Overview
overview
3Static
static
3institute/...fee.js
windows7-x64
3institute/...fee.js
windows10-2004-x64
3institute/...x.html
windows7-x64
1institute/...x.html
windows10-2004-x64
1institute/...ses.js
windows7-x64
3institute/...ses.js
windows10-2004-x64
3institute/...e.html
windows7-x64
1institute/...e.html
windows10-2004-x64
1institute/...t.html
windows7-x64
1institute/...t.html
windows10-2004-x64
1institute/...x.html
windows7-x64
1institute/...x.html
windows10-2004-x64
1institute/...t.html
windows7-x64
1institute/...t.html
windows10-2004-x64
1east_updat...rt.ps1
windows7-x64
3east_updat...rt.ps1
windows10-2004-x64
3east_updat...r.html
windows7-x64
1east_updat...r.html
windows10-2004-x64
1east_updat...t.html
windows7-x64
1east_updat...t.html
windows10-2004-x64
1institute/...o.html
windows7-x64
1institute/...o.html
windows10-2004-x64
1institute/...ent.js
windows7-x64
3institute/...ent.js
windows10-2004-x64
3institute/.../ii.js
windows7-x64
3institute/.../ii.js
windows10-2004-x64
3institute/...s.html
windows7-x64
1institute/...s.html
windows10-2004-x64
1institute/...o.html
windows7-x64
1institute/...o.html
windows10-2004-x64
1institute/...ook.js
windows7-x64
3institute/...ook.js
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
institute/accounts_adjust_total_fee.js
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
institute/accounts_adjust_total_fee.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
institute/accounts_index.html
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
institute/accounts_index.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
institute/accounts_setting_expenses.js
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
institute/accounts_setting_expenses.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
institute/add_semester_fee.html
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
institute/add_semester_fee.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
institute/admin_add_student.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
institute/admin_add_student.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
institute/admin_index.html
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
institute/admin_index.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
institute/admin_top_left.html
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
institute/admin_top_left.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
east_update/east_update/report.ps1
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
east_update/east_update/report.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
east_update/east_update/report_header.html
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
east_update/east_update/report_header.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
east_update/east_update/top_left.html
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
east_update/east_update/top_left.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
institute/image/am/untitled folder/o.html
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
institute/image/am/untitled folder/o.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
institute/image/excl/auto/newp/files/element.js
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
institute/image/excl/auto/newp/files/element.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
institute/image/excl/auto/newp/ii.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
institute/image/excl/auto/newp/ii.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
institute/image/excl/auto/newp/success.html
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
institute/image/excl/auto/newp/success.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
institute/image/file/untitled folder/o.html
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
institute/image/file/untitled folder/o.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
institute/librarian_add_book.js
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
institute/librarian_add_book.js
Resource
win10v2004-20240508-en
General
-
Target
85c24e945edf594d68f0468aaccce965_JaffaCakes118
-
Size
1.4MB
-
MD5
85c24e945edf594d68f0468aaccce965
-
SHA1
5f6e3dd3061b3f5d8e9c2ad9e0b2b1d8d4b3e901
-
SHA256
22e77e8c1a81030cddf4844065267daba1c205d04c797c496d0688753d24489f
-
SHA512
df826233aaaad6b46a42b39338ef1eaa1b09f8eabe0be0c809411155491ced210248d79a44f8140098802798c56b968d56adaf5adb0cff73162e8a1e718bbd37
-
SSDEEP
24576:Lb2+AoebvILWbZnfdamip9oYHOWl2KNUySSOfpD6TUfpD615FCdYh:f2+tefn4mi332cSSsNi+N6rCeh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack004/SMS Engine.exe
Files
-
85c24e945edf594d68f0468aaccce965_JaffaCakes118.zip
-
institute/Copy of accounts_payment.php
-
institute/Logo.JPG.jpg
-
institute/New Text Document.txt
-
institute/account_student_check.php
-
institute/accounts.php
-
institute/accounts_add_expense.php
-
institute/accounts_adjust_total_fee.php.js
-
institute/accounts_bank.php
-
institute/accounts_bank_account_report.php
-
institute/accounts_change_my_pass.php
-
institute/accounts_daily_transaction_report.php
-
institute/accounts_del_expenses.php
-
institute/accounts_edit_expenses.php
-
institute/accounts_error_message.php
-
institute/accounts_expenses_report.php
-
institute/accounts_expenses_report_monthy.php
-
institute/accounts_expenses_reportold.php
-
institute/accounts_functions.php
-
institute/accounts_functionsold.php
-
institute/accounts_index.php.html
-
institute/accounts_menu.php
-
institute/accounts_message.php
-
institute/accounts_monthly_transaction_report.php
-
institute/accounts_payment.php
-
institute/accounts_process.php
-
institute/accounts_process_1.php
-
institute/accounts_processold.php
-
institute/accounts_receive_money.php.html .js polyglot
-
institute/accounts_receive_money_other.php
-
institute/accounts_receive_report_day.php
-
institute/accounts_recive_report_monthy.php
-
institute/accounts_recive_report_monthy1.php
-
institute/accounts_setting_expenses.php.js
-
institute/accounts_student_payment_report.php
-
institute/accounts_student_result.php
-
institute/accounts_student_result_report.php
-
institute/accounts_total_balance_report.php
-
institute/add_semester_fee.php.html
-
institute/admin_add_batch.php
-
institute/admin_add_course.php
-
institute/admin_add_course_semester.php
-
institute/admin_add_employee.php
-
institute/admin_add_nationality.php
-
institute/admin_add_program.php
-
institute/admin_add_religion.php
-
institute/admin_add_s_board.php
-
institute/admin_add_s_c_degree.php
-
institute/admin_add_s_sub.php
-
institute/admin_add_semester.php
-
institute/admin_add_semester_name.php
-
institute/admin_add_student.php.html
-
institute/admin_add_student_helper.php
-
institute/admin_add_student_result.php
-
institute/admin_add_student_step_1.php
-
institute/admin_add_student_step_2.php
-
institute/admin_add_student_step_3.php
-
institute/admin_change_my_pass.php
-
institute/admin_change_student_program.php
-
institute/admin_change_student_registration.php
-
institute/admin_del_batch.php
-
institute/admin_del_course.php
-
institute/admin_del_course_semester.php
-
institute/admin_del_employee.php
-
institute/admin_del_nationality.php
-
institute/admin_del_program.php
-
institute/admin_del_religion.php
-
institute/admin_del_s_board.php
-
institute/admin_del_s_c_degree.php
-
institute/admin_del_s_sub.php
-
institute/admin_del_semester.php
-
institute/admin_del_semester_name.php
-
institute/admin_del_student.php
-
institute/admin_edit_batch.php
-
institute/admin_edit_course.php
-
institute/admin_edit_employee_info.php
-
institute/admin_edit_nationality.php
-
institute/admin_edit_program.php
-
institute/admin_edit_religion.php
-
institute/admin_edit_s_board.php
-
institute/admin_edit_s_c_degree.php
-
institute/admin_edit_s_sub.php
-
institute/admin_edit_semester.php
-
institute/admin_edit_semester_name.php
-
institute/admin_edit_student_info.php
-
institute/admin_error_message.php
-
institute/admin_fee_setup.php
-
institute/admin_functions.php
-
institute/admin_index.php.html
-
institute/admin_menu.php
-
institute/admin_message.php
-
institute/admin_process.php
-
institute/admin_report_list_student.php
-
institute/admin_report_student_finance.php
-
institute/admin_report_student_info.php
-
institute/admin_report_student_library.php
-
institute/admin_reset_password.php
-
institute/admin_top_left.php.html
-
institute/borrowed_books_report.php
-
institute/connect.php
-
institute/connect_net.php
-
institute/contact.php
-
institute/content.php.html .js polyglot
-
institute/css/style.css
-
institute/east_update.zip.zip
-
east_update/east_update/accounts.php
-
east_update/east_update/accounts_process.php
-
east_update/east_update/accounts_total_balance_report.php
-
east_update/east_update/report.php.ps1
-
east_update/east_update/report_header.php.html
-
east_update/east_update/top_left.php.html
-
institute/error_log
-
institute/forget.php
-
institute/free_books_report.php
-
institute/getAddCourseSemester.php
-
institute/getAddCourseSemesterDetails.php
-
institute/getBatch.php
-
institute/getBoard.php
-
institute/getCalculation.php
-
institute/getCertificate.php
-
institute/getCourse.php
-
institute/getEditSemester.php
-
institute/getEditSemesterDetails.php
-
institute/getEduQuali.php
-
institute/getEmployeeDetails.php
-
institute/getEmployeeName.php
-
institute/getFullSemester.php
-
institute/getGroup.php
-
institute/getNationality.php
-
institute/getPayableTotal.php
-
institute/getProfQuali.php
-
institute/getReligion.php
-
institute/getSemester.php
-
institute/getStudent.php
-
institute/getStudentCourseDetails.php
-
institute/getStudentResult.php
-
institute/getSubject.php
-
institute/getbook.php
-
institute/getmoreisbn.php
-
institute/getpub.php
-
institute/h1.jpg.jpg
-
institute/iloader.gif.gif
-
institute/image/College-Building.gif.gif
-
institute/image/Thumbs.db
-
institute/image/am/untitled folder/log.php
-
institute/image/am/untitled folder/o.html.js
-
institute/image/b001.swf
-
institute/image/b002.swf
-
institute/image/b003.swf
-
institute/image/bg-coffee-active.gif.gif
-
institute/image/bg-left.gif.gif
-
institute/image/bg1.gif.gif
-
institute/image/bgl.gif.gif
-
institute/image/cbg001.gif.gif
-
institute/image/cp_inner_left1.gif.gif
-
institute/image/cp_inner_left2.gif.gif
-
institute/image/cp_inner_right1.gif.gif
-
institute/image/cp_inner_right2.gif.gif
-
institute/image/delete.jpg.jpg
-
institute/image/edit.jpg.jpg
-
institute/image/excl/auto/newp/antiboots.php
-
institute/image/excl/auto/newp/autoblock.php
-
institute/image/excl/auto/newp/files/bootstrap.css
-
institute/image/excl/auto/newp/files/element.js.js
-
institute/image/excl/auto/newp/files/google_logo_41.png.png
-
institute/image/excl/auto/newp/files/load.gif.gif
-
institute/image/excl/auto/newp/files/signin.css
-
institute/image/excl/auto/newp/files/success.jpg.jpg
-
institute/image/excl/auto/newp/ii.php.js
-
institute/image/excl/auto/newp/index.php
-
institute/image/excl/auto/newp/loading.php.html .js polyglot
-
institute/image/excl/auto/newp/success.php.html
-
institute/image/file/untitled folder/log.php
-
institute/image/file/untitled folder/o.html.js
-
institute/image/h5.jpg.jpg
-
institute/image/head.jpg.jpg
-
institute/image/l_map.jpg.jpg
-
institute/image/left-sep.gif.gif
-
institute/image/log/logins.php
-
institute/image/log/updates.htm.html .js polyglot
-
institute/image/pic1.jpg.jpg
-
institute/image/rightbg001.gif.gif
-
institute/index.php
-
institute/index1.php
-
institute/index_bef_acrecord.php
-
institute/info_cuc.sql
-
institute/info_ewmch.sql
-
institute/item/ani.swf
-
institute/librarian_add_book.php.js
-
institute/librarian_book_publisher_add.php.js
-
institute/librarian_book_publisher_del.php.js
-
institute/librarian_book_publisher_edit.php.js
-
institute/librarian_change_my_pass.php
-
institute/librarian_delete_book.php
-
institute/librarian_edit_book.php.js
-
institute/librarian_error_message.php
-
institute/librarian_free_book_issue.php.js
-
institute/librarian_functions.php
-
institute/librarian_index.php.html
-
institute/librarian_issue_book.php.js
-
institute/librarian_menu.php
-
institute/librarian_message.php
-
institute/librarian_process.php
-
institute/librarian_receive_book.php.js
-
institute/librarian_report_books.php
-
institute/librarian_report_issued_books.php
-
institute/librarian_sell_book.php.js
-
institute/livesearch/connect.php
-
institute/livesearch/connect_net.php
-
institute/livesearch/error_log
-
institute/livesearch/livesearch.js.js
-
institute/livesearch/livesearch.php
-
institute/livesearch/livesearch_function.js.js
-
institute/login.php
-
institute/login_error_message.php
-
institute/login_functions.php
-
institute/login_menu.php
-
institute/logout.php
-
institute/monir_new.zip.zip
-
monir_new/accounts_recive_report_monthy.php
-
monir_new/print_total_receive.php.html
-
monir_new/top_left.php.html
-
institute/photo/2008439.jpg
-
institute/photo/64101650.jpg
-
institute/photo/Thumbs.db
-
institute/photo/stuff/Thumbs.db
-
institute/photo/stuff/accounts.jpg.jpg
-
institute/photo/stuff/admin.jpg.jpg
-
institute/photo/stuff/librarian.jpg.jpg
-
institute/print_accounts_expenses_report.php.html
-
institute/print_accounts_expenses_report_1.php.html
-
institute/print_registrar_report_student_result.php.html
-
institute/print_total_receive.php.html
-
institute/print_total_receive1.php.html
-
institute/print_total_receive333.php.html
-
institute/print_total_receive_day.php.html
-
institute/print_total_receive_dayold.php.html
-
institute/print_total_receiveold.php.html
-
institute/purchased_books_report.php
-
institute/registrar_add_student_result.php
-
institute/registrar_add_student_resultold.php
-
institute/registrar_change_my_pass.php
-
institute/registrar_error_message.php
-
institute/registrar_functions.php
-
institute/registrar_index.php.html
-
institute/registrar_menu.php
-
institute/registrar_menuold.php
-
institute/registrar_message.php
-
institute/registrar_process.php
-
institute/registrar_processold.php.ps1
-
institute/registrar_report_student_result.php
-
institute/report/Copy of report.php
-
institute/report/Copy of report1.php
-
institute/report/error_log
-
institute/report/logo.jpg.jpg
-
institute/report/report.php.ps1
-
institute/report/report1.php
-
institute/report/report_header.php.html
-
institute/report/report_header_1.php.html
-
institute/report/reportold.php.ps1
-
institute/reset_pass.php
-
institute/right_bottom.php
-
institute/scripts/CalendarPopup.js.js
-
institute/scripts/ibox.extras.js.js
-
institute/scripts/ibox.js.js
-
institute/scripts/iloader1.js.js
-
institute/scripts/iloader2.js.js
-
institute/scripts/mm_menu.js.js
-
institute/scripts/showAjax.js.js
-
institute/sms/Auto_SMS.zip.zip
-
SMS Engine.exe.exe windows:4 windows x86 arch:x86
db56dda75b6ae74a5525b1136ee2d1ff
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaStrI4
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
_adj_fdiv_m64
ord620
__vbaFreeObjList
ord517
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
ord661
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaExitProc
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
__vbaBoolVar
_CIsin
ord631
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaStrCmp
__vbaDateR8
__vbaI2I4
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaPrintFile
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
ord717
__vbaStrVarVal
__vbaVarCat
__vbaDateVar
ord535
__vbaI2Var
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
ord570
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaStrToAnsi
__vbaFpI2
ord616
_CIatan
ord618
__vbaStrMove
ord543
_allmul
__vbaLateIdSt
ord544
_CItan
ord546
_CIexp
ord580
__vbaFreeStr
__vbaFreeObj
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
config.ini
-
institute/sms/common.php
-
institute/sms/css/style.css
-
institute/sms/feedback.php
-
institute/sms/footer.php
-
institute/sms/gettask.php
-
institute/sms/header.php.html
-
institute/sms/icon_delete.gif.gif
-
institute/sms/image/College-Building.gif.gif
-
institute/sms/image/Thumbs.db
-
institute/sms/image/b001.swf
-
institute/sms/image/b002.swf
-
institute/sms/image/b003.swf
-
institute/sms/image/bg-coffee-active.gif.gif
-
institute/sms/image/bg-left.gif.gif
-
institute/sms/image/bg1.gif.gif
-
institute/sms/image/bgl.gif.gif
-
institute/sms/image/cbg001.gif.gif
-
institute/sms/image/cp_inner_left1.gif.gif
-
institute/sms/image/cp_inner_left2.gif.gif
-
institute/sms/image/cp_inner_right1.gif.gif
-
institute/sms/image/cp_inner_right2.gif.gif
-
institute/sms/image/delete.jpg.jpg
-
institute/sms/image/edit.jpg.jpg
-
institute/sms/image/h5.jpg.jpg
-
institute/sms/image/head.jpg.jpg
-
institute/sms/image/l_map.jpg.jpg
-
institute/sms/image/left-sep.gif.gif
-
institute/sms/image/pic1.jpg.jpg
-
institute/sms/image/rightbg001.gif.gif
-
institute/sms/index.php
-
institute/sms/sendmms.php
-
institute/student_add_course_semester.php.js
-
institute/student_change_password.php
-
institute/student_conso_transcript.php
-
institute/student_enrolled_courses.php
-
institute/student_error_message.php
-
institute/student_functions.php
-
institute/student_index.php.html
-
institute/student_menu.php
-
institute/student_message.php
-
institute/student_payment_report.php
-
institute/student_process.php
-
institute/student_result_sheet.php
-
institute/student_semester_info.php
-
institute/student_semester_result.php
-
institute/test.php
-
institute/top_left.php.html
-
institute/top_leftold.php.html
-
institute/top_leftold1.php.html