General

  • Target

    73b519a8064a787cfe2c3306aa30ee62_JaffaCakes118

  • Size

    22.5MB

  • MD5

    73b519a8064a787cfe2c3306aa30ee62

  • SHA1

    5d293e14f9650fd42ca6c442a6be189c720bd797

  • SHA256

    c1242e43f6dc33895846d564834391d2c963165063cf428964728591bc471cb1

  • SHA512

    1723293d319ba71d15f08c082889e94cc1f2ae55d939236e05352f95caf49fde6ef575c6359d9ccd0e04462924bf7ab2ad25654a9311066cca1bf6744311776b

  • SSDEEP

    393216:3LmPuAW/H8vPqbU3OGwIMRy/JMEUHokczdTgKNxAIrKLVSk+NGyd3D7kr9:36G3f8vPq434IMRAFkc5gKNxFuVSTNpU

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 24 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 43 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 73b519a8064a787cfe2c3306aa30ee62_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AccessControl.dll
    .dll windows:4 windows x86 arch:x86

    b79de4e8687b3fce7173ec8dc917f685


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Dialer.dll
    .dll windows:4 windows x86 arch:x86

    6504337db30ea93d33d7a714fefff047


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/INetC.dll
    .dll windows:4 windows x86 arch:x86

    8ef3613e48db9e7b48e33704238cd659


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InetBgDL.dll
    .dll windows:4 windows x86 arch:x86

    2a2eba5ac8c64ac59f673985a907e322


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LockedList.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/action.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $R0/irsaprint.dll
    .dll windows:4 windows x64 arch:x64

    2c4b1b236bf998a51bbdba77fe365550


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $R0/irsaprint/irfanview/i_about.txt
  • $R0/irsaprint/irfanview/i_view32.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/i_view32.ini
  • $R0/irsaprint/irfanview/plugins/Ansi2Unicode.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/plugins/Awd.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/plugins/B3d.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/plugins/Dicom.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/plugins/DjVu.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/plugins/Ecw.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $R0/irsaprint/irfanview/plugins/Ecw/NCSEcw.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Ecw/NCSEcwC.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Ecw/NCSUtil.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Ecw/NCScnet.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Fmod/Fmod.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Formats.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Fpx.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Hdp.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Ics.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/JPEG2000.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/JPM.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/KDC120.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Mng.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/MrSID.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/MrSID/lti_dsdk_cdll_9.0.dll
    .dll windows:4 windows x86 arch:x86

    fe4aaef17000d2d7de996ab12f9b15ef


    Headers

    Imports

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/MrSID/tbb.dll
    .dll windows:4 windows x86 arch:x86

    11a55d17a715681c35fad752d641a8b3


    Headers

    Imports

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Mrc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Photocd.dll
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Postscript.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Sff.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irfanview/plugins/Vtf.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $R0/irsaprint/irsaprint.ini
  • $R0/irsaprint/sumatrapdf/SumatraPDF.LICENSE
  • $R0/irsaprint/sumatrapdf/SumatraPDF.exe
    .exe windows:5 windows x64 arch:x64

    84b36b50db49b3c608d6e49ef1b1d453


    Code Sign

    Headers

    Imports

    Sections

  • $R0/irsaprint/wkp.LICENSE
  • $R0/irsaprint/wkp.README
  • $R0/irsaprint/wkp.dll
    .dll windows:4 windows x64 arch:x64

    0f9974417b1d95bda7acf05e1551063c


    Code Sign

    Headers

    Imports

    Exports

    Sections