General

  • Target

    f67dba25dad60a4d7752e7830eae88dc_JaffaCakes118

  • Size

    2.9MB

  • MD5

    f67dba25dad60a4d7752e7830eae88dc

  • SHA1

    015d7f72482f89f4d0612234a461fc755760032a

  • SHA256

    5ccc733e11380913ca33a2611588d720afba172ed88ecc2becceedd9507d69ea

  • SHA512

    280ef9cfa3e2b829fc4abcacef22e5aaf04f85e7ef3943065cff6d1e8a31b7aced11f409162e76a876c41b7da227c0098d721352387b59bb5efb34153d3ba552

  • SSDEEP

    49152:fVhmPBz6fX/OdBfPEYv17z0rVzOJ+SZRvlHNMoCn3jzPHesCtF8eNosIYEvdVFuI:zC0Xa33vwzObvlNq3jRCt+7nJYif

Score
8/10

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • f67dba25dad60a4d7752e7830eae88dc_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    135de77644e2add2fd9dd8176740e7e0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • @Install_̻.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Headers

    Imports

    Sections

  • @Install_̻.ico
  • @Uninstall_ж.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Headers

    Imports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • aopr.chm
    .chm
  • aopr.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • aopr.pwc
  • charsets/arabic.chr
  • charsets/armenian.chr
  • charsets/czech (all letters).chr
  • charsets/czech (caps letters).chr
  • charsets/czech (small letters).chr
  • charsets/french (all letters).chr
  • charsets/french (caps letters).chr
  • charsets/french (small letters).chr
  • charsets/german (all letters).chr
  • charsets/german (caps letters).chr
  • charsets/german (small letters).chr
  • charsets/greek (all symbols).chr
  • charsets/greek (letters only).chr
  • charsets/hebrew.chr
  • charsets/japanese (hiragana).chr
  • charsets/japanese (katakana).chr
  • charsets/japanese.chr
  • charsets/korean (hangul jamo).chr
  • charsets/russian (cyrillic).chr
  • elcom_lang.xml
  • elcom_partners.exml
  • elcom_reg.dll
    .dll windows:5 windows x86 arch:x86

    2fafdab49d262681fedbc6f0af4ad166


    Headers

    Imports

    Exports

    Sections

  • elcom_xml.dll
    .dll windows:4 windows x86 arch:x86

    d054730b3b6bf4b9a8763e5fe56838d3


    Headers

    Imports

    Exports

    Sections

  • english.dic
  • english.lng
  • english.tip
  • file_id.diz
  • german.dic
  • german.lng
  • german.tip
  • license.doc
    .doc windows office2003

    ThisDocument

  • order.txt
  • partner.xml
    .xml
  • readme.txt
  • rungame.ini
  • russian.dic
  • russian.lng
  • Ϸ_Դվ-cngr.cn.url
    .url
  • .lng
  • .tip
  • ˵.txt
  • Ա.url
    .url