83b000464f1a31977af51c40d76010d361793895f56df2bceca89fd5674
MD5 7b3a1ff7c8d7460b9f7e97257f2563eb
SHA1 457f8c1d36aad52259fd3cd6d266547cfef24b3e
SHA512 346af95c2632ead9f94210e4dc0051aaff77171c3d9dbdf02bf797bec9c8a097c01975f05499b1c9df7aa76e58ec56376eaebd9583b8823134dbe5f6d47d0980
TLSH
T14AD0229B6A8A1DB88990812B426800A1EF10902C911981E713CAE86E2922A8C20C81DA
MD5 SHA1 SHA512 TLSH

$TEMP/EmptySearch-Dark.scale-200.png

SHA256 aa790eba31e6e99580850352f556e60a3f46950bf114b00806ed54d7d3357f4b
MD5 3b382349601ddcfe0ac82ced41d6de02
SHA1 ff29ad73ab0c2bf4965673ece3ba7ac8b28f96d1
SHA512 9cb5d3e20bc534f380dcab37042dfb733b83531b2c66ab07fcb68c4e8bf6bf7f4485bc7bb70dd5449447cd127ff32178320a982887532ba357f627f864fe5c67
SSDEEP 96:To8lXeo4u2HJCuU9zVGh0tN7RsJMQFj/dTWJ3bbOEI7osa/CSyVwibZk92:T9Uu5n68qhj/dTWJLbOE6aKk92
TLSH
T1B0B16D4BC756A807C3684AA9F5638304088218796047A51E653329FB8123CAF2CDA1DB
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/INTRO_300px.94.png

SHA256 2401ac0742f5317bb88c4d4908c3f7f0cdfc7bc2dc796dfbce1b159e76f072ea
MD5 304c4996286d31a143c5c6afaeb0da68
SHA1 a37a8c3f03065d7b8bce4d36008944d648cb1782
SHA512 ecf047efd22ee1d08df02e730235fd1946cf03dca882d1afb58e5ef7b13d8a7a68003615ae0bc594b96f8d4ff1a5b03881ce1f810cf1132929c698aad04c16d1
SSDEEP 192:Mtt8l56Oss+F6gWl/d2tGGIUdEt8S7B+4ZTuzPmEPRH:MtU0tsLTl8BIiN4BJZyzPmmRH
TLSH
T1D1F18D058C82C1AD86EA90FC772C42758B25DA67E44F54F8187E991EBC021B8DC6DE7E
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Kromesky

SHA256 ff6bf83adc7d6546d6c01068489a6d2320ce60f40b74fc81640258c8927d54e3
MD5 3f06d8a121f40ba0e00e2269204ef144
SHA1 9d9931f2b710ca3b2bb926a8b44886d038df8203
SHA512 ee5badfcc89ac41a7d0a0bd8a62a704131cb30d6eed563f94cfdc60ad40d0d449ef846b608ddbb0f6a6a23d0ee57e449accb61e727bcf8ea12fd4d6f5b48ab30
SSDEEP 3072:DiqEZHlcNvwogG+ODjPY8GCYdZ94I/e3RCo05l:Di30/gJIjPKCu/RW3Rw5l
TLSH
T13EC312EFC128432B4C5BFF72D50960BD225042CCDEE26E525B28A83D665A7F0DD86BC1
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/LargeLogo.scale-200_contrast-white.png

SHA256 0b6acc7eda6dc3ff7b666aedf3d6b18b6290c64991180f163d11a4d307020329
MD5 a952744398fc67678a1ca47e1a2298f0
SHA1 e2ca77fa41d7a5ab7ebbab80317e841e9bd91618
SHA512 3253e0f18c04dde179ee87c4e1b64cbdc7cafbe5cafa69fa78bfee2d8aaf921d45a76326a97791606a6e13c06db08ac7c215057855d04b2f06e938f8e37c1e94
TLSH
T15E51BF41398952FA5A54D63A3BF58535F13A89784130897C3391FB3F31C7D8EE61BA82
MD5 SHA1 SHA512 TLSH

$TEMP/PhotosAppList.targetsize-96_altform-fullcolor.png

SHA256 80602772315882b6923ca7a339d213385afd1c28e01fc993addc2807dbfaac89
MD5 8831f10b2d281f03066df7b9a172831c
SHA1 bdb4173dd4f4413d305dc57379979d1e17456001
SHA512 92301c2a25bdcff027c454f6dbef6735c0376eef708ebb0baab46df8230f169776eb1718e36d0bcabbff0788c61bbf0056b5857c448926161e916133694a452c
TLSH
T1791198D518E891F3CC52433B0456D7393556C4EA1884DD1501CDFD7BC35739DA0560A5
MD5 SHA1 SHA512 TLSH

$TEMP/PhotosVideoEditorSquare71x71Logo.scale-200.png

SHA256 45b5ee224538b832f145461a2e47a0f4caa1da1be1d347f7806fd0a31b7aaa79
MD5 12884b8f2ce33ad9890a67e3bd882fe4
SHA1 e4dd17ad95d9eac0942b3120219411fce5319857
SHA512 2271aa7bb013b87399c9b4e3ee948369fa30ce8325136d2b9e6f6d7ac53427b7eab0ebf90e8d2e44edda21688a54895583967265dcfb6ea2f7e1d7cce627f412
TLSH
T177F09E84FAE8147BCD4E38269C514873589713D2EA04AB876DA3F01C9736F15B494D60
MD5 SHA1 SHA512 TLSH

$TEMP/PhotosVideoEditorWide310x150Logo.scale-100_contrast-black.png

SHA256 a11e7fdccefa7e3aabbb3ea57210532acb59a08966ca2bae58b629a93a1730d7
MD5 7576f6b9c6aa247c4d10cedf8c33c2bb
SHA1 b32dedb89b48c507d7b9689c7c86bb413ae850c0
SHA512 b041332e6c9886177925b425c23dd8d36de31fe04a7e78920f2ee488abb25b9d4afd8487a2e881df812e4117614e7d12dfbbccb2a9b59000cb80578795bf8e37
TLSH
T1F0F0461A53F90F7AFE30DA36D220D5604ED62C207449881622ADD6B2296100BC95F3FA
MD5 SHA1 SHA512 TLSH

$TEMP/SearchDictionary.xbf

SHA256 df80dac69b0abc25fbc9b802e890701f222b2e84fd39e1240049a5f08e8e020d
MD5 65aa6926c8d41630e348aad6d6841632
SHA1 05a05ebbbc39c7b4a3e08f44643ee4ac58440ed0
SHA512 90038b32fd9a24ed93eb0761eccaed42a4611e2a0d91732a0fbff11cb8b0ede761fc2ad0219e50d3538e7efe199299b1aff3eee6e3980cddad2df3f76a1f4d77
SSDEEP 384:XL56lUxE9eBow5qV8JyKmOHvHjH/HrWVccoPbFvw3TIN:XLIGxOgowEIyiPDfLWbof
TLSH
T1F762DD01ABFA1108F6F2AFB07E7B492529B3BF325D22E1AF4114185E1672F4495B47B3
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/Venussflytrap.dll

IMPHASH d18a1f89e4800560c0cdfa7d54015555
SHA256 78eca2d779348f8b80cecc4dfddd9b4ad0eaeccc99efa0ac49ea78ebe282561c
MD5 ea0d50dafd70fffb4c71ca775a672228
SHA1 97a418322a94aa914e65d0bea337af185af414fd
SHA512 fddea65f8ad3cebfd833ad7ab3a6ef0162c2930859c86beacf618c2e735c6ec79a57aaa852ab23a1bed717fd7b70072277f59c408cee21395b6182fffae4b9fc
SSDEEP 1536:SnBZRfocrAyTyM43nQJDYGiS3TEUmFY356OjHVQWtFuQR8lMuifCH2c4sfER3URO:Cfd/TyMOWDYtUTh35rHF+uCWcdDR
TLSH
T1CCA39E55B1DDC075C1AE5C3C606E6B832A3DD0B8DE548F67D0812AF82A507A36EE138F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

57216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/msadomd28.tlb

SHA256 462cd1c066015c1c7e654a4a33b1f204d73807f02420f81e7cfc420aa316d353
MD5 2d8aef0653d0c2fdd51b26f70efd9194
SHA1 25ff0c7168f06d264d147fd0fb64edcb7631572c
SHA512 5eea77684948ff8ffb0528bb439b7802b400024e9d4ffb80b72fa8a44f5df74ce012dc821c8942212c50073ffd2210ea476f5f697949532ee600a21a79fb2033
SSDEEP 192:cx+IWPbAWGHzr1KHgbkyjRz+EzacooRMBGDCbKydW66CwWbol/5UgpavCF7oF7/s:cAIWDAWw0KuW6nxbqBUK1
TLSH
T12752AC05BB84C9A7D50D0232084766EB6F70EC442F62A36B6385777D1D737C8AD09ABE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jaffacakes118_Trojan.NSIS.Inject.rmv.5eaec4c04c16dbbf894e0ab791fb98cf

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/29.rsrc

$TEMP/8041_32x32x32.png

$TEMP/CalculatorAppList.targetsize-48_altform-fullcolor.png

$TEMP/EmptySearch-Dark.scale-200.png

$TEMP/INTRO_300px.94.png

$TEMP/Kromesky

$TEMP/LargeLogo.scale-200_contrast-white.png

$TEMP/PhotosAppList.targetsize-96_altform-fullcolor.png

$TEMP/PhotosVideoEditorSquare71x71Logo.scale-200.png

$TEMP/PhotosVideoEditorWide310x150Logo.scale-100_contrast-black.png

$TEMP/SearchDictionary.xbf

$TEMP/Venussflytrap.dll

ole32

ws2_32

kernel32

user32

generic

$TEMP/msadomd28.tlb

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.NSIS.Inject.rmv.5eaec4c04c16dbbf894e0ab791fb98cf

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$TEMP/29.rsrc

$TEMP/8041_32x32x32.png

$TEMP/CalculatorAppList.targetsize-48_altform-fullcolor.png

$TEMP/EmptySearch-Dark.scale-200.png

$TEMP/INTRO_300px.94.png

$TEMP/Kromesky

$TEMP/LargeLogo.scale-200_contrast-white.png

$TEMP/PhotosAppList.targetsize-96_altform-fullcolor.png

$TEMP/PhotosVideoEditorSquare71x71Logo.scale-200.png

$TEMP/PhotosVideoEditorWide310x150Logo.scale-100_contrast-black.png

$TEMP/SearchDictionary.xbf

$TEMP/Venussflytrap.dll

ole32

ws2_32

kernel32

user32

generic

$TEMP/msadomd28.tlb

generic