General

  • Target

    6113678fd2645c0a69d04bc6bb13c94e_JaffaCakes118

  • Size

    1.9MB

  • MD5

    6113678fd2645c0a69d04bc6bb13c94e

  • SHA1

    fe4c19bebb4b0242b6342c466576c8c6c1ff4ff3

  • SHA256

    d60acceb53d9737c331f95ac7854762d664e0420a6873b89107266e06cd5577b

  • SHA512

    2d89a72a155350efb517c8a77ffd1a8e2adc8ea21fe1b7f16fc5f4ca1af7c57c7a852fbf1b903edc432dc6cbca665e848952af4f668e9c5ffbea3c8886749b28

  • SSDEEP

    49152:7h8fItdn4NQCqD5NatpWBhTPoUP54wwz2:7awt14qCuItyThPoC

Score
3/10

Malware Config

Signatures

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 6113678fd2645c0a69d04bc6bb13c94e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/actssl.cer
  • $TEMP/ActSys/SSL/import.bat
  • $TEMP/ActSys/SSL/import_root_cert.exe
    .exe windows:4 windows x86 arch:x86

    fe88de5311928dafcb49148bfb766f02


    Headers

    Imports

    Sections

  • $TEMP/ActSys/SSL/nss/certutil.exe
    .exe windows:4 windows x86 arch:x86

    4bfff94eb6c93e4a6872b3beda65ae7f


    Headers

    Imports

    Sections

  • $TEMP/ActSys/SSL/nss/mozcrt19.dll
    .dll windows:4 windows x86 arch:x86

    7cea1bcca1ff18e164507fda5b70c620


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/nss/nspr4.dll
    .dll windows:4 windows x86 arch:x86

    2f18ebeca6261a49374a46ce4247a667


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/nss/nss3.dll
    .dll windows:4 windows x86 arch:x86

    704ea4cc802242fb4a5a244486fbb13f


    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/nss/plc4.dll
    .dll windows:4 windows x86 arch:x86

    117580383d9705e2154f4772a3d7b5cb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/nss/plds4.dll
    .dll windows:4 windows x86 arch:x86

    b39362cc8da8c2533578c138bce5d210


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/nss/smime3.dll
    .dll windows:4 windows x86 arch:x86

    63f1666a383df6c6d3edc57a30e32345


    Headers

    Imports

    Exports

    Sections

  • $TEMP/ActSys/SSL/nss/softokn3.dll
    .dll windows:4 windows x86 arch:x86

    c8d7acb564d2040c70f541793dbd89e0


    Headers

    Imports

    Exports

    Sections

  • ActSys.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • ProtocolFilters.dll
    .dll windows:4 windows x86 arch:x86

    a3c5fb9ec617fcef7625acb46eab606b


    Headers

    Imports

    Exports

    Sections

  • asfilterdrv.sys
    .sys windows:6 windows x64 arch:x64

    284cb257f5e3c599fd324b84106b0283


    Code Sign

    Headers

    Imports

    Sections

  • libeay32.dll
    .dll windows:4 windows x86 arch:x86

    783dcdfb322025121b2ec4d0d3136f5d


    Headers

    Imports

    Exports

    Sections

  • nfapi.dll
    .dll windows:4 windows x86 arch:x86

    eef222389069e6802997aae6945fe27b


    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:4 windows x86 arch:x86

    28d2228f3a74c454fdd2b43fc9c6e2d7


    Headers

    Imports

    Exports

    Sections