jaffacakes118_Trojan[.]Win32[.]DNSChanger[.]ueb[.]44011ceb23845d7661dee777d2b6b7de

resource	yara_rule
static1/unpack001/$TEMP/UnRAR.exe	upx

resource
jaffacakes118_Trojan.Win32.DNSChanger.ueb.44011ceb23845d7661dee777d2b6b7de
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack002/01.exe
unpack001/$TEMP/UnRAR.exe
unpack003/out.upx
unpack001/Uninstall.exe

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_1

jaffacakes118_Trojan.Win32.DNSChanger.ueb.44011ceb23845d7661dee777d2b6b7de

IMPHASH 9c523d8653da5455667e3f82274f2f88
SHA256 2bbb6f476b32c5afabd570306b1f7675b0c32348e9a4d624c07e569c58111ba3
MD5 44011ceb23845d7661dee777d2b6b7de
SHA1 40a34e8483ad426acc332ab9e4d50e0a7f5e3078
SHA512 7e08c4d25581c3ca3ec1123481f374bfe4cee58e1fff016fffb3a42c46ca1ccb64d7ecbbbcd90b029081a1752a7835b4e505d0ed38c5443586c1e72da4bc6670
SSDEEP 3072:nbLpZuEskJoU4VQi1wX7hWleUuA+CEPkC8R3lno2TIrd4YWG/oIMysHkoSL:nbOO2h128Pzbbo2Tey4hFsEoSL
TLSH
T177141287B3D0D4F3D7430670CDBBCBA3E2F6660016946B835B659F7E5EB62A31926084
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount lstrcmpiA CopyFileA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCurrentProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/StartMenu.dll

IMPHASH 28d94e5199b88ad374b3cb2118e31a66
SHA256 a5c5012191015659684fc19b5e8ec7d33837b25c607f0f9dbfd46c10b8baeb17
MD5 a6978ea99297c941d02d88fa873150d9
SHA1 4e1fd5c2f7291daef4d817b12bc7bfa432a90013
SHA512 8caf697317e6f9e83bbb0ee15a87ec56be3b08aaea9f7fb64fa65dd111bcfde5a8d25c7ef58fa1aa464ba5f9d4e365d9d8d3763cda17b4f3223418adf9a25000
SSDEEP 96:g1C0Qaep2wbE+WH1/FMXF6CGQhFzK1KQ5YnhElMmV4d:4ep2w5k/FyEt2gN
TLSH
T117D1E8B6F3C184F3CA47533079A7BF136B699A312325B253915766CAB5834E3EE20312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6359

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 8e58b3e6e3896a4bae05fa2f6adc238d391aa80bc51c138f851f373c6c23e518
MD5 eadf80c79f88337c58ca0fb5032cb579
SHA1 523d7118a3755790eaddd6e99f7b3814e97d47d0
SHA512 ed612cda75f4b345c1405be33575a0060d6399654d66356e8102ec82a057497ef7dc99906132bd729ae793e7fc4f46cdbd57256fca567a056bed642c1d58b7ed
SSDEEP 192:6K3Taw+vLvvswRvyb7qY1eL5qDJD8CUNObWF/U0p3+i8Esub:6MOLzYQdqDJHsxcWPX
TLSH
T1681207AEAF1C6F539E71D2D9EA21188D1902861CF51ACEEC7E8F24055763B54267CFC0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsExec.dll

IMPHASH f835ad7f9363dc017c6826af3baa9002
SHA256 8a8bce943b78093ecd86a42c203931ee625f445acf5cb5b705e3b7eaf29c7110
MD5 03a1a9be1f1e72f926ec9161825eedd6
SHA1 d0574bafc615168c021788d413a3a73d275c492d
SHA512 8d82e15ee109d2236a995990fdd0c9fb39c9d3c4dea1c063f0806314e7a9d09a112f4f09091c265adba9f86ec7a0977294cce112e20ffb2f8b3ad62ab3dac396
SSDEEP 96:GCX1XJXT0HmzbGVBHdMeLTOKcbI2NaeI0YqNnqN3rCUTEVX6pbc:GQx1YHm3GVBHd3OKcbIs1zEZrCUTEVXu
TLSH
T1E3C1F9B7B6D23DF2C74E0A767C11206757B4D4241B680144EEB717C27A92EA3EC3528E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/00.exe

SHA256 ea71575689ddc67b34c58b494efa11178dadf7285e6974b03c270e40b587758c
MD5 208f131098fe3119c94421960df742fd
SHA1 95e1dbb67640056652270d8a1240532e9bc3c129
SHA512 28e36b27396e2ae19b6976f829750643f319ad2732234802863727d72990fd066587398904afabc2535c9480dc38a5b2d96c8fab2297258db702ad63f1df39be
SSDEEP 768:RuRnF/ZdaRy9OfmYkQsBVXZV/HBtwxmJ8iV3P5ERp1Ajk:RuRFxdamimc+VXZRhtwIJ8i7EKk
TLSH
T11CE2E1A7E423B0116F16979B0587C0FEC255C128DF6B8DC5458767FE8A58E13045FEB4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

01.exe

SHA256 1c0f271fdda1c1c548bed595414ac25d1153d63391ed8470a41c8befacd2e370
MD5 8908576d33b9df4414009550f2b5f8dc
SHA1 7b9173eada8fb71a642b5fc3cebb0063915a2dd1
SHA512 82fa8d692b474cf0ac66abe562e1990161e3823c059821583b58872bbc9ed16938e88dc2f47aee587b733f6ec49b62e31a6ef866b29dcd072f7d3f58ae88d0b1
SSDEEP 1536:WjIrMWnx+0M1TSzOCyk2GIyFcu8HTW+bPcqElBPCRqG:XrL+0M1TuOCykMyWt77cqElxC7
TLSH
T149535DB5C4C87C88E1E2C5F9EF38E6900E4397659658F443B5C8B96B07735FAA840CB9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/UnRAR.exe

SHA256 264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac
MD5 d87ddf597baf91e7d32b20c0b4d855da
SHA1 4e855b5c03e0a52d8057bc86b83a07f10d00e455
SHA512 f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26
SSDEEP 1536:SLNbEpkAr56pGQp79iBtHDAUrtSGk2/DpZw9NyotCMU6KeTI3l0yB6AbSt:SLNbpA96779iB5DAUrAt08yofKeMl5n
TLSH
T16793020AC654DDF7C95D82BC1ABE4C65035BC3A133968BC79402D99DFD543F06B9A908
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

264112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 d0d51acaf8d539f7fb76c22a0308f737a43eb17db08c399679757e643439decb
MD5 e58a29ac171e926e303b9457004a456a
SHA1 8f792d1fb1c40d6a25b99aeba3cf32e5ea403227
SHA512 0fbad2c40f4832780214be22f1bdc5c30a643459f8e433aef6aee4e6b7a8aded576bfcde673d4df5dd0f79cf7884c4159215ec18140a01c548a3e0b1dc091faa
SSDEEP 6144:tYeCJqjZpzd7s8tb/EcWZbApTDlqehG6+0O:tYeCJqjZpzKPEJ1O
TLSH
T157145C1BFA96C171D05086701E9B9AF3A13BBB00377192D2839F6C35BEA7131761939B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

147KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Uninstall.exe

IMPHASH 9c523d8653da5455667e3f82274f2f88
SHA256 464501b3de7998f744445fc8d2726be863bcf3664890626b7d76eb899c9fa1a9
MD5 096578e242a6f64905878911123f9981
SHA1 b69fcc30ca2cd36f2914f8898af3c5c06b3f75d8
SHA512 ec21b3aab24bc97efa8f81c0b681d22531505680d98a2c967facc996ef9d655322825759af5ab2d7ef1d220a8135c32e9316f924a339835134957e2646c6e885
SSDEEP 768:UebbuV4LlKWVJd9dxVh1qAOYwXzBx2JqF86eWkJN+eJRn5Am6kRRJ2iZ3igLiOa:nbSqZVJdThUxmskJoqAELVigLij
TLSH
T1C933AF2B37C0D8B7CB97477149B7A7BAF7B2A610011157931B908FBFA9B5282CE05187
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount lstrcmpiA CopyFileA ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCurrentProcess

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/modern-header.bmp

SHA256 8e58b3e6e3896a4bae05fa2f6adc238d391aa80bc51c138f851f373c6c23e518
MD5 eadf80c79f88337c58ca0fb5032cb579
SHA1 523d7118a3755790eaddd6e99f7b3814e97d47d0
SHA512 ed612cda75f4b345c1405be33575a0060d6399654d66356e8102ec82a057497ef7dc99906132bd729ae793e7fc4f46cdbd57256fca567a056bed642c1d58b7ed
SSDEEP 192:6K3Taw+vLvvswRvyb7qY1eL5qDJD8CUNObWF/U0p3+i8Esub:6MOLzYQdqDJHsxcWPX
TLSH
T1681207AEAF1C6F539E71D2D9EA21188D1902861CF51ACEEC7E8F24055763B54267CFC0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

jaffacakes118_Trojan.Win32.DNSChanger.ueb.44011ceb23845d7661dee777d2b6b7de

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/00.exe

01.exe

generic

$TEMP/UnRAR.exe

generic

out.upx

generic

Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/modern-header.bmp

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.DNSChanger.ueb.44011ceb23845d7661dee777d2b6b7de

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/00.exe

01.exe

generic

$TEMP/UnRAR.exe

generic

out.upx

generic

Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/modern-header.bmp