General

  • Target
    a9360745871d11e86208dfc05389ed87_JaffaCakes118
  • Size 18.5MB
  • Sample240614-mk5kdszhpr
  • SHA256 654eebb38506e36b159f0dda7b316e2b726548145a179cec49b32bb030d5aba8
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

File Explorer

  • a9360745871d11e86208dfc05389ed87_JaffaCakes118
    .exe 18.5MB
  • $PLUGINSDIR/ButtonEvent.dll
    .dll 5KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $PLUGINSDIR/a/$_110_
    .dll 1.4MB
  • $PLUGINSDIR/execDos.dll
    .dll 5KB
  • $PLUGINSDIR/g/PF-Chrome-2018.exe
    .exe 1.1MB
  • $PLUGINSDIR/System.dll
    .dll 23KB
  • $PLUGINSDIR/g/PF-Toolbar-2016.exe
    .exe 820KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $TEMP/GoogleUpdateSetup_1.3.21.169.exe
    .exe 799KB
  • $PLUGINSDIR/g/gcapi_dll.dll
    .dll 348KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1025.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1026.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1027.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1028.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1029.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1030.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1031.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1032.html
    .html 4KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1033.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1034.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1035.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1036.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1037.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1038.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1040.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1041.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1042.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1043.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1044.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1045.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1046.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1048.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1049.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1050.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1051.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1053.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1054.html
    .html 4KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1055.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1057.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1058.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1060.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1061.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1062.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1066.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_1102.html
    .html 4KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_2052.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_2070.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/ComboOffer_3098.html
    .html 3KB
  • $PLUGINSDIR/g/gcombo/combo-offer.png
    .png 7KB
  • $PLUGINSDIR/g/gtapi_signed.dll
    .dll 71KB
  • $PLUGINSDIR/g/gtb/toolbar-offer.png
    .png 67KB
  • $PLUGINSDIR/g/gtb/toolbar_1025.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1026.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1027.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1028.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1029.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1030.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1031.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1032.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1033.html
    2KB
  • $PLUGINSDIR/g/gtb/toolbar_1034.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1035.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1036.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1037.html
    .html 1KB
  • $PLUGINSDIR/g/gtb/toolbar_1038.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1040.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1041.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1042.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1043.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1044.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1045.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1046.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1048.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1049.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1050.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1051.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1053.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1054.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1055.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1057.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1058.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1060.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1061.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1062.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1066.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_1102.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_2052.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_2070.html
    1KB
  • $PLUGINSDIR/g/gtb/toolbar_3098.html
    1KB
  • $PLUGINSDIR/g/pfWWW.dll
    .dll 148KB
  • $PLUGINSDIR/inetc.dll
    .dll 23KB
  • $PLUGINSDIR/modern-header.bmp
    2KB
  • $PLUGINSDIR/modern-wizard.bmp
    9KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/nsProcess.dll
    .dll 4KB
  • $_104_/$_104_/pfBL.dll
    .dll 1.9MB
  • $_134_/$_134_/pfUI.dll
    .dll 4.9MB
  • $_135_/CC_logo_72x66.png
    .png 7KB
  • $_135_/Montserrat-Regular.otf
    44KB
  • $_135_/PF_computer.png
    .png 87KB
  • $_135_/PF_logo.png
    .png 3KB
  • $_135_/lang-1025.dll
    .dll 88KB
  • $_135_/lang-1026.dll
    .dll 94KB
  • $_135_/lang-1027.dll
    .dll 100KB
  • $_135_/lang-1028.dll
    .dll 61KB
  • $_135_/lang-1029.dll
    .dll 92KB
  • $_135_/lang-1030.dll
    .dll 93KB
  • $_135_/lang-1031.dll
    .dll 97KB
  • $_135_/lang-1032.dll
    .dll 109KB
  • $_135_/lang-1034.dll
    .dll 101KB
  • $_135_/lang-1035.dll
    .dll 99KB
  • $_135_/lang-1036.dll
    .dll 106KB
  • $_135_/lang-1037.dll
    .dll 80KB
  • $_135_/lang-1038.dll
    .dll 101KB
  • $_135_/lang-1040.dll
    .dll 100KB
  • $_135_/lang-1041.dll
    .dll 63KB
  • $_135_/lang-1042.dll
    .dll 73KB
  • $_135_/lang-1043.dll
    .dll 105KB
  • $_135_/lang-1044.dll
    .dll 92KB
  • $_135_/lang-1045.dll
    .dll 98KB
  • $_135_/lang-1046.dll
    .dll 100KB
  • $_135_/lang-1048.dll
    .dll 92KB
  • $_135_/lang-1049.dll
    .dll 89KB
  • $_135_/lang-1050.dll
    .dll 100KB
  • $_135_/lang-1051.dll
    .dll 94KB
  • $_135_/lang-1052.dll
    .dll 93KB
  • $_135_/lang-1053.dll
    .dll 96KB
  • $_135_/lang-1054.dll
    .dll 91KB
  • $_135_/lang-1055.dll
    .dll 93KB
  • $_135_/lang-1057.dll
    .dll 97KB
  • $_135_/lang-1058.dll
    .dll 94KB
  • $_135_/lang-1059.dll
    .dll 96KB
  • $_135_/lang-1060.dll
    .dll 97KB
  • $_135_/lang-1061.dll
    .dll 95KB
  • $_135_/lang-1062.dll
    .dll 96KB
  • $_135_/lang-1063.dll
    .dll 95KB
  • $_135_/lang-1065.dll
    .dll 91KB
  • $_135_/lang-1066.dll
    .dll 90KB
  • $_135_/lang-1067.dll
    .dll 90KB
  • $_135_/lang-1068.dll
    .dll 91KB
  • $_135_/lang-1071.dll
    .dll 98KB
  • $_135_/lang-1079.dll
    .dll 93KB
  • $_135_/lang-1081.dll
    .dll 94KB
  • $_135_/lang-1087.dll
    .dll 89KB
  • $_135_/lang-1090.dll
    .dll 99KB
  • $_135_/lang-1092.dll
    .dll 89KB
  • $_135_/lang-1102.dll
    .dll 94KB
  • $_135_/lang-1104.dll
    .dll 92KB
  • $_135_/lang-1109.dll
    .dll 96KB
  • $_135_/lang-1110.dll
    .dll 91KB
  • $_135_/lang-1155.dll
    .dll 104KB
  • $_135_/lang-2052.dll
    .dll 53KB
  • $_135_/lang-2070.dll
    .dll 100KB
  • $_135_/lang-2074.dll
    .dll 94KB
  • $_135_/lang-3098.dll
    .dll 94KB
  • $_135_/lang-5146.dll
    .dll 96KB
  • $_135_/lang-9999.dll
    .dll 95KB
  • CCUpdate.exe
    .exe 604KB
  • CCleaner.exe
    .exe 14.0MB
  • CCleaner64.exe
    .exe 18.7MB
  • Lang/lang-1025.dll
    .dll 88KB
  • Lang/lang-1026.dll
    .dll 94KB
  • Lang/lang-1027.dll
    .dll 100KB
  • Lang/lang-1028.dll
    .dll 61KB
  • Lang/lang-1029.dll
    .dll 92KB
  • Lang/lang-1030.dll
    .dll 93KB
  • Lang/lang-1031.dll
    .dll 97KB
  • Lang/lang-1032.dll
    .dll 109KB
  • Lang/lang-1034.dll
    .dll 101KB
  • Lang/lang-1035.dll
    .dll 99KB
  • Lang/lang-1036.dll
    .dll 106KB
  • Lang/lang-1037.dll
    .dll 80KB
  • Lang/lang-1038.dll
    .dll 101KB
  • Lang/lang-1040.dll
    .dll 100KB
  • Lang/lang-1041.dll
    .dll 63KB
  • Lang/lang-1042.dll
    .dll 73KB
  • Lang/lang-1043.dll
    .dll 105KB
  • Lang/lang-1044.dll
    .dll 92KB
  • Lang/lang-1045.dll
    .dll 98KB
  • Lang/lang-1046.dll
    .dll 100KB
  • Lang/lang-1048.dll
    .dll 92KB
  • Lang/lang-1049.dll
    .dll 89KB
  • Lang/lang-1050.dll
    .dll 100KB
  • Lang/lang-1051.dll
    .dll 94KB
  • Lang/lang-1052.dll
    .dll 93KB
  • Lang/lang-1053.dll
    .dll 96KB
  • Lang/lang-1054.dll
    .dll 91KB
  • Lang/lang-1055.dll
    .dll 93KB
  • Lang/lang-1057.dll
    .dll 97KB
  • Lang/lang-1058.dll
    .dll 94KB
  • Lang/lang-1059.dll
    .dll 96KB
  • Lang/lang-1060.dll
    .dll 97KB
  • Lang/lang-1061.dll
    .dll 95KB
  • Lang/lang-1062.dll
    .dll 96KB
  • Lang/lang-1063.dll
    .dll 95KB
  • Lang/lang-1065.dll
    .dll 91KB
  • Lang/lang-1066.dll
    .dll 90KB
  • Lang/lang-1067.dll
    .dll 90KB
  • Lang/lang-1068.dll
    .dll 91KB
  • Lang/lang-1071.dll
    .dll 98KB
  • Lang/lang-1079.dll
    .dll 93KB
  • Lang/lang-1081.dll
    .dll 94KB
  • Lang/lang-1087.dll
    .dll 89KB
  • Lang/lang-1090.dll
    .dll 99KB
  • Lang/lang-1092.dll
    .dll 89KB
  • Lang/lang-1102.dll
    .dll 94KB
  • Lang/lang-1104.dll
    .dll 92KB
  • Lang/lang-1109.dll
    .dll 96KB
  • Lang/lang-1110.dll
    .dll 91KB
  • Lang/lang-1155.dll
    .dll 104KB
  • Lang/lang-2052.dll
    .dll 53KB
  • Lang/lang-2070.dll
    .dll 100KB
  • Lang/lang-2074.dll
    .dll 94KB
  • Lang/lang-3098.dll
    .dll 94KB
  • Lang/lang-5146.dll
    .dll 96KB
  • Lang/lang-9999.dll
    .dll 95KB
  • branding.dll
    .dll 57KB
  • uninst.exe
    .exe 923KB
  • $PLUGINSDIR/LangDLL.dll
    .dll 5KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • $PLUGINSDIR/inetc.dll
    .dll 23KB
  • $PLUGINSDIR/modern-header.bmp
    2KB
  • $PLUGINSDIR/modern-wizard.bmp
    9KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/nsProcess.dll
    .dll 4KB
  • $_104_/$_104_/pfBL.dll
    .dll 1.9MB

a9360745871d11e86208dfc05389ed87_JaffaCakes118

  • IMPHASH 377a97652fdf5740d8cc11d5ce124fed
  • SHA256 654eebb38506e36b159f0dda7b316e2b726548145a179cec49b32bb030d5aba8
  • MD5 SHA1 SHA512 SSDEEP
Digest
25:5a:45:a7:c6:0e:35:71:32:39:df:68:c7:6a:ad:c3:3d:93:38:2e:4e:56:89:b0:0e:59:8d:88:c3:31:59:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB

PE Signature issue

Digest
d8:f3:95:2f:88:72:5e:49:f2:d7:fe:95:b4:56:7d:1b:ca:00:9c:79
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Piriform Software Ltd,O=Piriform Software Ltd,L=London,C=GB
Chains

Feb 12, 2019

Minor OS version
0
Major OS version
5
Entry point
14876
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths