Overview

overview

7

Static

static

7

6cd039238d...18.exe

windows7-x64

7

6cd039238d...18.exe

windows10-2004-x64

7

$PLUGINSDIR/$_17_.exe

windows7-x64

7

$PLUGINSDIR/$_17_.exe

windows10-2004-x64

7

$PLUGINSDIR/$_19_.dll

windows7-x64

1

$PLUGINSDIR/$_19_.dll

windows10-2004-x64

3

$PLUGINSDIR/Delay.dll

windows7-x64

3

$PLUGINSDIR/Delay.dll

windows10-2004-x64

3

$PLUGINSDI...ee.dll

windows7-x64

3

$PLUGINSDI...ee.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ch.dll

windows7-x64

3

$PLUGINSDI...ch.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDIR/gv.exe

windows7-x64

1

$PLUGINSDIR/gv.exe

windows10-2004-x64

1

$PLUGINSDI...4.html

windows7-x64

1

$PLUGINSDI...4.html

windows10-2004-x64

1

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDI...sh.dll

windows7-x64

1

$PLUGINSDI...sh.dll

windows10-2004-x64

1

$PLUGINSDI...s.html

windows7-x64

1

$PLUGINSDI...s.html

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    6cd039238d9f007bbeeba2616615507a_JaffaCakes118

  • Size

    2.6MB

  • MD5

    6cd039238d9f007bbeeba2616615507a

  • SHA1

    915efb893a318b8a104f5062f14b1f4c01a3249d

  • SHA256

    3d07be375a04a287af08bacc7f4854f05ed076588daf2f04f7c8dc3a3a9dab75

  • SHA512

    ca336db20d78bfbf1d38038ad107773fe7e7e399088d2e49d8566865d3e7568ae8d99548246481081ce1680e5cbf502c239fd028800c266ecd07b4efa517599b

  • SSDEEP

    49152:4zNEj6GBjWnBqiEF7mi4Yvw+Jfx01GhviCkJvr+FbtN7zZdZafVW5g:42j6GB6Bq5qYvw+8qMJ6FnzZdUf

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 36 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs
    installer

Files

  • 6cd039238d9f007bbeeba2616615507a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/$_17_
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/$_19_
    .dll windows:4 windows x86 arch:x86

    c911712c0576b2eb40dc87a5b3f4f572


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/1.gif
    .gif
  • $PLUGINSDIR/1.ico
  • $PLUGINSDIR/2.ico
  • $PLUGINSDIR/5.bmp
  • $PLUGINSDIR/Delay.dll
    .dll windows:4 windows x86 arch:x86

    bb13ae3bcb238d1bf689a931b2a56cd6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Marquee.dll
    .dll windows:4 windows x86 arch:x86

    92ab985aa8de0e55dc16648abbc2c871


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/VPatch.dll
    .dll windows:4 windows x86 arch:x86

    308dbf2136b37be830bdd627b8ff3095


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/animate.dll
    .dll windows:4 windows x86 arch:x86

    b8480fcb24dd1875fa021df176dc6e6f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/gv.exe
    .exe windows:4 windows x86 arch:x86

    478f4508e872c522e2acfc69b4d8854f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/index4.html
    .html
  • $PLUGINSDIR/locate.dll
    .dll windows:4 windows x86 arch:x86

    61142a69a9a888c92fddc2ab9dbb123a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/newadvsplash.dll
    .dll windows:4 windows x86 arch:x86

    eee37c14e102da3f62385f9796c701ce


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/notas.html
    .html
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:5 windows x86 arch:x86

    4c04c20a976733bf789fead96eb58701


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nxsGV.dll
    .dll windows:4 windows x86 arch:x86

    de36b53ffe7c2e743efb66087e7ba980


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/s.jpg
    .jpg
  • $PLUGINSDIR/s0_data/cont1.html
    .html .js polyglot
  • $PLUGINSDIR/s0_data/cont2.html
    .html
  • $PLUGINSDIR/textreplace.dll
    .dll windows:4 windows x86 arch:x86

    c9b875d3f7604775d782afcb308d92df


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/time.dll
    .dll windows:4 windows x86 arch:x86

    2e3a4d1f132aea64d421c1e936bcc407


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ts_files/scroll.dflt.js
  • $PLUGINSDIR/ts_files/scroll.html
    .js
  • $PLUGINSDIR/ts_files/scroll.js
    .js
  • $PLUGINSDIR/ts_files/scroll.tpl0.js
    .js
  • $PLUGINSDIR/ts_files/scroll0.css
  • $PROGRAMFILES/GameVicio/Batman: Arkham Asylum/$PROGRAMFILES/GameVicio/Batman: Arkham Asylum/Desinstalar.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/time.dll
    .dll windows:4 windows x86 arch:x86

    2e3a4d1f132aea64d421c1e936bcc407


    Headers

    Imports

    Exports

    Sections

  • $TEMP/$_17_
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • $TEMP/$_19_
    .dll windows:4 windows x86 arch:x86

    c911712c0576b2eb40dc87a5b3f4f572


    Headers

    Imports

    Exports

    Sections

  • $_41_
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PROGRAMFILES/GameVicio/Batman: Arkham Asylum/Atualizador.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Marquee.dll
    .dll windows:4 windows x86 arch:x86

    92ab985aa8de0e55dc16648abbc2c871


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    8773e19ae02f331332db1b00671fdecf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisXML.dll
    .dll windows:4 windows x86 arch:x86

    d9ee494a2a7b0d46616d9537ef3d8431


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/skingv_256_3.bmp
  • $_11_
  • $PROGRAMFILES/GameVicio/Batman: Arkham Asylum/favicon.ico
  • $PROGRAMFILES/GameVicio/Batman: Arkham Asylum/notas.html
    .html
  • $TEMP/$_0_
  • $_14_
    .jpg
  • $_20_
    .7z
  • Trad.gv
  • Binaries/$_41_
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • BmGame/Localization/INT/Achievements.int
  • BmGame/Localization/INT/Admin_B1.int
  • BmGame/Localization/INT/Admin_B4.int
  • BmGame/Localization/INT/Amadeus.int
  • BmGame/Localization/INT/Bio.int
  • BmGame/Localization/INT/Cave_A1.int
  • BmGame/Localization/INT/Cave_B1.int
  • BmGame/Localization/INT/Cave_B5.int
  • BmGame/Localization/INT/Cave_C1.int
  • BmGame/Localization/INT/Cells_B2.int
  • BmGame/Localization/INT/Credits.int
  • BmGame/Localization/INT/Cutscene.int
  • BmGame/Localization/INT/Demo.int
  • BmGame/Localization/INT/Enemy_L1.int
  • BmGame/Localization/INT/Forensics.int
  • BmGame/Localization/INT/Frontend.int
  • BmGame/Localization/INT/GFxFonts.int
  • BmGame/Localization/INT/GFxUI.int
  • BmGame/Localization/INT/Garden_B5.int
  • BmGame/Localization/INT/IVY.int
  • BmGame/Localization/INT/Investigation.int
  • BmGame/Localization/INT/Max_A1.int
  • BmGame/Localization/INT/Max_B1.int
  • BmGame/Localization/INT/Max_B3.int
  • BmGame/Localization/INT/Max_B4.int
  • BmGame/Localization/INT/Max_B5.int
  • BmGame/Localization/INT/Max_B6.int
  • BmGame/Localization/INT/Max_C1.int
  • BmGame/Localization/INT/Max_C6.int
  • BmGame/Localization/INT/Medical_A1.int
  • BmGame/Localization/INT/Medical_B1.int
  • BmGame/Localization/INT/Medical_B3.int
  • BmGame/Localization/INT/Medical_B6.int
  • BmGame/Localization/INT/Objectives.int
  • BmGame/Localization/INT/Overworld_A1.int
  • BmGame/Localization/INT/Overworld_A2.int
  • BmGame/Localization/INT/Overworld_A3.int
  • BmGame/Localization/INT/PC.int
  • BmGame/Localization/INT/Presence.int
  • BmGame/Localization/INT/Rewards.int
  • BmGame/Localization/INT/Riddler.int
  • BmGame/Localization/INT/Scarecrow_Taunts.int
  • BmGame/Localization/INT/Signs.int
  • BmGame/Localization/INT/Tutorial.int
  • BmGame/Localization/INT/Xlast_DLC.int
  • BmGame/Splash/PC/splash.bmp