General

  • Target

    06956d4e1404512c1b2fbfaaa6d208aa_JaffaCakes118

  • Size

    1.7MB

  • MD5

    06956d4e1404512c1b2fbfaaa6d208aa

  • SHA1

    7d6ec7f2a07e087ad24895244ae840414d90cb75

  • SHA256

    ee2994270b42614eb65db99369dbe610a5ddaba06322b56c15280d1d5ec76019

  • SHA512

    c00a3fdfa966c5ae739cf8259473606464dc07b30db5ed40feb3ea85c07c2923085183851cd24986d14cacb489ea80f62b18cd8b7850bf2c3171f3a8bef18181

  • SSDEEP

    49152:+23ZMjkAni5NJ44lClN5OVwlwikOZ+L9bgwWdUB8wI5:+8Mni5NJ46ClN5bkO7UB8f5

Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 06956d4e1404512c1b2fbfaaa6d208aa_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/ortmp/uninstaller.exe
    .exe windows:5 windows x86 arch:x86

    4e4795f534f924da51f16584b7cd5efc


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    6aa1fb50f909cdf4bea3d3523348e900


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/freebl3.dll
    .dll windows:5 windows x86 arch:x86

    f873bae979000fa955d161b528461da5


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/libnspr4.dll
    .dll windows:5 windows x86 arch:x86

    c3ea252fa1435d3841a3253d37e94812


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/libplc4.dll
    .dll windows:5 windows x86 arch:x86

    3891d3dc70cf5d7d26826daf36b8c086


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/libplds4.dll
    .dll windows:5 windows x86 arch:x86

    94ac7479544062cc3d4fec633c5ef59a


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/nss3.dll
    .dll windows:5 windows x86 arch:x86

    056c3dc8dc9919b781028066c7f9d51c


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/nssckbi.dll
    .dll windows:5 windows x86 arch:x86

    5e62360c3269a77afaa830fdada7767b


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/nssdbm3.dll
    .dll windows:5 windows x86 arch:x86

    a5e363ad4a9f58bb0976e299ef467471


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/nssutil3.dll
    .dll windows:5 windows x86 arch:x86

    b3ea12d3f9eed13644f0fc4a733cdc54


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/orion.exe
    .exe windows:5 windows x86 arch:x86

    67e87dc87e5f89fe3cbf43c36ec1cc8a


    Headers

    Imports

    Sections

  • $TEMPfolder/ortmp/smime3.dll
    .dll windows:5 windows x86 arch:x86

    e9f12bd41b659b69cfb5facb9a09bb01


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/softokn3.dll
    .dll .ps1 windows:5 windows x86 arch:x86 polyglot

    44653ae2122bfb7a591e41b1eccba9c8


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/sqlite3.dll
    .dll windows:5 windows x86 arch:x86

    6f383944ad37c3b1c6ab47bdb43092ea


    Headers

    Imports

    Exports

    Sections

  • $TEMPfolder/ortmp/ssl3.dll
    .dll windows:5 windows x86 arch:x86

    669657e3b303bd7906e02a3d3b84c380


    Headers

    Imports

    Exports

    Sections