General

  • Target

    0cb5a3d428c5db610a4565c17e3dc05e_JaffaCakes118

  • Size

    3.7MB

  • MD5

    0cb5a3d428c5db610a4565c17e3dc05e

  • SHA1

    46540b2d5f57fb312cb131751e75fc0a39ca7471

  • SHA256

    4105cfbe86187aa66ed30302be96bc9b3925a7baa5da101f4aa40354b1aa10cf

  • SHA512

    1e2765135bb980d2ca9ad00cc8f754bef8a839c8e20601fff034155284f73bd5a5dfe1e5e03413011a4c11e0d8caefacf98788ae3e585622e9798d0ff47e2a20

  • SSDEEP

    98304:5jatb53wfm3aoBGv94lfUnlRlL4NGm895xf/60w/yjEdD:5j2TfZUnlzeG95VY64D

Score
3/10

Malware Config

Signatures

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • 0cb5a3d428c5db610a4565c17e3dc05e_JaffaCakes118
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Headers

    Imports

    Sections

  • $PLUGINSDIR/INetC.dll
    .dll windows:4 windows x86 arch:x86

    735e27ae3d7df8c0487e4353d04f6f28


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:5 windows x86 arch:x86

    cd90e33ffbc335413a25300c682c83df


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • app.py
    .py .js
  • httpfilter.bin
  • httpfilter.py
  • launchall.py
    .py .js
  • localconfig.json
  • ml.py
    .py .vbs
  • python/DLLs/_ctypes.pyd
    .dll windows:5 windows x86 arch:x86

    acc7a15675979e1bb3298e16aecbb34f


    Headers

    Imports

    Exports

    Sections

  • python/DLLs/_socket.pyd
    .dll .js windows:5 windows x86 arch:x86 polyglot

    e383dec1c760c39c6e88305da21dd8f7


    Headers

    Imports

    Exports

    Sections

  • python/DLLs/_ssl.pyd
    .dll windows:5 windows x86 arch:x86

    a06529bf96457400394751f1ed655a48


    Headers

    Imports

    Exports

    Sections

  • python/DLLs/select.pyd
    .dll windows:5 windows x86 arch:x86

    1a29e10efc54a9291da0e908d2c68818


    Headers

    Imports

    Exports

    Sections

  • python/DLLs/unicodedata.pyd
    .dll windows:5 windows x86 arch:x86

    a01f425d4ee41eb620b69d752384032a


    Headers

    Imports

    Exports

    Sections

  • python/Lib/__future__.py
  • python/Lib/_bootlocale.py
  • python/Lib/_collections_abc.py
  • python/Lib/_compat_pickle.py
  • python/Lib/_dummy_thread.py
  • python/Lib/_sitebuiltins.py
  • python/Lib/_weakrefset.py
  • python/Lib/abc.py
  • python/Lib/argparse.py
    .py .vbs
  • python/Lib/base64.py
  • python/Lib/bisect.py
  • python/Lib/calendar.py
  • python/Lib/codecs.py
  • python/Lib/collections/__init__.py
  • python/Lib/collections/__main__.py
  • python/Lib/collections/abc.py
  • python/Lib/comtypes/GUID.py
  • python/Lib/comtypes/__init__.py
  • python/Lib/comtypes/_comobject.py
  • python/Lib/comtypes/_meta.py
  • python/Lib/comtypes/_safearray.py
  • python/Lib/comtypes/automation.py
  • python/Lib/comtypes/client/__init__.py
    .py .vbs
  • python/Lib/comtypes/client/_code_cache.py
  • python/Lib/comtypes/client/_events.py
    .py .vbs
  • python/Lib/comtypes/client/_generate.py
  • python/Lib/comtypes/client/dynamic.py
  • python/Lib/comtypes/client/lazybind.py
    .py .vbs
  • python/Lib/comtypes/connectionpoints.py
  • python/Lib/comtypes/errorinfo.py
  • python/Lib/comtypes/gen/IWshRuntimeLibrary.py
  • python/Lib/comtypes/gen/_00020430_0000_0000_C000_000000000046_0_2_0.py
  • python/Lib/comtypes/gen/_F935DC20_1CF0_11D0_ADB9_00C04FD58A0B_0_1_0.py
    .py .vbs
  • python/Lib/comtypes/gen/__init__.py
  • python/Lib/comtypes/gen/stdole.py
  • python/Lib/comtypes/git.py
  • python/Lib/comtypes/hresult.py
  • python/Lib/comtypes/logutil.py
  • python/Lib/comtypes/messageloop.py
  • python/Lib/comtypes/npsupport.py
  • python/Lib/comtypes/patcher.py
  • python/Lib/comtypes/persist.py
  • python/Lib/comtypes/safearray.py
    .py .vbs
  • python/Lib/comtypes/server/__init__.py
  • python/Lib/comtypes/server/automation.py
  • python/Lib/comtypes/server/connectionpoints.py
  • python/Lib/comtypes/server/inprocserver.py
  • python/Lib/comtypes/server/localserver.py
  • python/Lib/comtypes/server/register.py
  • python/Lib/comtypes/server/w_getopt.py
  • python/Lib/comtypes/shelllink.py
    .py .vbs
  • python/Lib/comtypes/tools/__init__.py
  • python/Lib/comtypes/tools/codegenerator.py
  • python/Lib/comtypes/tools/tlbparser.py
  • python/Lib/comtypes/tools/typedesc.py
  • python/Lib/comtypes/tools/typedesc_base.py
  • python/Lib/comtypes/typeinfo.py
  • python/Lib/comtypes/util.py
  • python/Lib/comtypes/viewobject.py
  • python/Lib/contextlib.py
  • python/Lib/copy.py
  • python/Lib/copyreg.py
  • python/Lib/ctypes/__init__.py
  • python/Lib/ctypes/_endian.py
  • python/Lib/ctypes/macholib/README.ctypes
  • python/Lib/ctypes/macholib/__init__.py
  • python/Lib/ctypes/macholib/dyld.py
  • python/Lib/ctypes/macholib/dylib.py
  • python/Lib/ctypes/macholib/fetch_macholib
    .sh linux
  • python/Lib/ctypes/macholib/fetch_macholib.bat
  • python/Lib/ctypes/macholib/framework.py
  • python/Lib/ctypes/util.py
  • python/Lib/ctypes/wintypes.py
  • python/Lib/datetime.py
  • python/Lib/decimal.py
  • python/Lib/dummy_threading.py
  • python/Lib/email/__init__.py
  • python/Lib/email/_encoded_words.py
  • python/Lib/email/_header_value_parser.py
  • python/Lib/email/_parseaddr.py
  • python/Lib/email/_policybase.py
  • python/Lib/email/architecture.rst
  • python/Lib/email/base64mime.py
  • python/Lib/email/charset.py
    .py .vbs
  • python/Lib/email/contentmanager.py
  • python/Lib/email/encoders.py
  • python/Lib/email/errors.py
  • python/Lib/email/feedparser.py
  • python/Lib/email/generator.py
  • python/Lib/email/header.py
  • python/Lib/email/headerregistry.py
  • python/Lib/email/iterators.py
  • python/Lib/email/message.py
  • python/Lib/email/mime/application.py
  • python/Lib/email/mime/audio.py
  • python/Lib/email/mime/base.py
  • python/Lib/email/mime/image.py
  • python/Lib/email/mime/message.py
  • python/Lib/email/mime/multipart.py
  • python/Lib/email/mime/nonmultipart.py
  • python/Lib/email/mime/text.py
  • python/Lib/email/parser.py
  • python/Lib/email/policy.py
  • python/Lib/email/quoprimime.py
  • python/Lib/email/utils.py
  • python/Lib/encodings/__init__.py
  • python/Lib/encodings/aliases.py
  • python/Lib/encodings/ascii.py
  • python/Lib/encodings/base64_codec.py
  • python/Lib/encodings/big5.py
  • python/Lib/encodings/big5hkscs.py
  • python/Lib/encodings/bz2_codec.py
  • python/Lib/encodings/charmap.py
  • python/Lib/encodings/cp037.py
  • python/Lib/encodings/cp1006.py
  • python/Lib/encodings/cp1026.py
  • python/Lib/encodings/cp1125.py
  • python/Lib/encodings/cp1140.py
  • python/Lib/encodings/cp1250.py
  • python/Lib/encodings/cp1251.py
  • python/Lib/encodings/cp1252.py
  • python/Lib/encodings/cp1253.py
  • python/Lib/encodings/cp1254.py
  • python/Lib/encodings/cp1255.py
  • python/Lib/encodings/cp1256.py
  • python/Lib/encodings/cp1257.py
  • python/Lib/encodings/cp1258.py
  • python/Lib/encodings/cp273.py
  • python/Lib/encodings/cp424.py
  • python/Lib/encodings/cp437.py
  • python/Lib/encodings/cp500.py
  • python/Lib/encodings/cp65001.py
  • python/Lib/encodings/cp720.py
  • python/Lib/encodings/cp737.py
  • python/Lib/encodings/cp775.py
  • python/Lib/encodings/cp850.py
  • python/Lib/encodings/cp852.py
  • python/Lib/encodings/cp855.py
  • python/Lib/encodings/cp856.py
  • python/Lib/encodings/cp857.py
  • python/Lib/encodings/cp858.py
  • python/Lib/encodings/cp860.py
  • python/Lib/encodings/cp861.py
  • python/Lib/encodings/cp862.py
  • python/Lib/encodings/cp863.py
  • python/Lib/encodings/cp864.py
  • python/Lib/encodings/cp865.py
  • python/Lib/encodings/cp866.py
  • python/Lib/encodings/cp869.py
  • python/Lib/encodings/cp874.py
  • python/Lib/encodings/cp875.py
  • python/Lib/encodings/cp932.py
  • python/Lib/encodings/cp949.py
  • python/Lib/encodings/cp950.py
  • python/Lib/encodings/euc_jis_2004.py
  • python/Lib/encodings/euc_jisx0213.py
  • python/Lib/encodings/euc_jp.py
  • python/Lib/encodings/euc_kr.py
  • python/Lib/encodings/gb18030.py
  • python/Lib/encodings/gb2312.py
  • python/Lib/encodings/gbk.py
  • python/Lib/encodings/hex_codec.py
  • python/Lib/encodings/hp_roman8.py
  • python/Lib/encodings/hz.py
  • python/Lib/encodings/idna.py
  • python/Lib/encodings/iso2022_jp.py
  • python/Lib/encodings/iso2022_jp_1.py
  • python/Lib/encodings/iso2022_jp_2.py
  • python/Lib/encodings/iso2022_jp_2004.py
  • python/Lib/encodings/iso2022_jp_3.py
  • python/Lib/encodings/iso2022_jp_ext.py
  • python/Lib/encodings/iso2022_kr.py
  • python/Lib/encodings/iso8859_1.py
  • python/Lib/encodings/iso8859_10.py
  • python/Lib/encodings/iso8859_11.py
  • python/Lib/encodings/iso8859_13.py
  • python/Lib/encodings/iso8859_14.py
  • python/Lib/encodings/iso8859_15.py
  • python/Lib/encodings/iso8859_16.py
  • python/Lib/encodings/iso8859_2.py
  • python/Lib/encodings/iso8859_3.py
  • python/Lib/encodings/iso8859_4.py
  • python/Lib/encodings/iso8859_5.py
  • python/Lib/encodings/iso8859_6.py
  • python/Lib/encodings/iso8859_7.py
  • python/Lib/encodings/iso8859_8.py
  • python/Lib/encodings/iso8859_9.py
  • python/Lib/encodings/johab.py
  • python/Lib/encodings/koi8_r.py
  • python/Lib/encodings/koi8_u.py
  • python/Lib/encodings/latin_1.py
  • python/Lib/encodings/mac_arabic.py
  • python/Lib/encodings/mac_centeuro.py
  • python/Lib/encodings/mac_croatian.py
  • python/Lib/encodings/mac_cyrillic.py
  • python/Lib/encodings/mac_farsi.py
  • python/Lib/encodings/mac_greek.py
  • python/Lib/encodings/mac_iceland.py
  • python/Lib/encodings/mac_latin2.py
  • python/Lib/encodings/mac_roman.py
  • python/Lib/encodings/mac_romanian.py
  • python/Lib/encodings/mac_turkish.py
  • python/Lib/encodings/mbcs.py
  • python/Lib/encodings/palmos.py
  • python/Lib/encodings/ptcp154.py
  • python/Lib/encodings/punycode.py
  • python/Lib/encodings/quopri_codec.py
  • python/Lib/encodings/raw_unicode_escape.py
  • python/Lib/encodings/rot_13.py
    .py .sh linux
  • python/Lib/encodings/shift_jis.py
  • python/Lib/encodings/shift_jis_2004.py
  • python/Lib/encodings/shift_jisx0213.py
  • python/Lib/encodings/tis_620.py
  • python/Lib/encodings/undefined.py
  • python/Lib/encodings/unicode_escape.py
  • python/Lib/encodings/unicode_internal.py
  • python/Lib/encodings/utf_16.py
  • python/Lib/encodings/utf_16_be.py
  • python/Lib/encodings/utf_16_le.py
  • python/Lib/encodings/utf_32.py
  • python/Lib/encodings/utf_32_be.py
  • python/Lib/encodings/utf_32_le.py
  • python/Lib/encodings/utf_7.py
  • python/Lib/encodings/utf_8.py
  • python/Lib/encodings/utf_8_sig.py
  • python/Lib/encodings/uu_codec.py
  • python/Lib/encodings/zlib_codec.py
  • python/Lib/enum.py
  • python/Lib/fnmatch.py
  • python/Lib/functools.py
  • python/Lib/genericpath.py
  • python/Lib/hashlib.py
  • python/Lib/heapq.py
  • python/Lib/hmac.py
  • python/Lib/http/__init__.py
  • python/Lib/http/client.py
  • python/Lib/http/cookiejar.py
    .py .vbs
  • python/Lib/http/cookies.py
    .py .js
  • python/Lib/http/server.py
  • python/Lib/io.py
  • python/Lib/json/__init__.py
  • python/Lib/json/decoder.py
  • python/Lib/json/encoder.py
  • python/Lib/json/scanner.py
  • python/Lib/json/tool.py
  • python/Lib/keyword.py
  • python/Lib/linecache.py
  • python/Lib/locale.py
  • python/Lib/logging/__init__.py
  • python/Lib/logging/config.py
  • python/Lib/logging/handlers.py
    .py .js
  • python/Lib/mimetypes.py
  • python/Lib/ntpath.py
  • python/Lib/nturl2path.py
  • python/Lib/numbers.py
  • python/Lib/operator.py
  • python/Lib/optparse.py
  • python/Lib/os.py
  • python/Lib/pickle.py
  • python/Lib/posixpath.py
  • python/Lib/quopri.py
  • python/Lib/random.py
  • python/Lib/re.py
  • python/Lib/reprlib.py
  • python/Lib/selectors.py
  • python/Lib/shutil.py
  • python/Lib/site-packages/dns/__init__.py
  • python/Lib/site-packages/dns/_compat.py
  • python/Lib/site-packages/dns/dnssec.py
  • python/Lib/site-packages/dns/e164.py
  • python/Lib/site-packages/dns/edns.py
  • python/Lib/site-packages/dns/entropy.py
  • python/Lib/site-packages/dns/exception.py
  • python/Lib/site-packages/dns/flags.py
  • python/Lib/site-packages/dns/grange.py
  • python/Lib/site-packages/dns/hash.py
  • python/Lib/site-packages/dns/inet.py
  • python/Lib/site-packages/dns/ipv4.py
  • python/Lib/site-packages/dns/ipv6.py
  • python/Lib/site-packages/dns/message.py
  • python/Lib/site-packages/dns/name.py
  • python/Lib/site-packages/dns/namedict.py
  • python/Lib/site-packages/dns/node.py
  • python/Lib/site-packages/dns/opcode.py
  • python/Lib/site-packages/dns/query.py
  • python/Lib/site-packages/dns/rcode.py
  • python/Lib/site-packages/dns/rdata.py
  • python/Lib/site-packages/dns/rdataclass.py
  • python/Lib/site-packages/dns/rdataset.py
  • python/Lib/site-packages/dns/rdatatype.py
  • python/Lib/site-packages/dns/rdtypes/ANY/AFSDB.py
  • python/Lib/site-packages/dns/rdtypes/ANY/CAA.py
  • python/Lib/site-packages/dns/rdtypes/ANY/CDNSKEY.py
  • python/Lib/site-packages/dns/rdtypes/ANY/CDS.py
  • python/Lib/site-packages/dns/rdtypes/ANY/CERT.py
  • python/Lib/site-packages/dns/rdtypes/ANY/CNAME.py
  • python/Lib/site-packages/dns/rdtypes/ANY/CSYNC.py
  • python/Lib/site-packages/dns/rdtypes/ANY/DLV.py
  • python/Lib/site-packages/dns/rdtypes/ANY/DNAME.py
  • python/Lib/site-packages/dns/rdtypes/ANY/DNSKEY.py
  • python/Lib/site-packages/dns/rdtypes/ANY/DS.py
  • python/Lib/site-packages/dns/rdtypes/ANY/EUI48.py
  • python/Lib/site-packages/dns/rdtypes/ANY/EUI64.py
  • python/Lib/site-packages/dns/rdtypes/ANY/GPOS.py
  • python/Lib/site-packages/dns/rdtypes/ANY/HINFO.py
  • python/Lib/site-packages/dns/rdtypes/ANY/HIP.py
  • python/Lib/site-packages/dns/rdtypes/ANY/ISDN.py
  • python/Lib/site-packages/dns/rdtypes/ANY/LOC.py
  • python/Lib/site-packages/dns/rdtypes/ANY/MX.py
  • python/Lib/site-packages/dns/rdtypes/ANY/NS.py
  • python/Lib/site-packages/dns/rdtypes/ANY/NSEC.py
  • python/Lib/site-packages/dns/rdtypes/ANY/NSEC3.py
  • python/Lib/site-packages/dns/rdtypes/ANY/NSEC3PARAM.py
  • python/Lib/site-packages/dns/rdtypes/ANY/PTR.py
  • python/Lib/site-packages/dns/rdtypes/ANY/RP.py
  • python/Lib/site-packages/dns/rdtypes/ANY/RRSIG.py
  • python/Lib/site-packages/dns/rdtypes/ANY/RT.py
  • python/Lib/site-packages/dns/rdtypes/ANY/SOA.py
  • python/Lib/site-packages/dns/rdtypes/ANY/SPF.py
  • python/Lib/site-packages/dns/rdtypes/ANY/SSHFP.py
  • python/Lib/site-packages/dns/rdtypes/ANY/TLSA.py
  • python/Lib/site-packages/dns/rdtypes/ANY/TXT.py
  • python/Lib/site-packages/dns/rdtypes/ANY/URI.py
  • python/Lib/site-packages/dns/rdtypes/ANY/X25.py
  • python/Lib/site-packages/dns/rdtypes/ANY/__init__.py
  • python/Lib/site-packages/dns/rdtypes/IN/A.py
  • python/Lib/site-packages/dns/rdtypes/IN/AAAA.py
  • python/Lib/site-packages/dns/rdtypes/IN/APL.py
  • python/Lib/site-packages/dns/rdtypes/IN/DHCID.py
  • python/Lib/site-packages/dns/rdtypes/IN/IPSECKEY.py
  • python/Lib/site-packages/dns/rdtypes/IN/KX.py
  • python/Lib/site-packages/dns/rdtypes/IN/NAPTR.py
  • python/Lib/site-packages/dns/rdtypes/IN/NSAP.py
  • python/Lib/site-packages/dns/rdtypes/IN/NSAP_PTR.py
  • python/Lib/site-packages/dns/rdtypes/IN/PX.py
  • python/Lib/site-packages/dns/rdtypes/IN/SRV.py
  • python/Lib/site-packages/dns/rdtypes/IN/WKS.py
  • python/Lib/site-packages/dns/rdtypes/IN/__init__.py
  • python/Lib/site-packages/dns/rdtypes/__init__.py
  • python/Lib/site-packages/dns/rdtypes/dnskeybase.py
  • python/Lib/site-packages/dns/rdtypes/dsbase.py
  • python/Lib/site-packages/dns/rdtypes/euibase.py
  • python/Lib/site-packages/dns/rdtypes/mxbase.py
  • python/Lib/site-packages/dns/rdtypes/nsbase.py
  • python/Lib/site-packages/dns/rdtypes/txtbase.py
  • python/Lib/site-packages/dns/renderer.py
  • python/Lib/site-packages/dns/resolver.py
  • python/Lib/site-packages/dns/reversename.py
  • python/Lib/site-packages/dns/rrset.py
  • python/Lib/site-packages/dns/set.py
  • python/Lib/site-packages/dns/tokenizer.py
  • python/Lib/site-packages/dns/tsig.py
  • python/Lib/site-packages/dns/tsigkeyring.py
  • python/Lib/site-packages/dns/ttl.py
  • python/Lib/site-packages/dns/update.py
  • python/Lib/site-packages/dns/version.py
  • python/Lib/site-packages/dns/wiredata.py
  • python/Lib/site-packages/dns/zone.py
  • python/Lib/site.py
  • python/Lib/socket.py
    .py .js
  • python/Lib/sre_compile.py
  • python/Lib/sre_constants.py
  • python/Lib/sre_parse.py
  • python/Lib/ssl.py
    .py .js
  • python/Lib/stat.py
  • python/Lib/string.py
  • python/Lib/stringprep.py
  • python/Lib/struct.py
  • python/Lib/subprocess.py
  • python/Lib/sysconfig.py
  • python/Lib/tarfile.py
    .py .sh linux
  • python/Lib/tempfile.py
  • python/Lib/textwrap.py
  • python/Lib/threading.py
  • python/Lib/token.py
  • python/Lib/tokenize.py
  • python/Lib/traceback.py
  • python/Lib/types.py
  • python/Lib/urllib/error.py
  • python/Lib/urllib/parse.py
  • python/Lib/urllib/request.py
    .py .js
  • python/Lib/urllib/response.py
  • python/Lib/urllib/robotparser.py
  • python/Lib/uu.py
  • python/Lib/warnings.py
  • python/Lib/weakref.py
  • python/msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • python/python.exe
    .exe windows:5 windows x86 arch:x86

    aabf9658c659113c3543d697ab1b589a


    Headers

    Imports

    Sections

  • python/python34.dll
    .dll windows:5 windows x86 arch:x86

    bf31f75de465e5022a052fd959325045


    Headers

    Imports

    Exports

    Sections

  • python/pythonw.exe
    .exe windows:5 windows x86 arch:x86

    a983849fc05db4fa6587d1439c6a466c


    Headers

    Imports

    Sections

  • rules.ini
  • settings.ini
  • uninstall.exe
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Headers

    Imports

    Sections