General

  • Target

    afd2fb0c91a2e9eb65c4ae0cd8a7987a_JaffaCakes118

  • Size

    12.7MB

  • MD5

    afd2fb0c91a2e9eb65c4ae0cd8a7987a

  • SHA1

    2359dc79d8fba380ad6a28f722edd11b6658a4eb

  • SHA256

    681b379575500ad42d6d212ac2508dbf30f8b38f55564cdc9009d845d547430a

  • SHA512

    c1d99efcc9f1ccc8204f0b628b780075732d8c44d1bd5745a16bdcf9fbc4941d7c03a197009d554e6be169f7df2b6af7d92b7b286e995155fb4ae4aa1192571d

  • SSDEEP

    196608:+ZxoMSVxguRYOKix7wBoKLxnVww9N4rTJjPvZ+xUCTsKltG0UEdh:+zoMod5wmK1nVd4rTJLvZ2UqsStG0U+h

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 59 IoCs

    Checks for missing Authenticode signature.

Files

  • afd2fb0c91a2e9eb65c4ae0cd8a7987a_JaffaCakes118
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Restoro/AV/HBEDV.KEY
  • $APPDATA/Restoro/AV/avupdate.exe
    .exe windows:5 windows x86 arch:x86

    7c6cb5f857b8c5f712b3cf62b62d8ff0


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Restoro/AV/avupdate_msg.avr
  • $APPDATA/Restoro/AV/cacert.crt
  • $APPDATA/Restoro/AV/msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Restoro/AV/productname.dat
  • $APPDATA/Restoro/AV/savapi.exe
    .exe windows:5 windows x86 arch:x86

    5bb154ead68c0dd9be1ce94c1ed7db00


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Restoro/AV/savapi_restart.exe
    .exe windows:5 windows x86 arch:x86

    90f7250647f81578737a004ab858c26d


    Headers

    Imports

    Sections

  • $APPDATA/Restoro/AV/savapi_stub.exe
    .exe windows:5 windows x86 arch:x86

    0db532abe0984e99866008e5b84ceb8e


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Restoro/TechSupportApp.ini
  • $PLUGINSDIR/AccessControl.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/DcryptDll.dll
    .dll windows:5 windows x86 arch:x86

    1daf45fd074126f5eabcc532bc3e5bf5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    3f0fda09180f619ca116344bede41608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/RestoroUpdater.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AccessControl.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    3f0fda09180f619ca116344bede41608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stack.dll
    .dll windows:4 windows x86 arch:x86

    454e327924e76e3c69e4915b2b6f1a25


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:5 windows x86 arch:x86

    5bbd63919e9f724979e2ebcc7e04a7e6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/installer-164x314.bmp
  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stack.dll
    .dll windows:4 windows x86 arch:x86

    454e327924e76e3c69e4915b2b6f1a25


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:5 windows x86 arch:x86

    5bbd63919e9f724979e2ebcc7e04a7e6


    Headers

    Imports

    Exports

    Sections

  • LZMA.EXE
    .exe windows:4 windows x86 arch:x86

    1c97b14bd77b27568e0f4c0abc6f72d9


    Headers

    Imports

    Sections

  • Restoro.dat
  • RestoroAM.exe
    .exe windows:5 windows x86 arch:x86

    9db9c263185805291883a984bffc4867


    Code Sign

    Headers

    Imports

    Sections

  • RestoroMain.exe
    .exe windows:6 windows x64 arch:x64

    a3407eac0d6030e3719d4f47eb7c0242


    Code Sign

    Headers

    Imports

    Sections

  • RestoroSafeMode.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    3f0fda09180f619ca116344bede41608


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • Restoro_SafeMode.ico
  • Restoro_uninstall.ico
  • Restoro_website.ico
  • Restoroicon.ico
  • TechSupportApp.exe
    .exe windows:6 windows x64 arch:x64

    520222431250455e8b47f08110b0067b


    Code Sign

    Headers

    Imports

    Sections

  • engine.dat
  • msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • savapi.dll
    .dll windows:6 windows x86 arch:x86

    062ab4da52cf6b371ee1577f253cd6cc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AccessControl.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/Banner.dll
    .dll windows:5 windows x86 arch:x86

    beba03bbad1f8d79d5b3c1359e913e0d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    a5d239ed12c9442d63c73cb9ff7cad0e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/GetVersion.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/LogEx.dll
    .dll windows:4 windows x86 arch:x86

    549d7b44067bbcdf42bf6a90a80a3a9e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Restoro_desktop.ico
  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WmiInspector.dll
    .dll windows:5 windows x86 arch:x86

    7f0e53ce204644197ed8a4abb8792a26


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    86cdacc6fa5e3ff4938d358350751516


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/installer-164x314.bmp
  • $PLUGINSDIR/installer-497x57.bmp
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/rCrypt.dll
    .dll windows:5 windows x86 arch:x86

    1671686fd0e54187e7363776a72a11bf


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    421a02aae559045e04759aae146087eb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:5 windows x86 arch:x86

    5bbd63919e9f724979e2ebcc7e04a7e6


    Headers

    Imports

    Exports

    Sections

  • $TEMP/RestoroUninstall.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $_174_/RestoroUninstall.exe
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections