General

  • Target
    4d43fefdff96dcbf5952ab4ece7b7095_JaffaCakes118
  • Size 4.4MB
  • Sample240516-145amaba78
  • SHA256 896fca5100c8a8c0b84908249cafa259654cf5eaf8191fa5da65d57b7b727dae
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 4d43fefdff96dcbf5952ab4ece7b7095_JaffaCakes118
    .exe 4.4MB
  • $PLUGINSDIR/20141021-search-module-install-v15-CENTER-AREA.bmp
    163KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/modern-header.bmp
    73KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/nsProcess.dll
    .dll 4KB
  • $_2_/SBIEBrowserHelperObject.dll
    .dll 21KB
  • $_2_/sma.exe
    .exe 123KB
  • $_2_/smci32.dll
    .dll 1.1MB
  • $_2_/smci64.dll
    .dll 1.6MB
  • $_2_/smei32.dll
    .dll 714KB
  • $_2_/smei64.dll
    .dll 1.0MB
  • $_2_/smfi32.dll
    .dll 654KB
  • $_2_/smfi64.dll
    .dll 914KB
  • $_2_/smi32.exe
    .exe 77KB
  • $_2_/smi64.exe
    .exe 98KB
  • $_2_/smoi32.dll
    .dll 401KB
  • $_2_/smoi64.dll
    .dll 610KB
  • $_2_/smri32.dll
    .dll 399KB
  • $_2_/smri64.dll
    .dll 609KB
  • $_2_/smu.exe
    .exe 2.6MB
  • $_2_/smw.sys
    .dll 41KB

4d43fefdff96dcbf5952ab4ece7b7095_JaffaCakes118

  • IMPHASH 4ce4fb65535ed2e6e7721383dad3bbe0
  • SHA256 896fca5100c8a8c0b84908249cafa259654cf5eaf8191fa5da65d57b7b727dae
  • MD5 SHA1 SHA512 SSDEEP
  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

PE Signature issue

Digest
0c:ff:cd:f6:8b:f7:04:e7:13:90:81:b2:b2:80:b9:b0:f6:0b:74:cb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Goobzo Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Goobzo Ltd,L=Haifa,ST=HAIFA,C=IL
Chains

Jan 8, 2015

Minor OS version
0
Major OS version
5
Entry point
928012
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths