Overview

overview

7

Static

static

7

121f1bd937...18.exe

windows7-x64

7

121f1bd937...18.exe

windows10-2004-x64

7

$PLUGINSDI...if.dll

windows7-x64

3

$PLUGINSDI...if.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...tc.dll

windows7-x64

3

$PLUGINSDI...tc.dll

windows10-2004-x64

3

$PLUGINSDI...eb.dll

windows7-x64

3

$PLUGINSDI...eb.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows7-x64

7

$PLUGINSDI...ay.dll

windows10-2004-x64

7

$PLUGINSDIR/nsBR.dll

windows7-x64

3

$PLUGINSDIR/nsBR.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...NG.dll

windows7-x64

3

$PLUGINSDI...NG.dll

windows10-2004-x64

3

$PLUGINSDIR/nsURL.dll

windows7-x64

3

$PLUGINSDIR/nsURL.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    121f1bd937571b7d6b6334b392577eb5_JaffaCakes118

  • Size

    2.9MB

  • MD5

    121f1bd937571b7d6b6334b392577eb5

  • SHA1

    294cfec1650ee9b560d77a12795bf308c3207443

  • SHA256

    158fa153f494583f4732d53fda9fa640d7aa306b98978b718e185adf2290f47e

  • SHA512

    89aeebab367608e99f9f7a57b2cd9fa22b3de057a6ab9ceeddc5e7927c538ede462b48911e2fd763c788d31a222edcaa7fd4d05e4b8bff924d66732e1782caa6

  • SSDEEP

    49152:7FFHs80RsB2svqy1SazmIGgJXHBs6PzUfDMpXT2BIHTgk1ZQ20tfVroADc+Url:Rp4sB2Q1SaCIPXHyRKXTuwMkAFoUc+Ol

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs
    installer

Files

  • 121f1bd937571b7d6b6334b392577eb5_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AnimGif.dll
    .dll windows:4 windows x86 arch:x86

    f600fe515bbb976d5966dd4286e0ebd4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/BgWorker.dll
    .dll windows:4 windows x86 arch:x86

    db2755f409b81c4dbfc04f648cfb80b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ButtonEvent.dll
    .dll windows:5 windows x86 arch:x86

    0ece15e7d9bb35972aec701f46192460


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    b997a221e444f5e6463b28778735cf2b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    a9988f98d52a3c7d16228f87844f85ea


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ThreadTimer.dll
    .dll windows:5 windows x86 arch:x86

    cd7699c6e9370d6d4c4bcc96b7286a04


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TkInetc.dll
    .dll windows:6 windows x86 arch:x86

    5854fabbcac12a88b03001569b8f77c1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TkNsweb.dll
    .dll windows:6 windows x86 arch:x86

    0d00b915273c786c7050422fa4b6ee7a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsArray.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsBR.dll
    .dll windows:5 windows x86 arch:x86

    d72efa71858454931b0d55eaf55f5be7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsLANG.dll
    .dll windows:5 windows x86 arch:x86

    0b178f5e7b5a551ae43a16b965e59810


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsURL.dll
    .dll windows:6 windows x86 arch:x86

    97e70b971b35cb67da23cbde6a181f80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/tkDecript.dll
    .dll windows:5 windows x86 arch:x86

    08baf3c404a85e8e1acfb586ba23b61e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/version.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $TEMP/3dboxes_pcspeedup.bmp
  • $TEMP/ajax_loader.gif
    .gif
  • $TEMP/bubbledock_image1.bmp
  • $TEMP/config.xml
    .xml
  • $TEMP/dealply_largo.bmp
  • $TEMP/dealscompare_image.bmp
  • $TEMP/falcon_image1.bmp
  • $TEMP/freesofttoday_image1_en.bmp
  • $TEMP/freesofttoday_image1_es.bmp
  • $TEMP/freesofttoday_image1_fr.bmp
  • $TEMP/freesofttoday_image1_it.bmp
  • $TEMP/freesofttoday_image1_jp.bmp
  • $TEMP/freesofttoday_image1_pl.bmp
  • $TEMP/freesofttoday_image1_pt.bmp
  • $TEMP/freesofttoday_image1_tr.bmp
  • $TEMP/greatarcadehits_terms.rtf
    .rtf
  • $TEMP/hao123_image1.bmp
  • $TEMP/ime_babylon_logo.bmp
  • $TEMP/ime_logo.bmp
  • $TEMP/instloffer.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $TEMP/irobinhood_image1.bmp
  • $TEMP/license.rtf
    .rtf
  • $TEMP/logo_pcspeedup.bmp
  • $TEMP/lollipop_moreinfo.bmp
  • $TEMP/mockup_softwareupdater.bmp
  • $TEMP/moreinfo_boxore.bmp
  • $TEMP/moreinfo_offerbox.bmp
  • $TEMP/passwidget_image3.bmp
  • $TEMP/pcfaster_logo.bmp
  • $TEMP/pcpowerspeed_image.bmp
  • $TEMP/plushd_image1.bmp
  • $TEMP/pricepeep_logo.bmp
  • $TEMP/richtext1.rtf
    .rtf
  • $TEMP/savesense_image.bmp
  • $TEMP/sharpsavings_image1.bmp
  • $TEMP/snapdo_terms.rtf
    .rtf
  • $TEMP/square_baseflash.bmp
  • $TEMP/square_boxore.bmp
  • $TEMP/square_browseradditions.bmp
  • $TEMP/square_bubbledock.bmp
  • $TEMP/square_dealply.bmp
  • $TEMP/square_downloadterms.bmp
  • $TEMP/square_falcon.bmp
  • $TEMP/square_fastfreeconvertor.bmp
  • $TEMP/square_freesofttoday.bmp
  • $TEMP/square_greatarcadehits.bmp
  • $TEMP/square_irobinhood.bmp
  • $TEMP/square_lollipop.bmp
  • $TEMP/square_mobogenie.bmp
  • $TEMP/square_offerbox.bmp
  • $TEMP/square_okitspace.bmp
  • $TEMP/square_passwidget.bmp
  • $TEMP/square_pcfaster.bmp
  • $TEMP/square_pcspeedup.bmp
  • $TEMP/square_plushd.bmp
  • $TEMP/square_pricepeep.bmp
  • $TEMP/square_quickshare.bmp
  • $TEMP/square_savesense.bmp
  • $TEMP/square_sharpsavings.bmp
  • $TEMP/square_socialhelper.bmp
  • $TEMP/square_softwareupdater.bmp
  • $TEMP/square_tubedimmer.bmp
  • $TEMP/square_utilsbar.bmp
  • $TEMP/square_vbates.bmp
  • $TEMP/square_wajam.bmp
  • $TEMP/square_weatherapp.bmp
  • $TEMP/square_webstroller.bmp
  • $TEMP/tb_utilsbar.bmp
  • $TEMP/tubedimmer_logo.bmp
  • $TEMP/tubedimmer_sample.bmp
  • $TEMP/wajam_image1.bmp
  • $TEMP/wajam_logo.bmp
  • $TEMP/wajam_terms.rtf
    .rtf