General

  • Target

    8d760359b549d03a8abd29b814c3e42c_JaffaCakes118

  • Size

    1.3MB

  • MD5

    8d760359b549d03a8abd29b814c3e42c

  • SHA1

    1ff189782371467c707f9bf1a9102788002e1fa3

  • SHA256

    bd94bc0c1bf818e397f17b3d0ec201bc26baceaf2bb264de5348fc1e2b763c56

  • SHA512

    4cbda28c954a9598d29107ffcb09a7d3437012e87bc880e3c7c7e2cc45ea0665126d8e6542e0cd406f97e11037fb0695a0cdf9da7f740dbbfbeebe5b2171d9f2

  • SSDEEP

    24576:VbyZSFoZw4FVZ46teudv2jn9iqTLjOpRofVr7r9YliO1aNx8UhdhHP8pNABsc:FyUo64fZLeudv2jnsajOpR8VrX9YvgXj

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 8d760359b549d03a8abd29b814c3e42c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    3abe302b6d9a1256e6a915429af4ffd2


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Math.dll
    .dll windows:4 windows x86 arch:x86

    6a7dba1ca35af83a9a3593fbf002fb1e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SelfDel.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    46f8b6973f33717335c0f6d8087de67b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    a49b0342971aa199fc6349725b90146d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisdl.dll
    .dll windows:4 windows x86 arch:x86

    35098e8775f91723e90a28745ef6495b


    Headers

    Imports

    Exports

    Sections

  • $TEMP/7za.dll
    .dll windows:4 windows x86 arch:x86

    d81b60eda1cab1fb301cbc5030fb0921


    Headers

    Imports

    Exports

    Sections

  • $TEMP/7za.exe
    .exe windows:4 windows x86 arch:x86

    bd912273bbf29e21ff00a414f95c84bd


    Headers

    Imports

    Sections

  • $TEMP/Actualizaciones.vbs
    .vbs
  • $TEMP/AnsiToUtf8.vbs
    .vbs
  • $TEMP/AutoUpdate.vbs
    .vbs
  • $TEMP/CStore.vbs
    .vbs
  • $TEMP/CStoreMini.vbs
    .vbs
  • $TEMP/GetIP.vbs
    .vbs
  • $TEMP/Log.sql
  • $TEMP/LogParser.7z
    .7z
  • LogParser.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    2e2b691177bb4205fc4f5eb9fbd1a8d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • LogParser.exe
    .exe windows:5 windows x86 arch:x86

    f20708e1690d12a2c8e19cfda66baa85


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/LogParser.bat
  • $TEMP/SerialNumber.bat
    .bat .vbs
  • $TEMP/blat.dll
    .dll windows:4 windows x86 arch:x86

    0f2e58e30316ca2f77100c6ebc4cafae


    Headers

    Imports

    Exports

    Sections

  • $TEMP/blat.exe
    .exe windows:4 windows x86 arch:x86

    7c62a5893c00ccbedb9fbe141080d3b8


    Headers

    Imports

    Sections

  • $TEMP/capicom.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    817acf67b593a3bed6b4a50e83400d47


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/dump.bat
  • $TEMP/obtenerRed.vbs
    .vbs