Overview

overview

3

Static

static

3

FreePOPs-0...sl.exe

windows7-x64

3

FreePOPs-0...sl.exe

windows10-2004-x64

3

$SYSDIR/lw...st.dll

windows7-x64

1

$SYSDIR/lw...st.dll

windows10-2004-x64

1

C/updater_fltk.dll

windows7-x64

1

C/updater_fltk.dll

windows10-2004-x64

1

LUA/abv.js

windows7-x64

1

LUA/abv.js

windows10-2004-x64

1

LUA/aol.js

windows7-x64

1

LUA/aol.js

windows10-2004-x64

1

LUA/browse...ser.js

windows7-x64

1

LUA/browse...ser.js

windows10-2004-x64

1

LUA/common.js

windows7-x64

1

LUA/common.js

windows10-2004-x64

1

LUA/fastmail.js

windows7-x64

1

LUA/fastmail.js

windows10-2004-x64

1

LUA/freepops.js

windows7-x64

1

LUA/freepops.js

windows10-2004-x64

1

LUA/gmail.js

windows7-x64

1

LUA/gmail.js

windows10-2004-x64

1

LUA/libero.js

windows7-x64

1

LUA/libero.js

windows10-2004-x64

1

LUA/lycos.js

windows7-x64

1

LUA/lycos.js

windows10-2004-x64

1

LUA/mailcom.js

windows7-x64

1

LUA/mailcom.js

windows10-2004-x64

1

LUA/mimer.js

windows7-x64

1

LUA/mimer.js

windows10-2004-x64

1

LUA/monitor.js

windows7-x64

1

LUA/monitor.js

windows10-2004-x64

1

LUA/netscape.js

windows7-x64

1

LUA/netscape.js

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    f74563f0ba0d72b7565c70e8d595bf9c_JaffaCakes118

  • Size

    1.2MB

  • MD5

    f74563f0ba0d72b7565c70e8d595bf9c

  • SHA1

    3b9214e68cba40899bf8df01108b6c04a1ee0e01

  • SHA256

    32a581c19d4e0ca5335354cd6d6ff1b5f11119c462663f24d38c52d6ca8f154b

  • SHA512

    23287aa4a78c04966465cc10c2967a62e48bf5ff0c86ae64b20418f678783f1977314577853af7cfb512788eff5888a6f4f626e5c89c8c02f85ee9e207c48edf

  • SSDEEP

    24576:VbXyUelg7r7aT8RZR3eIwOvqoHQxe1AjncgI9rFf+O:V2uX8EL7vlQjjns9rJx

Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

Files

  • f74563f0ba0d72b7565c70e8d595bf9c_JaffaCakes118
    .rar
  • FreePOPs-0.2.9-openssl.exe
    .exe windows:4 windows x86 arch:x86

    28a099a911237a28521d8b7ea250f089


    Headers

    Imports

    Sections

  • $SYSDIR/lwel-manifest.dll
    .dll windows:4 windows x86 arch:x86

    3e9fc6603c77b7a36b77e352ce19ac3a


    Headers

    Imports

    Sections

  • C/updater_fltk.dll
    .dll windows:4 windows x86 arch:x86

    58b500ff40a151f0e96c2bb4a925420b


    Headers

    Imports

    Exports

    Sections

  • COPYING.txt
  • ChangeLog.txt
  • LANG/it/LC_MESSAGES/updater_fltk.mo
  • LUA/abv.lua
    .js
  • LUA/aggregator.lua
  • LUA/aol.lua
    .js
  • LUA/browser/browser.lua
    .js
  • LUA/browser/cookie.lua
  • LUA/common.lua
    .js
  • LUA/davmail.lua
  • LUA/excite.lua
  • LUA/fastmail.lua
    .js
  • LUA/flatnuke.lua
  • LUA/foo.lua
  • LUA/freepops.lua
    .js
  • LUA/gmail.lua
    .js
  • LUA/hotmail.lua
  • LUA/httpmail.lua
  • LUA/juno.lua
  • LUA/kernel.lua
  • LUA/libero.lua
    .js
  • LUA/lxp/lom.lua
  • LUA/lycos.lua
    .js
  • LUA/mail2world.lua
  • LUA/mailcom.lua
    .js
  • LUA/mimer.lua
    .js
  • LUA/monitor.lua
    .js
  • LUA/netscape.lua
    .js
  • LUA/orange.lua
    .js
  • LUA/plugins2xml.lua
    .js
  • LUA/popforward.lua
    .js
  • LUA/psock.lua
    .js
  • LUA/serial.lua
  • LUA/skeleton.lua
  • LUA/smartlog.lua
    .js
  • LUA/soap/http.lua
  • LUA/soap/soap.lua
    .js
  • LUA/socket.lua
    .js
  • LUA/softhome.lua
  • LUA/squirrelmail.lua
    .js
  • LUA/supereva.lua
  • LUA/support.lua
    .js
  • LUA/table2xml.lua
  • LUA/tin.lua
  • LUA/tre.lua
    .js
  • LUA/updater.lua
    .js
  • LUA/updater_common.lua
    .js
  • LUA/updater_php.lua
  • LUA/version_comparer.lua
  • LUA/wel.lua
    .js
  • LUA/xml2table.lua
    .js
  • LUA/xml2tex.lua
  • LUA/yahoo.lua
  • README.FPM.en.txt
  • README.FPM.it.txt
  • SERVICE.en.txt
  • SERVICE.it.txt
  • config.lua
  • cryptoeay32.dll
    .dll windows:4 windows x86 arch:x86

    6b0226b247a63b704e8b848ba109cd7c


    Headers

    Imports

    Exports

    Sections

  • freepops-remove.ico
  • freepops-setup.ico
  • freepops-updater.ico
  • freepopsd.exe
    .exe windows:4 windows x86 arch:x86

    fc8b20c19ecbcd5156a3a9f637cc435f


    Headers

    Imports

    Sections

  • freepopsd.vbs
    .vbs
  • freepopsservice.exe
    .exe windows:4 windows x86 arch:x86

    a8f68744af3895e05a81f021b367b1b7


    Headers

    Imports

    Sections

  • libcurl-4.dll
    .dll windows:4 windows x86 arch:x86

    5080c0696e138401ee34629b48a4b67b


    Headers

    Imports

    Exports

    Sections

  • libexpat.dll
    .dll windows:4 windows x86 arch:x86

    949cd0bc40dc11131d835ad009dd4440


    Headers

    Imports

    Exports

    Sections

  • libfp.dll
    .dll windows:4 windows x86 arch:x86

    5b9d871caf685d037691cb22ae67ba9c


    Headers

    Imports

    Exports

    Sections

  • libintl-8.dll
    .dll windows:4 windows x86 arch:x86

    0175c607cd921398aaa6a388db3509da


    Headers

    Imports

    Exports

    Sections

  • libpthread.dll
    .dll windows:4 windows x86 arch:x86

    af761163145145ee337e8fe118e98a10


    Headers

    Imports

    Exports

    Sections

  • libz.dll
    .dll windows:4 windows x86 arch:x86

    dc941e396315cb180b5b839e2e0c5090


    Headers

    Imports

    Exports

    Sections

  • lwel-manifest.dll
    .dll windows:4 windows x86 arch:x86

    3e9fc6603c77b7a36b77e352ce19ac3a


    Headers

    Imports

    Sections

  • ssleay32.dll
    .dll windows:4 windows x86 arch:x86

    f6b6e526746878a96c23bffe06153d14


    Headers

    Imports

    Exports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    28a099a911237a28521d8b7ea250f089


    Headers

    Imports

    Sections

  • 新云软件.url
    .url