Overview

overview

7

Static

static

7

PowerISO-7....5.exe

windows7-x64

7

PowerISO-7....5.exe

windows10-2004-x64

7

$PLUGINSDIR/Aero.dll

windows7-x64

7

$PLUGINSDIR/Aero.dll

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$TEMP/Powe...eg.exe

windows7-x64

7

$TEMP/Powe...eg.exe

windows10-2004-x64

7

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gp.dll

windows7-x64

3

$PLUGINSDI...gp.dll

windows10-2004-x64

3

$R0.exe

windows7-x64

1

$R0.exe

windows10-2004-x64

1

devcon.exe

windows7-x64

1

devcon.exe

windows10-2004-x64

1

piso.exe

windows7-x64

1

piso.exe

windows10-2004-x64

1

setup64.exe

windows7-x64

1

setup64.exe

windows10-2004-x64

1

$TEMP/temp/packeg.exe

windows7-x64

1

$TEMP/temp/packeg.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fc1d0d67bf66fb05a56b13aa59fe590_JaffaCakes118

  • Size

    10.3MB

  • MD5

    6fc1d0d67bf66fb05a56b13aa59fe590

  • SHA1

    142da6da98d861e29b077dcea4caf93941194f6f

  • SHA256

    c67452f65d0c7187312499a53670b1e82895518b487328026b2957ee77a274a1

  • SHA512

    e9e69a0dfe9f777e0a4c320dd0c8261cf0680f0a1bc70fbe88cd344a137b382341c62da7bf95f03632023796180b620ad6d3cf30b38ad276c4746bead6cd0d27

  • SSDEEP

    196608:NFFkWfFYkWn862GHPz/+chisFwmR0qz6SNz0SXBmdZDopmQRSVvD5Rp4WvQs:O4FYiMKenR027z0sEzspmQR07eUQs

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 6fc1d0d67bf66fb05a56b13aa59fe590_JaffaCakes118
    .rar
  • PowerISO-7.5/PowerISO-7.5.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Aero.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    135de77644e2add2fd9dd8176740e7e0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $TEMP/PowerISO/packeg.exe
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • $0
    .sys windows:5 windows x64 arch:x64

    8cc86026769dacc3439639a1321b72f8


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Math.dll
    .dll windows:5 windows x86 arch:x86

    9e076237451e90f00c0ff9eb96ba6514


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/qzoxzhphgp.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0
    .exe windows:5 windows x64 arch:x64

    24129f939da41cc56515e833be608d60


    Headers

    Imports

    Sections

  • Lang/Arabic.lng
  • Lang/Armenian.lng
  • Lang/Azerbaijani.lng
  • Lang/Belarusian.lng
  • Lang/Bosnian.lng
  • Lang/Bulgarian.lng
  • Lang/Burmese.lng
  • Lang/Dutch.lng
  • Lang/Farsi.lng
  • Lang/Finnish.lng
  • Lang/German.lng
  • Lang/Greek.lng
  • Lang/Hungarian.lng
  • Lang/Indonesian.lng
  • Lang/Italian.lng
  • Lang/Japanese.lng
  • Lang/Korean.lng
  • Lang/Lithuanian.lng
  • Lang/Malay.lng
  • Lang/Norsk.lng
  • Lang/Polish.lng
  • Lang/Portuguese(Brazil).lng
  • Lang/Romanian.lng
  • Lang/Russian.lng
  • Lang/Serbian(cyrl).lng
  • Lang/SimpChinese.lng
  • Lang/Slovak.lng
  • Lang/Spanish.lng
  • Lang/Swedish.lng
  • Lang/Thai.lng
  • Lang/TradChinese.lng
  • Lang/Turkish.lng
  • Lang/Ukrainian.lng
  • Lang/Urdu(Pakistan).lng
  • Lang/Vietnamese.lng
  • Lang/croatian.lng
  • Lang/czech.lng
  • Lang/danish.lng
  • Lang/french.lng
  • Lang/kazakh.lng
  • Lang/slovenian.lng
  • devcon.exe
    .exe windows:5 windows x64 arch:x64

    24129f939da41cc56515e833be608d60


    Headers

    Imports

    Sections

  • piso.exe
    .exe windows:4 windows x86 arch:x86

    08c6c6afda2527b8a47741d922302b10


    Code Sign

    Headers

    Imports

    Sections

  • setup64.exe
    .exe windows:5 windows x64 arch:x64

    f40095f40192b72a4724ee8f537ca1d9


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/temp/packeg.exe
    .exe windows:4 windows x86 arch:x86

    da401ef5e9d5c4599673c26d95fa6029


    Headers

    Imports

    Sections

  • PowerISO-7.5/Тихая установка.cmd