General

  • Target
    807579e491f92a6eb21cdebede48329a_JaffaCakes118
  • Size 6.0MB
  • Sample240529-mqe7pace72
  • SHA256 1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

File Explorer

  • 807579e491f92a6eb21cdebede48329a_JaffaCakes118
    .exe 6.0MB
  • $PLUGINSDIR/BgWorker.dll
    .dll 2KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/nsDui.dll
    .dll 1.7MB
  • $PLUGINSDIR/nsis7z.dll
    .dll 171KB
  • $PLUGINSDIR/sobar.bmp
    57KB
  • $PLUGINSDIR/welcome.bmp
    25KB
  • SearchCommon.dll
    .dll 200KB
  • app.7z
    .7z 4.2MB
  • QuickSearch.exe
    .exe 7.3MB
  • Update.exe
    .exe 193KB
  • extname.txt
    1KB
  • htmlayout.dll
    .dll 933KB
  • out.upx
    .dll 2.3MB
  • uninst.exe
    .exe 1.3MB
  • $PLUGINSDIR/BgWorker.dll
    .dll 2KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/nsDui.dll
    .dll 1.7MB
  • searchshelp.dll
    .dll 372KB
  • searchshelpx64.dll
    .dll 330KB

807579e491f92a6eb21cdebede48329a_JaffaCakes118

  • IMPHASH 7fa974366048f9c551ef45714595665e
  • SHA256 1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28
  • MD5 SHA1 SHA512 SSDEEP
Digest
33:0b:6a:0e:b2:30:f5:7a:47:b0:1d:e4:b9:cd:ec:a6:03:96:4d:d3:cc:a0:5d:de:51:83:cc:01:c1:f1:a4:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Henan Yiciyuan Network Technology Co. Ltd,OU=Technology Department,O=Henan Yiciyuan Network Technology Co. Ltd,L=Xinzheng,ST=Henan,C=CN
Digest
90:cd:9f:70:00:09:90:e9:ca:6c:70:09:50:01:56:9a:c9:99:25:3e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Henan Yiciyuan Network Technology Co. Ltd,OU=Technology Department,O=Henan Yiciyuan Network Technology Co. Ltd,L=Xinzheng,ST=Henan,C=CN
Minor OS version
0
Major OS version
4
Entry point
12624
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths