jaffacakes118_Trojan[.]Win32[.]Pincav[.]bqowv[.]d66efb276a03ecf1904abfcfbe36e904

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	upx

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/SelfDel.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcEx.dll
unpack001/$PLUGINSDIR/nsProcess.dll

resource
jaffacakes118_Trojan.Win32.Pincav.bqowv.d66efb276a03ecf1904abfcfbe36e904

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jaffacakes118_Trojan.Win32.Pincav.bqowv.d66efb276a03ecf1904abfcfbe36e904

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 8730ba0355c20eef9776ee43d3703680a36624f2e54154ad2579f59708a0042e
MD5 d66efb276a03ecf1904abfcfbe36e904
SHA1 2344b257587a6773c6490b8a0c7fab98553662de
SHA512 1c19871f78e832099a111ba29799bdbc53c9392ee9a70d964cc3f3241b23a6013651e8aa672016c76dc61eb6b96d129c412f188a566884d72371a83e630c689a
SSDEEP 12288:Fh6PElDp1xA1BtXhDvAdDi8hnXL8ZNE+2M11RAprKSXGD1fQ9:vacDRAj2phnX2hA1eQ
TLSH
T1301523333AB0C9B2D24B8C7042CADBFACBB5709065596E8B77C42ECD3F64A5B0D60506
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

0b:88:db:1d:4a:d6:95:6e:04:c1:28:68:92:35:f8:3f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=USENET,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=USENET,L=Kumingan Barat No.8,ST=Jakarta,C=ID

Chains

Jan 1, 0001

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=USENET,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=USENET,L=Kumingan Barat No.8,ST=Jakarta,C=ID

Serial Number

13:5e:04:6f:1c:85:e3:b0:19:a1:84:4c:11:5e:34:64

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 1, 2011 - Mar 31, 2012

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/Licence.txt

SHA256 b616cc109c84f05ff3f1fcd24d6b43fa90af57018095d58d47cd50e16db6a44d
MD5 848818303f7d895b003a3de7e4b2e4a1
SHA1 46981f78d343ab98d0b271424b6965e6c81a34ac
SHA512 35fd544c999e0b286f099c41ea7d8de9bcbabe3a2cab95fbdcf67ac8f223ba200e3878ef3f65ab54d2ce359c71d4b939e4223fd4d2766a5591bc2780579774a3
SSDEEP 192:Bo/8dA758lBYkPyscdOzxKKwVK+reTke7fJm/rNTc1iapkSnOzalIOl4NkoXq3:E867G5ktM7JmhCOYWq3
TLSH
T1797287C55B6C3212CC9CECAF7C005A57DCDBEC95F5CC420FA9808449AD886797A2971F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/SelfDel.dll

SHA256 281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
MD5 7cff7fe2caea5184d98c147e7e263132
SHA1 21f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA512 fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
SSDEEP 48:CzHDh3jgWMynQfXKsJ3eAn67wN4VDm0pmoZSeJY8JTaCILFoyTFS7lWsaEaSueq:S18WMynkXKOOATEVUPnS7s9TShqTM
TLSH
T14F91F98467EC1656D4F607306BF193263C3EBC104979D3FE2888114A6CB165A9965F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

30144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 16b76fa1fdb38370620685dca43c8dc868c311a440416e5a99201af8602584f4
MD5 89e19ef4c9e148d9a25abb001b1bd707
SHA1 b344be397b903dfa19c82a19dca3520abd68412e
SHA512 17e04657483700a0d1ce1a588f587a0f17dbf7f07d945c08e88ee64bdc2a0ddded680aca1b009a1fab194bc97551733ae1b248ae7029c2e7a7555b59d189f785
SSDEEP 48:CV/wr5gIkjfqzDcFGb7Gfq815pwsL9ANPJ4ZAyTFS7lWsaEaSu:VgB2z4Wkp5L9ARJ4ZVS7s9TS
TLSH
T1A6C12531A3E61266F4A347B1F9BB1222552A7C305735C2BF4A5201593C701A3ED35F32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/mdmxusnad.da_

SHA256 7fd9f0495360a5e3463eea1c9ca291acdbcc15caa0d2cc10a09c5113b525cb6b
MD5 47fd5988e4cf4f45b8b7a6ba82b53de1
SHA1 c0b4ed09ae6dcb7268c9b78f757e92aae66becbc
SHA512 12ddbf629a371c063a4541d49ab09c3582d12337e1e31b2a5e0e037d887862b0cdd7c48f3bbcc982c288be51ea8f9222d2f64fbfec80eaa73b17d7741bb9da6d
SSDEEP 12288:1KVxpW+Fyd76nPwUGoilgWckO70s9zskfxcNANs:N+FyAPwUScx0SIExc3
TLSH
T118C4AEBA0E2B16F5FBE65964325E7ED26CD4D146159F0F8D088974180922A8CE273FF3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcEx.dll

IMPHASH db88e7ca457a1dd7e9078b47dcc1e619
SHA256 e7a1c7da9b1d9f483b572e00aa9586c46fbc480dbc2accee5703ac223eea7071
MD5 ed7ba4dc1df007a788f0ef3dd65f95be
SHA1 62f88e158a03ff1bc70ac6e3cb993d91ff4e000c
SHA512 3f9f0a00b848dcc49af1c5c8b34e63452d448eb3626a5501be1b3207961c0ae9297010394b7e3cea3c27319d09dc3ae7731eb5d112fe9bacd30ae92cc8340bb0
SSDEEP 192:04EE8le+bTYR9GyNBV6s+6MWV/PDBWdb3OYX/0V8PaVu0NHY/0Nk/pzCqJkdsRTi:iDsM2BV6gCb310iC3x1C/pzCqJbxIKc
TLSH
T10CE2E802ED426072C36947B1266FAA2BA15DAD721BD555C3FBC60F1D0EBE0E37631A07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12149

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord815 ord1134 ord2725 ord540 ord800 ord6467 ord860 ord858 ord2818 ord2764 ord537 ord6153 ord3790 ord1979 ord6385 ord5442 ord3318 ord665 ord5186 ord354 ord3136 ord940 ord4277 ord5683 ord5572 ord2915 ord825 ord268 ord823 ord1567 ord5858 ord5651 ord3127 ord3616 ord350 ord3126 ord3613 ord3663 ord1176 ord1575 ord1168 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord3922 ord1089 ord5731 ord2512 ord2554 ord4486 ord6375 ord535 ord4274 ord1116

msvcrt

_adjust_fdiv strstr __CxxFrameHandler strtol memcpy atoi memset _mbsicmp __dllonexit _onexit ??1type_info@@UAE@XZ free malloc _initterm

kernel32

LocalFree GlobalAlloc lstrcpyA GlobalFree TerminateProcess OpenProcess LoadLibraryA GetProcAddress FreeLibrary CloseHandle lstrlenA GetTickCount CreateThread DeleteFileA LocalAlloc

user32

wsprintfA

advapi32

RegOpenKeyA RegCreateKeyA RegSetValueExA RegCloseKey RegDeleteValueA RegQueryValueExA

ole32

OleInitialize

urlmon

URLDownloadToFileA

wininet

InternetOpenA InternetSetOptionA InternetOpenUrlA HttpQueryInfoA InternetReadFile InternetCloseHandle

psapi

GetModuleFileNameExA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
MD5 8f4ac52cb2f7143f29f114add12452ad
SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
TLSH
T1FA91767353F961E0C1CB0F72308715E7FB77C87013A6A15E0A63A39556A1597EC2C715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$WINDIR/System32/winmxsvc.da_

SHA256 eb9573e27b9a2ec5949e5e543f7d9b60740525cdd9a73414422c7befb2b86429
MD5 687adb24881cae28423d64b1ca28b9ee
SHA1 a97217c8065c8735f4b49445c1cd6e784adc2ea5
SHA512 00c1565da82a44c504609b2bf3856863bedaebf5f4f5b69e6b98da34e45c37df167566f31d8b3f8d7948ad099adf214125e47c3fc7af0bc9d5b330f2676a60cd
SSDEEP 1536:cecvvM/c8OY3ofzY8654Hx/mEgBQ38Fyxn8YQdugo:V4vMqPzYH4RmEg+sFyl8Yxgo
TLSH
T13983BFFAF7F3FB5BA159D1B01376A0796C0E346F486BC8A2A14CDF4535100A627EE4A4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

mdmxrun.da_

SHA256 9ce0da3f582dfe88f08e26a412edd4f9f3f42c9b5af6ba1587f9ce784c724735
MD5 a26e8d7b12db8f7385507e7a18f0bb77
SHA1 ab936e56a67e62432b693f40b892c2ad50bc3e1b
SHA512 14a175f37040f4b01948a09ab230a8648824c4670232041156612433fe4628e0f21b907a87786b52971815e9fe00c0761fa185faa98e6fe907abecd34ba39471
SSDEEP 1536:JN7ywZmeKdFUMauJ71o2WyePyWqmLBz9riw/jTe9krlO6em:JN7yyzKx70+mL/HeSg6em
TLSH
T127B37C9E47B815BB71BECDD301883F55C632AF42D4B087AAA16D469ECA3D29CC11D21F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

mdmxus.da_

SHA256 16d998340b6a2fab0e382313fff510a2341b08e1be82f3a1aa93249bcce905ca
MD5 0d1904c94804bd32924bfe5017e50309
SHA1 14c5caeb55a1542c197abc9d3fba814557d25e93
SHA512 e4c9375248e75cc383ed24bf850b231f25ed580f33e33144ba30140ac36370bf6a2b5a267f9fc4bec944adc9731c7d2a2c41c91ffd55010a7b7d936fd57c53eb
SSDEEP 3072:3F6anEWM+R/fSAxkzUTgfbCjnyuw4OxDne50cjvp6I:V9393qzUEvul+neiUvpV
TLSH
T19BB3AF668AD77E6434EDAD1F48AAA7AFC10A57F5301CC25FC00D6096B3B732E251325B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

mdmxusnad.da_

SHA256 7fd9f0495360a5e3463eea1c9ca291acdbcc15caa0d2cc10a09c5113b525cb6b
MD5 47fd5988e4cf4f45b8b7a6ba82b53de1
SHA1 c0b4ed09ae6dcb7268c9b78f757e92aae66becbc
SHA512 12ddbf629a371c063a4541d49ab09c3582d12337e1e31b2a5e0e037d887862b0cdd7c48f3bbcc982c288be51ea8f9222d2f64fbfec80eaa73b17d7741bb9da6d
SSDEEP 12288:1KVxpW+Fyd76nPwUGoilgWckO70s9zskfxcNANs:N+FyAPwUScx0SIExc3
TLSH
T118C4AEBA0E2B16F5FBE65964325E7ED26CD4D146159F0F8D088974180922A8CE273FF3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

mdmxussvc.da_

SHA256 8ef55a7c95755e5b9e8f0c3e28f95830e70c2a2375c86e1267ece6b0586040ce
MD5 57a02ed610522090b091e5bc1ffb3a73
SHA1 a53ebe1a8b1a4543fbc9781ffff54243b646d577
SHA512 49eeb78ba5c6bf72c38f5557ec6658f022dd56960cbaeecde559928fc3a4ced04901c6337ad845810a060eb902ffe99dadbe867aaad18de15e3fbecbffa935b2
SSDEEP 1536:8rMPyBaAoAPQ02baDN4VY4j4Lhc8miukPswonp:vZAoADwaZMsLhcuJPswOp
TLSH
T1D6A39EE1B8679F643A19DA973AFD7B545F87B950C9E806BC1AC748C0047A33F5090A3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninst.exe.nsis

SHA256 52ae8180fd64ed62bc3caedacdf0320fb4e6b53a7b34154209966ab3800d9c1c
MD5 a608b0fc834bab6a861b052a590ed3cd
SHA1 abf288a01678223f742315df45c5d63323e04846
SHA512 7b9a56a205a1164ae10640a71e657ee56553cf2edf91592bd5b01ff0b86f66d4fc98cb3402521b79578522f6f8e5fc3781a9cef2c4b8684f20599ff4c535d7a2
SSDEEP 6144:zPUzlnPrNj2eKmTjkKiiAtDtNNzpHDyEMuT6dqJ4U:zPElDp1xA1BtXhDvAdE
TLSH
T1917423B23675C6A4004B6CE093C88BFE86E5709179627F47F4C27E8A7B64E1A1ED4D03
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Pincav.bqowv.d66efb276a03ecf1904abfcfbe36e904

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/Licence.txt

$PLUGINSDIR/SelfDel.dll

generic

out.upx

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/mdmxusnad.da_

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsProcEx.dll

mfc42

msvcrt

kernel32

user32

advapi32

ole32

urlmon

wininet

psapi

version

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$WINDIR/System32/winmxsvc.da_

mdmxrun.da_

mdmxus.da_

mdmxusnad.da_

mdmxussvc.da_

uninst.exe.nsis