Overview

overview

10

Static

static

10

ed03f8136c...18.exe

windows7-x64

7

ed03f8136c...18.exe

windows10-2004-x64

7

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...ry.dll

windows7-x64

3

$PLUGINSDI...ry.dll

windows10-2004-x64

3

$TEMP/v.vbs

windows7-x64

3

$TEMP/v.vbs

windows10-2004-x64

3

$TEMP/xcmd.exe

windows7-x64

9

$TEMP/xcmd.exe

windows10-2004-x64

9

$_48_/$APP...md.exe

windows7-x64

9

$_48_/$APP...md.exe

windows10-2004-x64

9

$_48_/1.html

windows7-x64

6

$_48_/1.html

windows10-2004-x64

1

$_48_/3.bat

windows7-x64

1

$_48_/3.bat

windows10-2004-x64

1

$_48_/3.vbs

windows7-x64

4

$_48_/3.vbs

windows10-2004-x64

7

$_48_/qq.vbs

windows7-x64

3

$_48_/qq.vbs

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed03f8136c974575f1995a02588027fd_JaffaCakes118

  • Size

    1.0MB

  • MD5

    ed03f8136c974575f1995a02588027fd

  • SHA1

    6938361bcdb6464efa695314f823099edf64ceb7

  • SHA256

    1cb6977c6c4553ff7842af9205760e5c5958a85ffb3db2c1e94c69fcd0f0a347

  • SHA512

    62fcd214537cff84a4259fdaed385c468a97ca7ff00d573291314b96491ac638db5911f09ab7dd76f963f6edf34f913f53ed7397547d4c71d83b568ddb5ae0bf

  • SSDEEP

    24576:UsKpBnGtQcAw9VgfMWbo+1/h54/GBshHvPM1NbwlJULneh:UdBnGtQ1jT0+rGA8H3M1NbwlWLneh

Score
10/10
upx

Malware Config

Signatures

  • Nirsoft 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • ed03f8136c974575f1995a02588027fd_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InetLoad.dll
    .dll windows:4 windows x86 arch:x86

    24a4a671f5cc294ce3543d18a1e873cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MakeDll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsRandom.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    cd53277eaa7bbb8fb5b2b678274dcb4e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/v.txt
    .vbs
  • $TEMP/xcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_48_/$APPDATA/$_49_
  • $_48_/$APPDATA/xcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_48_/$DESKTOP/$_49_
  • $_48_/$STARTMENU/$_49_
  • $_48_/$SYSDIR/game.ico
  • $_48_/$SYSDIR/taobao.ico
  • $_48_/1.html
  • $_48_/3.bat
  • $_48_/3.vbs
    .vbs
  • $_48_/game.ico
  • $_48_/qq
    .vbs
  • $_48_/qq.ico
  • $_48_/taobao.ico
  • $_48_/v.txt
    .vbs
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • oem.ini
  • ֮.exe
    .exe windows:4 windows x86 arch:x86

    529e31f77e52cbf0a3f800a64416df7b


    Code Sign

    Headers

    Imports

    Sections

  • ֮.ini