Overview

overview

7

Static

static

7

setup.exe

windows7-x64

7

setup.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

Easy_Burning.exe

windows7-x64

7

Easy_Burning.exe

windows10-2004-x64

7

Uninst Eas...ng.exe

windows7-x64

7

Uninst Eas...ng.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

VisualISO.exe

windows7-x64

3

VisualISO.exe

windows10-2004-x64

3

cdrecord.exe

windows7-x64

7

cdrecord.exe

windows10-2004-x64

7

check_file.exe

windows7-x64

7

check_file.exe

windows10-2004-x64

7

compare.exe

windows7-x64

1

compare.exe

windows10-2004-x64

1

cygwin1.dll

windows7-x64

7

cygwin1.dll

windows10-2004-x64

7

info.html

windows7-x64

1

info.html

windows10-2004-x64

1

language.exe

windows7-x64

7

language.exe

windows10-2004-x64

7

mkisofs.exe

windows7-x64

7

mkisofs.exe

windows10-2004-x64

7

problem.pdf

windows7-x64

1

problem.pdf

windows10-2004-x64

1

sh.exe

windows7-x64

7

sh.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8cf104087e0379599cdcc28cc8baa04_JaffaCakes118

  • Size

    1.5MB

  • MD5

    f8cf104087e0379599cdcc28cc8baa04

  • SHA1

    4060dc796bb80862651fdbf90fdb33f30293125a

  • SHA256

    965616976ed28bffd24f8316ba6bad5d6008dc511c757643f038bc6c57c37e2b

  • SHA512

    5da8d36b3dde390db4c9caac5a3ca9dab4da3c6c9a00d4973a57ac97113252d18da0cc164ca636d41ccb6145599f3c35779648d2382c5fea850985f173a4f9a3

  • SSDEEP

    24576:C0r1fFj4TFh6+K8UTps4E2F/fgAXxcN0LJey60dU4z2N3lAOEIST29QrVpS7N/nX:Dr1tcTp4XgABcf6dUx3lbE32KhpkN/nX

Score
7/10
pdflinkupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

Files

  • f8cf104087e0379599cdcc28cc8baa04_JaffaCakes118
    .rar
  • file_id.diz
  • setup.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Easy_Burning.exe
    .exe windows:4 windows x86 arch:x86

    f424ea085243e561c786308a0bf15646


    Headers

    Imports

    Sections

  • Uninst Easy_Burning.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • VisualISO.exe
    .exe windows:4 windows x86 arch:x86

    f2b5224d1722450654e9192cb2ae83e3


    Headers

    Imports

    Sections

  • cdrecord.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • check_file.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • compare.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • cygwin1.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • fifo.cfg
  • file_id.diz
  • info.html
    .html
  • language.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • language/catalan.lng
  • language/danish.lng
  • language/deutsch.lng
  • language/english.lng
  • language/finnish.lng
  • language/french.lng
  • language/galician.lng
  • language/hungarian.lng
  • language/italian.lng
  • language/japanese.lng
  • language/korean.lng
  • language/macedonian.lng
  • language/nederlands.lng
  • language/polish.lng
  • language/portuguese.lng
  • language/russian.lng
  • language/sc.lng
  • language/spanish.lng
  • language/translation_info.txt
  • language/ukrainian.lng
  • license.txt
  • mkisofs.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • problem.pdf
    .pdf

    • http://www.nu2.nu/aspiUnder

    • http://forum.paehl.de

  • prodvd.key
  • readme_first.txt
  • sh.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • trans.txt
  • translate.txt
  • visualiso.chm
    .chm
  • 下载说明.htm
    .html .js polyglot