General

  • Target

    7a1b7fd28a1d853d454585f9a77d3b69_JaffaCakes118

  • Size

    11.2MB

  • MD5

    7a1b7fd28a1d853d454585f9a77d3b69

  • SHA1

    265c0efbfc6147ae0f698473e348e62406d6750f

  • SHA256

    6cf77d2dd24c9a1c1564a1af270943b5b885a80e727248c3b29f51e5fd26f877

  • SHA512

    87cda1873c4e91907b84f8ad56306b7b39fc7d2cedbc1f7dc5fe8f4e5c98899181a4843fc0e1f8e66c0cce7d0f9cda4fa4165db76011b32d475c02ec9f297153

  • SSDEEP

    196608:sXY0UVGNAAyy9wd89cu43mqc2NhHqMHU8lcsR9y3igMwSGd:sXiIKNy9OT3XNhKvOPPgMwJd

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 59 IoCs

    Checks for missing Authenticode signature.

Files

  • 7a1b7fd28a1d853d454585f9a77d3b69_JaffaCakes118
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Restoro/AV/HBEDV.KEY
  • $APPDATA/Restoro/AV/avupdate.exe
    .exe windows:5 windows x86 arch:x86

    7c6cb5f857b8c5f712b3cf62b62d8ff0


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Restoro/AV/avupdate_msg.avr
  • $APPDATA/Restoro/AV/cacert.crt
  • $APPDATA/Restoro/AV/msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Restoro/AV/productname.dat
  • $APPDATA/Restoro/AV/savapi.exe
    .exe windows:5 windows x86 arch:x86

    5bb154ead68c0dd9be1ce94c1ed7db00


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Restoro/AV/savapi_restart.exe
    .exe windows:5 windows x86 arch:x86

    90f7250647f81578737a004ab858c26d


    Headers

    Imports

    Sections

  • $APPDATA/Restoro/AV/savapi_stub.exe
    .exe windows:5 windows x86 arch:x86

    0db532abe0984e99866008e5b84ceb8e


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Restoro/TechSupportApp.ini
  • $PLUGINSDIR/AccessControl.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/DcryptDll.dll
    .dll windows:5 windows x86 arch:x86

    1daf45fd074126f5eabcc532bc3e5bf5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    3f0fda09180f619ca116344bede41608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/RestoroUpdater.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AccessControl.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    3f0fda09180f619ca116344bede41608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stack.dll
    .dll windows:4 windows x86 arch:x86

    454e327924e76e3c69e4915b2b6f1a25


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:5 windows x86 arch:x86

    5bbd63919e9f724979e2ebcc7e04a7e6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/installer-164x314.bmp
  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stack.dll
    .dll windows:4 windows x86 arch:x86

    454e327924e76e3c69e4915b2b6f1a25


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:5 windows x86 arch:x86

    5bbd63919e9f724979e2ebcc7e04a7e6


    Headers

    Imports

    Exports

    Sections

  • LZMA.EXE
    .exe windows:4 windows x86 arch:x86

    1c97b14bd77b27568e0f4c0abc6f72d9


    Headers

    Imports

    Sections

  • Restoro.dat
  • RestoroAM.exe
    .exe windows:5 windows x86 arch:x86

    9db9c263185805291883a984bffc4867


    Code Sign

    Headers

    Imports

    Sections

  • RestoroMain.exe
    .exe windows:5 windows x86 arch:x86

    9e814ae7a04844e675f196fff0b187fb


    Code Sign

    Headers

    Imports

    Sections

  • RestoroSafeMode.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    3f0fda09180f619ca116344bede41608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • Restoro_SafeMode.ico
  • Restoro_uninstall.ico
  • Restoro_website.ico
  • Restoroicon.ico
  • TechSupportApp.exe
    .exe windows:5 windows x86 arch:x86

    f061f9bdf4c3a5da89ac5a8b7d3cc987


    Code Sign

    Headers

    Imports

    Sections

  • engine.dat
  • msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • savapi.dll
    .dll windows:6 windows x86 arch:x86

    062ab4da52cf6b371ee1577f253cd6cc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AccessControl.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/Banner.dll
    .dll windows:5 windows x86 arch:x86

    beba03bbad1f8d79d5b3c1359e913e0d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/GetVersion.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Restoro_desktop.ico
  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/installer-164x314.bmp
  • $PLUGINSDIR/installer-497x57.bmp
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:5 windows x86 arch:x86

    5bbd63919e9f724979e2ebcc7e04a7e6


    Headers

    Imports

    Exports

    Sections

  • $TEMP/RestoroUninstall.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $_174_/RestoroUninstall.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections