jaffacakes118_Trojan[.]Win32[.]Gofot[.]crg[.]d10d3347530959aa15ac35ffebf2e4d7

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7
Size 366KB
Sample261018-v5bf2sswew
SHA256 51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc
MD5 d10d3347530959aa15ac35ffebf2e4d7
SHA1 25810fea82d399a5cbcc5591fb116217488692ee
SHA512 c100e24c5abad2ef50c44ebbfd89a41a1bfb7f137cffeacde7526bf99b5141a18ce992142d62d942281cf45abfcba03bf464a9f7504b4ee83475ae9a2bc238d0
SSDEEP 6144:Je34uRAKkpJ8SnUfdJF7dRacRN5mGwRQwIJLHHNhjVnlo7OpjPwBiiKOI2FiqOpC:+OD8LJF7LIvRFuLHRnppjPk82s8Jd
TLSH
T13984228AD5E1ACBFFD83863262FDF15AE67F13901121682F439567AD3E9022D09449CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/UninstallExpressService.exe

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7
unpack001/BomulBoxC.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/UninstallExpressService.exe	nsis_installer_2

File Explorer

jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7

.exe 366KB
$PLUGINSDIR/KillProcDLL.dll

.dll 44KB
$PLUGINSDIR/System.dll

.dll 11KB
BomulBoxC.exe

.exe 725KB
Uninstall.exe.nsis

32KB
UninstallExpressService.exe

.exe 32KB

jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 51a5678e3dcba33c7201090bbaa09a6d04ebd14eaa8a5c7e56a18a4ab7611acc
MD5 d10d3347530959aa15ac35ffebf2e4d7
SHA1 25810fea82d399a5cbcc5591fb116217488692ee
SHA512 c100e24c5abad2ef50c44ebbfd89a41a1bfb7f137cffeacde7526bf99b5141a18ce992142d62d942281cf45abfcba03bf464a9f7504b4ee83475ae9a2bc238d0
SSDEEP 6144:Je34uRAKkpJ8SnUfdJF7dRacRN5mGwRQwIJLHHNhjVnlo7OpjPwBiiKOI2FiqOpC:+OD8LJF7LIvRFuLHRnppjPk82s8Jd
TLSH
T13984228AD5E1ACBFFD83863262FDF15AE67F13901121682F439567AD3E9022D09449CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

35:38:b9:1a:78:ca:86:d7:83:ee:c0:f1:a5:d4:af:dd

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TGSM Inc.,OU=Dev Team,O=TGSM Inc.,L=Haeundae-gu,ST=Busan,C=KR

Chains

Jan 1, 0001

Subject

CN=TGSM Inc.,OU=Dev Team,O=TGSM Inc.,L=Haeundae-gu,ST=Busan,C=KR

Serial Number

65:5f:3e:af:0d:3e:7a:56:0b:41:5f:fe:56:11:af:dd

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 14, 2009 - Feb 12, 2011

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 0000020b36314254f6eca65a7ae713f4
SHA256 1af3ac7d3176af42e8594ba0c33821d3318f4eea5cbb799bf8fab58e480efe0e
MD5 3599d30554ad65dc29fc689217d2152e
SHA1 8f5fcc313b667a1de2d56573bcf98d43fd0d4ff9
SHA512 846776b1d908b5204667715ffdfd3a6c76dface1677e8b1e5156ceac2ef0a739f68b48ccbb919c9e08d6ff359a93174bf0b90def7d48cee54cd3c41d8d8575f2
SSDEEP 768:oY6+2hD1lu3SFh80Z9pe7nJRJ3QN8DOUVowlo+J:76xhZlM0h/9panJ73CSFl
TLSH
T1F8137D117C8285F3C59A457962D91F575B3F66001BF580871FFA1A6EAF372E0AA3E302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess CloseHandle OpenProcess FreeLibrary LoadLibraryA GetProcAddress GetVersionExA HeapFree HeapAlloc GetProcessHeap GlobalFree lstrcpyA lstrcpynA GlobalAlloc HeapSize GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetCurrentThreadId GetCommandLineA VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery LCMapStringA WideCharToMultiByte MultiByteToWideChar GetLastError LCMapStringW TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetModuleHandleA ExitProcess GetCurrentProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter WriteFile LeaveCriticalSection EnterCriticalSection HeapReAlloc GetLocaleInfoA GetCPInfo GetStringTypeA GetStringTypeW RtlUnwind GetACP GetOEMCP InterlockedExchange InitializeCriticalSection

user32

wsprintfA

ws2_32

inet_addr

wininet

InternetGetCookieA

iphlpapi

GetAdaptersInfo

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BomulBoxC.exe

IMPHASH 8a91d74798e164d07ad05b737ee02eb4
SHA256 22e20debb0b8d4de152ef122e11cbef1d94d8df74b99a96c3b6afa8ca14a2e85
MD5 5bcd355f7594869c3df982f0b6092e89
SHA1 3c19ee9e83eb26da2ccca276817667642e734b8d
SHA512 5dc8dd48c7b98b1ea485b30c29140c86ee9a285319bfc873c9599e2327425cbb72111b656b08805d143d476fa4717b7e38e441f1f29a24429a439d054fccd3b5
SSDEEP 6144:EVjPCGHUYoWwgkbRUCNgsF0NywJWvAf1WTvCZ3jvyJiTcPDqlzIEAJg80SoQD2dk:8jpZkNlNgy29WTvCxLy0TjZAe80So+j
TLSH
T1FDF46A0177F1C1F6C68286320DBB931963B2FE965B24AAC737D83B5F9E351D16A38211
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

8f:94:97:9f:2a:a5:2b:b4:07:2f:44:4f:9d:8f:91:ae

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=TGSM Inc.,OU=Dev Team,O=TGSM Inc.,L=Haeundae-gu,ST=Busan,C=KR

Chains

Jan 1, 0001

Subject

CN=TGSM Inc.,OU=Dev Team,O=TGSM Inc.,L=Haeundae-gu,ST=Busan,C=KR

Serial Number

65:5f:3e:af:0d:3e:7a:56:0b:41:5f:fe:56:11:af:dd

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 14, 2009 - Feb 12, 2011

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

Major OS version

Entry point

282889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\WORK\MONE\PROGRAM\WEBHARD\BomulBox\Src\Windows\BomulBoxUpdate\release\BomulBoxC.pdb

kernel32

GlobalFindAtomA GlobalGetAtomNameA GetModuleFileNameW GlobalFlags TlsGetValue GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree InterlockedIncrement GetFileTime SetErrorMode GetCPInfo GetOEMCP GetSystemTimeAsFileTime ExitThread CreateThread VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RtlUnwind ExitProcess RaiseException GlobalAddAtomA lstrcmpW GetACP GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW GetStdHandle HeapDestroy HeapCreate VirtualFree GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount QueryPerformanceCounter GetConsoleCP GetConsoleMode WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA SetStdHandle GetCurrentProcessId GetFullPathNameA GetVolumeInformationA GetThreadLocale SetEndOfFile UnlockFile LockFile FormatMessageA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MulDiv GetPrivateProfileStringA WritePrivateProfileStringA FreeResource GetCurrentThread ConvertDefaultLocale GetModuleFileNameA EnumResourceLanguagesA GetLocaleInfoA GlobalDeleteAtom FindClose FindFirstFileA SetFileTime SetFileAttributesA DosDateTimeToFileTime GetCurrentDirectoryA SystemTimeToFileTime SetFilePointer GetFileType GetCurrentProcess DuplicateHandle FlushFileBuffers InterlockedDecrement GlobalFree GlobalReAlloc GlobalUnlock GlobalLock GlobalAlloc lstrcpynA GetModuleHandleA SetLastError GetProcAddress FreeLibrary LoadLibraryA GetVersion CompareStringA InterlockedExchange CompareStringW lstrlenA TerminateThread IsBadWritePtr IsBadReadPtr lstrcpynW FileTimeToSystemTime FileTimeToLocalFileTime lstrcmpA lstrcpyW LocalFree LocalAlloc HeapFree GetProcessHeap HeapAlloc WriteFile MultiByteToWideChar CreateDirectoryA GetSystemDirectoryA TerminateProcess GetTickCount DeleteFileA ReadFile GetFileSize CreateFileA GetCurrentThreadId WaitForSingleObject GetVersionExA GetFileAttributesA GetWindowsDirectoryA GetTempPathA SetCurrentDirectoryA Sleep OutputDebugStringA CloseHandle GetLastError CreateMutexA FindResourceA LoadResource LockResource SizeofResource HeapSize WideCharToMultiByte

user32

PostThreadMessageA CopyAcceleratorTableA CharNextA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA DestroyMenu SendDlgItemMessageA WinHelpA IsChild GetClassLongA SetPropA GetPropA RemovePropA GetWindowTextLengthA GetWindowTextA GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos GetMenu CreateWindowExA GetClassInfoExA RegisterClassA AdjustWindowRectEx EqualRect GetScrollInfo SetScrollInfo GetDlgCtrlID CallWindowProcA IntersectRect GetWindowPlacement GetLastActivePopup SetWindowsHookExA CallNextHookEx GetMessageA ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuA EnableMenuItem CheckMenuItem GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EndPaint BeginPaint GetWindowDC GrayStringA DrawTextExA DrawTextA TabbedTextOutA SetActiveWindow CreateDialogIndirectParamA DestroyWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem EndDialog SetWindowContextHelpId MapDialogRect SetWindowPos PostQuitMessage SetWindowLongA FindWindowA SetWindowRgn LoadBitmapA GetActiveWindow PeekMessageA TranslateMessage DispatchMessageA MessageBoxA WindowFromPoint GetCapture GetAsyncKeyState IsRectEmpty UpdateWindow OffsetRect FrameRect FillRect RegisterWindowMessageA RedrawWindow LockWindowUpdate RegisterClipboardFormatA ClientToScreen SetCursor InvalidateRgn UnregisterClassA GetSysColorBrush MessageBeep GetNextDlgGroupItem GetKeyState GetClassNameA GetWindowThreadProcessId GetForegroundWindow SetForegroundWindow BringWindowToTop SetFocus GetDesktopWindow GetWindow IsWindow IsWindowVisible GetParent LoadIconA GetSystemMenu AppendMenuA SetTimer CopyRect KillTimer IsIconic GetSystemMetrics GetClientRect DrawIcon SendMessageA EnableWindow CharUpperA GetClassInfoA DefWindowProcA LoadCursorA GetWindowLongA InflateRect GetSysColor DrawFrameControl ShowScrollBar SetRect ReleaseCapture SetCapture ReleaseDC GetDC ScreenToClient GetCursorPos PostMessageA SystemParametersInfoA GetWindowRect InvalidateRect PtInRect GetFocus MapWindowPoints

gdi32

GetDeviceCaps CreatePen CreateRectRgnIndirect GetBkColor GetTextColor GetRgnBox ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutA TextOutA RectVisible PtVisible MoveToEx LineTo GetClipBox SetTextColor SetBkMode RestoreDC SaveDC CombineRgn ExtCreateRegion CreateDIBSection StretchBlt DeleteDC SetBkColor GetMapMode SetMapMode CreateCompatibleBitmap CreateBitmap DPtoLP DeleteObject GetCurrentObject CreateRectRgn BitBlt CreateCompatibleDC GetTextExtentPoint32A SelectObject Rectangle GetObjectA CreateFontIndirectA GetWindowExtEx GetViewportExtEx SelectClipRgn CreateSolidBrush CreateFontA GetStockObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

advapi32

RegCreateKeyExA RegFlushKey RegCloseKey RegDeleteKeyA RegOpenKeyExA RegDeleteValueA RegQueryValueExA RegSetValueExA RegOpenKeyA RegQueryValueA RegEnumKeyA

shell32

ShellExecuteA ShellExecuteExA SHGetMalloc ExtractIconA SHGetSpecialFolderPathA

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCA PathFindFileNameA PathStripToRootA UrlUnescapeA PathFindExtensionA

oledlg

ord8

ole32

CoRegisterMessageFilter CoInitialize CoCreateInstance CoUninitialize OleRun CLSIDFromProgID CLSIDFromString CoTaskMemFree OleFlushClipboard OleIsCurrentClipboard CoTaskMemAlloc CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject

oleaut32

SysStringByteLen SysFreeString VariantInit VariantCopy VariantClear SysAllocString VariantChangeType SysAllocStringLen SysStringLen OleCreateFontIndirect VariantTimeToSystemTime SystemTimeToVariantTime SafeArrayDestroy GetErrorInfo SysAllocStringByteLen

urlmon

URLDownloadToFileA

crypt32

CryptDecodeObject CertFreeCertificateContext CryptMsgGetParam CertFindCertificateInStore CertCloseStore CryptMsgClose CertGetNameStringA CryptQueryObject

iphlpapi

GetAdaptersInfo

ws2_32

inet_addr

wininet

DeleteUrlCacheEntry InternetGetCookieA HttpOpenRequestA InternetOpenUrlA InternetConnectA HttpSendRequestA InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallback InternetOpenA InternetGetLastResponseInfoA InternetCloseHandle HttpQueryInfoA InternetQueryDataAvailable InternetSetOptionExA InternetQueryOptionA InternetCanonicalizeUrlA InternetCrackUrlA

UninstallExpressService.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 c25c6f5d71bc86cbc6c1ba8a4232b00f2563d24bef74d4f7320ffbe179ac926c
MD5 8d96315a729fd0739faa862ef3021b43
SHA1 3091144193a3e187fb9722d87bae5b8511169e10
SHA512 b9061900803442ee727b780d12da7d3a4a1b17f4abb222b276b4829db8732a954cad4e5c5f0b908ba17f5bcc7149c310132fed6913181101f0ce6a344070bf50
SSDEEP 768:oHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJRJRnod:opgpHzb9dZVX9fHMvG0D3XJGd
TLSH
T100E28F1B79C08DBBD9D3463106B7B77DEBBBC2C902525A034B782F7E3D614538A09296
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Gofot.crg.d10d3347530959aa15ac35ffebf2e4d7

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/KillProcDLL.dll

kernel32

user32

ws2_32

wininet

iphlpapi

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

BomulBoxC.exe

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

crypt32

iphlpapi

ws2_32

wininet

generic

Uninstall.exe.nsis

UninstallExpressService.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic