General

  • Target

    b0bbf65444328c4819249e583652d27f_JaffaCakes118

  • Size

    5.2MB

  • MD5

    b0bbf65444328c4819249e583652d27f

  • SHA1

    5c93caf5ba8941138dc1c621487fe65a12d6fcb2

  • SHA256

    af96ec6b221ffe88fa55a825f2ec593485436cab7fda8fd3cf87171e98eeb932

  • SHA512

    8613b759fd936bbf56895edba9f9dd6e6e954b909b7261ae9d9edcbc740f98ec78868c3e70b5b21a986f75e963a503c540f3d95f0081fe947a2a4ba7b8a61b30

  • SSDEEP

    98304:6ikNqC/9lijqIPHjfkXHv7Wgv3KoCgc8t8h79TpffLFKyZ+zdWBZ+zdn:zkNfSGIPLSjBPK11y859JfZb1g

Score
9/10

Malware Config

Signatures

  • Detectes NiceHashMiner Payload 1 IoCs
  • HTTP links in PDF interactive object 2 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

Files

  • b0bbf65444328c4819249e583652d27f_JaffaCakes118
    .zip
  • AMDOpenCLDeviceDetection.exe
    .exe windows:6 windows x64 arch:x64

    cf2ed5911d0a7071b83cf40f4a0a223c


    Code Sign

    Headers

    Imports

    Sections

  • CudaDeviceDetection.exe
    .exe windows:6 windows x64 arch:x64

    55ea1fa686b413ae0d6d5c0ae081ef6a


    Headers

    Imports

    Exports

    Sections

  • EULA.txt
  • Get_started.pdf
    .pdf
    • https://bitgo.zendesk.com/hc/en-us/articles/208001396-How-do-I-create-a-wallet-

    • https://support.coinbase.com/customer/en/portal/articles/1027432-where-is-my-wallet-address-

    • https://www.bitgo.com/wallet

    • https://www.coinbase.com/signup

    • https://www.nicehash.com/

    • https://www.nicehash.com/?p=register

  • Get_started_RU.pdf
    .pdf
    • https://www.nicehash.com/

  • LinqBridge.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MessageBoxManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MessageBoxManager.pdb
  • MyDownloader.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MyDownloader.Core.pdb
  • MyDownloader.Extension.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MyDownloader.Extension.pdb
  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • NiceHashMinerLegacy.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • NiceHashMinerLegacy.pdb
  • OnGPUsLost.bat
    .bat .vbs
  • SQLite.Net.Platform.Generic.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SQLite.Net.Platform.Win32.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SQLite.Net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SharpCompress.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • System.Data.SQLite.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • check_all_AMD.bat
  • check_all_NVIDIA.bat
  • common/OpenCL.dll
    .dll windows:6 windows x64 arch:x64

    de8c598b67d0b917100bcaab4ee83b83


    Headers

    Imports

    Exports

    Sections

  • common/cudart32_80.dll
    .dll windows:5 windows x86 arch:x86

    4b32cb13a1d12d18a9a2c05e9e82a47d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • common/cudart64_80.dll
    .dll windows:5 windows x64 arch:x64

    52a5a93fc9a8a28f27072ecb922043dc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • common/cudart64_91.dll
    .dll windows:5 windows x64 arch:x64

    0ec3f1a513d55b2bb58f5e290dcf76bb


    Headers

    Imports

    Exports

    Sections

  • common/libcurl.dll
    .dll windows:6 windows x64 arch:x64

    6b739c9203381ef46e8fa3d976a90f60


    Headers

    Imports

    Exports

    Sections

  • common/msvcp120.dll
    .dll windows:6 windows x86 arch:x86

    6ccda270a497a2c5a36a7f385cc9910d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • common/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    c3bac5b277d6a19414754b3ea09dbe12


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • common/msvcr110.dll
    .dll windows:6 windows x64 arch:x64

    2d8550b19d324144e95b49aae32a0dca


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • common/msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • common/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    f49ac71a58dd00b20fff27fd20515fff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cpuid.dll
    .dll windows:6 windows x64 arch:x64

    28f2f26cf04359b10cfb6751ae151104


    Headers

    Imports

    Exports

    Sections

  • langs/bg.lang
  • langs/en.lang
  • langs/es.lang
  • langs/it.lang
  • langs/pl.lang
  • langs/pt.lang
  • langs/ro.lang
  • langs/ru.lang
  • langs/zh_cn.lang
  • log4net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • msvcp120.dll
    .dll windows:6 windows x86 arch:x86

    6ccda270a497a2c5a36a7f385cc9910d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nvidiasetp0state.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • nvidiasetp0state.pdb
  • nvml.dll
    .dll windows:6 windows x64 arch:x64

    8aa9b7ac2a8c0c9845706fb07b4c269c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • setcpuaff.exe
    .exe windows:6 windows x64 arch:x64

    9e5dd170ccd6602b27263869c3fe7bab


    Code Sign

    Headers

    Imports

    Sections

  • websocket-sharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • x64/SQLite.Interop.dll
    .dll windows:6 windows x64 arch:x64

    9c208621f87838d81aaabd3b0bd652ba


    Headers

    Imports

    Exports

    Sections