General

  • Target

    fa0128e6aa25ea80c58db440067bbf75_JaffaCakes118

  • Size

    2.4MB

  • MD5

    fa0128e6aa25ea80c58db440067bbf75

  • SHA1

    e043046dc3380e2e3954354313d3e47e46be2d29

  • SHA256

    b0ddc63c506ee92d417679c07285de289e44979b1fda460bfd7578288252ab89

  • SHA512

    ae0cfc9000cc509367bd6585e6c96988a6ef33ea3ae630e0f2cf092c7289b3c95a22465720ce7e125975d7f3be516f4e1bc63fd7e54b796bbfc734e9f6262ea3

  • SSDEEP

    49152:QcXn856Z1f6uffQVljCSxqvlR41SMmwFtSNGZJnE8IpNYS:Qf6Z1ZQVljCJNMSeE8Iv

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • fa0128e6aa25ea80c58db440067bbf75_JaffaCakes118
    .rar
  • GHosting.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/recommend.ini
  • 2003safe/antiddos.reg
  • 2003safe/imailno3389.ipsec
  • 2003safe/linbo.sdb
  • 2003safe/port1.bat
  • 2003safe/reg.reg
  • 2003safe/safe1.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 2003safe/safe2.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 2003safe/safe3.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 2003safe/safe4.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 2003safe/sql.sql
  • 404.htm
    .html .js polyglot
  • GHosting.CHM
    .chm
  • GHosting.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/1.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/2.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/3.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/4.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/5.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/6.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/7.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/Rar.exe
    .exe windows:4 windows x86 arch:x86

    ab369c4db94893cbae59850b1a0da0d4


    Headers

    Imports

    Exports

    Sections

  • back/host.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • back/iperf.exe
    .exe windows:4 windows x86 arch:x86

    2a221c4e5ad946ceaf525b6df216102e


    Headers

    Imports

    Sections

  • back/myftp.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • libmysql.dll
    .dll windows:4 windows x86 arch:x86

    228cf40d4f0852fd3dffaa6cf5aaaa05


    Headers

    Imports

    Exports

    Sections

  • mfc71.dll
    .dll windows:4 windows x86 arch:x86

    7397fb8b8633dd76aa9cbc7e2e0c24bd


    Headers

    Imports

    Sections

  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • testing/asp.asp
    .asp .vbs polyglot
  • testing/aspx.aspx
    .asp .vbs polyglot
  • testing/php.php
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Headers

    Imports

    Sections

  • version.ini
  • 新云软件.url
    .url