Overview

overview

7

Static

static

7

0c15cd873a...18.exe

windows7-x64

7

0c15cd873a...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

OE.dll

windows7-x64

3

OE.dll

windows10-2004-x64

3

OE4.dll

windows7-x64

1

OE4.dll

windows10-2004-x64

1

TheBAT.dll

windows7-x64

1

TheBAT.dll

windows10-2004-x64

1

UnACE.dll

windows7-x64

3

UnACE.dll

windows10-2004-x64

3

UnARJ.dll

windows7-x64

1

UnARJ.dll

windows10-2004-x64

1

UnMSCAB.dll

windows7-x64

1

UnMSCAB.dll

windows10-2004-x64

1

VirusRescue.exe

windows7-x64

7

VirusRescue.exe

windows10-2004-x64

7

asc4.dll

windows7-x64

1

asc4.dll

windows10-2004-x64

1

kernel40.dll

windows7-x64

7

kernel40.dll

windows10-2004-x64

7

pl.dll

windows7-x64

3

pl.dll

windows10-2004-x64

3

stopapi4.dll

windows7-x64

7

stopapi4.dll

windows10-2004-x64

7

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    0c15cd873a5362317ba3c69740aed6cf_JaffaCakes118

  • Size

    4.8MB

  • MD5

    0c15cd873a5362317ba3c69740aed6cf

  • SHA1

    6d7b2f1a2acaac488676371b110087b02502f86e

  • SHA256

    d2cd6ab550a34bf74cc3f62d77cd4dc3cf3e32209392e2ff1f72d4a5b8866bde

  • SHA512

    86b558599db24ccbae2af00a686098a3ddeb5b49353748b3545fce92bcadd11e44840946a3017478c4cdb6d2b896d6cda59bc31751a4524d185698c1f71eeb6f

  • SSDEEP

    98304:mgyumC8us0H9pkqRLttfPeEwp8vQHE3IV7ilzfBvKvF/2vx2/ywK+rn:BmSbdpXV3fjwp8l3IV7il7BvKvpox27p

Score
7/10
aspackv2upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 0c15cd873a5362317ba3c69740aed6cf_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Languages/english.ini
  • OE.api
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • OE4.api
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • TheBAT.api
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • UnACE.api
    .dll windows:1 windows x86 arch:x86

    fbf4b91fbc5290dae1c49b4d40efb912


    Headers

    Imports

    Exports

    Sections

  • UnARJ.api
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • UnMSCAB.api
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • VirusRescue.exe
    .exe windows:4 windows x86 arch:x86

    aaa734bdf233e7b6248c47353f08a15f


    Headers

    Imports

    Sections

  • VirusRescue.tlb
  • asc4.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • backdoor.avb
  • base.dat
  • ca.avb
  • config.ini
  • daily.avb
  • kernel4.avb
  • kernel40.dll
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:1 windows x86 arch:x86


    Headers

    Sections

  • malware.avb
  • pl.dll
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • stop.set
  • stopapi4.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • tips.txt
  • trojan.avb
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • unrar.api
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • unzip.api
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • updater.plb
  • virusdos.avb
  • virusw32.avb
  • vrExt.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    726a9bab706b5d31cfebc8dc850347c4


    Headers

    Imports

    Exports

    Sections

  • vrsvc.exe
    .exe windows:4 windows x86 arch:x86

    cf33961a0721c89ef85b4c8a9612e4d0


    Headers

    Imports

    Sections

  • weekly.avb