Overview

overview

6

Static

static

3

24041e38d0...18.exe

windows7-x64

3

24041e38d0...18.exe

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$TEMP/~nsi...ad.dll

windows7-x64

1

$TEMP/~nsi...ad.dll

windows10-2004-x64

1

$WINDIR/Sy...vc.exe

windows7-x64

1

$WINDIR/Sy...vc.exe

windows10-2004-x64

1

cloud-web_run.exe

windows7-x64

1

cloud-web_run.exe

windows10-2004-x64

1

cloud-web_...96.exe

windows7-x64

1

cloud-web_...96.exe

windows10-2004-x64

1

cloudwebin.dll

windows7-x64

6

cloudwebin.dll

windows10-2004-x64

6

cloudwebinnad.dll

windows7-x64

1

cloudwebinnad.dll

windows10-2004-x64

1

cloudwebintb.dll

windows7-x64

1

cloudwebintb.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    24041e38d01754a5d1bef1b93a4ba872_JaffaCakes118

  • Size

    750KB

  • MD5

    24041e38d01754a5d1bef1b93a4ba872

  • SHA1

    262ff7e6435315a708b325993ed1383ba970b01a

  • SHA256

    4698edea099d0527453bc77047a95f8ba7effefc1950aade26021052df414380

  • SHA512

    5affe6521a55860d6921b8158628f565eb611c11db7779fa16f02a7b4563ea2e16d11795629d7f453aee93c721b2f7fff637729d943dddebd9727bb0d7d00b7c

  • SSDEEP

    12288:8cqAwTj7sGpz46xnxOdmzo8v7ZrXQYSHCllnU/P9L5qz66xn3Ozmkoz3V:bqdgG946xxOczo8v7ZiHCY066x3Oavl

Score
3/10

Malware Config

Signatures

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 24041e38d01754a5d1bef1b93a4ba872_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/tmp.ini
  • $TEMP/~nsis/s40007/cloudwebinnad.dll
    .dll windows:4 windows x86 arch:x86

    47db5f6ea045b5e9c353754e408a7c6e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $WINDIR/System32/cldiasvc.exe
    .exe windows:4 windows x86 arch:x86

    865a4699dc989a6c4020da5d4bc37278


    Code Sign

    Headers

    Imports

    Sections

  • cloud-web_run.ex_
    .exe windows:4 windows x86 arch:x86

    ddd73f1778b2b258d98cb7513f53b79c


    Code Sign

    Headers

    Imports

    Sections

  • cloud-web_svc_2_96.ex_
    .exe windows:4 windows x86 arch:x86

    5eb5605105dd037280c95d1ee86efa67


    Code Sign

    Headers

    Imports

    Sections

  • cloudwebin.dl_
    .dll regsvr32 windows:4 windows x86 arch:x86

    3349570131fbaa69ef5ccbf0c5cb1ade


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cloudwebinnad.dl_
    .dll windows:4 windows x86 arch:x86

    47db5f6ea045b5e9c353754e408a7c6e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cloudwebintb.dl_
    .dll regsvr32 windows:4 windows x86 arch:x86

    62aae4a780185490b96a2db14f7f901b


    Code Sign

    Headers

    Imports

    Exports

    Sections