Overview

overview

8

Static

static

3

01f7e1f9cf...18.exe

windows7-x64

1

01f7e1f9cf...18.exe

windows10-2004-x64

1

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/Ktobj.dll

windows7-x64

6

$SYSDIR/Ktobj.dll

windows10-2004-x64

6

$SYSDIR/Log.dll

windows7-x64

1

$SYSDIR/Log.dll

windows10-2004-x64

1

$SYSDIR/Update.dll

windows7-x64

1

$SYSDIR/Update.dll

windows10-2004-x64

3

$SYSDIR/lrcsys.exe

windows7-x64

1

$SYSDIR/lrcsys.exe

windows10-2004-x64

1

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

kooting.exe

windows7-x64

8

kooting.exe

windows10-2004-x64

8

ktengine.dll

windows7-x64

8

ktengine.dll

windows10-2004-x64

8

lidx.dll

windows7-x64

1

lidx.dll

windows10-2004-x64

3

update/Undate.exe

windows7-x64

3

update/Undate.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    01f7e1f9cf0a45bc9fa80bbe9ae4e676_JaffaCakes118

  • Size

    650KB

  • MD5

    01f7e1f9cf0a45bc9fa80bbe9ae4e676

  • SHA1

    97f135ca12d004702993cd14f83dc2e86623a0c4

  • SHA256

    ac73f4a443ce1850c93afc1c7ffd36bd7fd181905f206ff7a3439745408f2b56

  • SHA512

    efa60e890eba9f9a4bbb1a57e0db27eb9dc03747c9b40965e255ea7534873e144655d48ea7579532dd08aee7dfa1ef1df332596bd71122fad944787079583b38

  • SSDEEP

    12288:Dkebwynb8WBnA5YPFVqRuu7ZS3tFThvasrOBHb+aClrSliInB5+YkOEV:DkebGvcFgHmasrWHb+j+UmB4V

Score
3/10

Malware Config

Signatures

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 01f7e1f9cf0a45bc9fa80bbe9ae4e676_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    bf730599ca246ea6f6df7d7646cab285


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/Ktcmd.img
  • $SYSDIR/Ktlog.img
  • $SYSDIR/Ktobj.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    d1de853b780ce56575114ca564c46546


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Log.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    08efa82a5d0394910e8352d58c447d85


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Update.dll
    .dll windows:4 windows x86 arch:x86

    b4205391d500e47e692bb9dca77765d8


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/lrcsys.exe
    .exe windows:4 windows x86 arch:x86

    a90695606c168dc74ff90837b8ba6d0e


    Headers

    Imports

    Sections

  • Plugin.ini
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    bf730599ca246ea6f6df7d7646cab285


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • face/kwc.img
  • kooting.exe
    .exe windows:4 windows x86 arch:x86

    c4ed3b9cd9b3257f6af7bb2aabd89acb


    Headers

    Imports

    Sections

  • ktengine.dll
    .dll windows:4 windows x86 arch:x86

    ec7c0267b4a80e6e3db84319477958b5


    Headers

    Imports

    Exports

    Sections

  • lidx.dll
    .dll windows:4 windows x86 arch:x86

    dc5fbd8367a9787c2ed0361865278bd2


    Headers

    Imports

    Exports

    Sections

  • update/Undate.exe
    .exe windows:4 windows x86 arch:x86

    1bec43c6e62d9ad75892ecdf6aea3f2b


    Headers

    Imports

    Sections