Overview

overview

7

Static

static

7

2566ebf23c...18.exe

windows7-x64

7

2566ebf23c...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

vfd-ob.exe

windows7-x64

7

vfd-ob.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/fct.dll

windows7-x64

3

$PLUGINSDIR/fct.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

bho_project.dll

windows7-x64

1

bho_project.dll

windows10-2004-x64

1

chromeaddo...ded.js

windows7-x64

3

chromeaddo...ded.js

windows10-2004-x64

3

chromeaddo...d.html

windows7-x64

1

chromeaddo...d.html

windows10-2004-x64

1

chromeaddo...ded.js

windows7-x64

3

chromeaddo...ded.js

windows10-2004-x64

3

firefoxaddon/build.sh

ubuntu-18.04-amd64

3

firefoxaddon/build.sh

debian-9-armhf

3

firefoxaddon/build.sh

debian-9-mips

3

firefoxaddon/build.sh

debian-9-mipsel

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    2566ebf23c8f8ebc136926c1c9de1985_JaffaCakes118

  • Size

    996KB

  • MD5

    2566ebf23c8f8ebc136926c1c9de1985

  • SHA1

    86fcfa6c98a05eaf4f3044d1c001190f9eb27130

  • SHA256

    18f93a9d6e3c7464998f75b60fe660f9ccb0944d27adc5de8228ac9503b4f7e8

  • SHA512

    418a945fb225cd040c1b68e279722aeca48f6452e72119b02560f1496558f69c57d7e909ef1cd2c5c45ac9a6143eb9c994062a58ec9c5d1654de031eb208c810

  • SSDEEP

    24576:KdvYiUcWObYFdMZ3yG869EYy/ymfORuaqPj5O3+4AS/k:4YvcXMFdMZj86Jyz2Ru9W+xMk

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs
    installer

Files

  • 2566ebf23c8f8ebc136926c1c9de1985_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • header.bmp
  • header2.bmp
  • header3.bmp
  • next.bmp
  • skip.bmp
  • vfd-ob.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/fct.dll
    .dll windows:4 windows x86 arch:x86

    ea6c66dd8fdf3fe3fb04ddbc357acc4c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • ChromeAddon.pem
  • bho_project.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    470b42adb8619884c5594da47c09acc6


    Headers

    Imports

    Exports

    Sections

  • chromeaddon/._included.js
  • chromeaddon/background.html
    .html .js polyglot
  • chromeaddon/included.js
    .js
  • chromeaddon/manifest.json
  • firefoxaddon/build.sh
    .sh linux
  • firefoxaddon/chrome.manifest
  • firefoxaddon/config_build.sh
    .sh linux
  • firefoxaddon/content/.DS_Store
  • firefoxaddon/content/firefoxOverlay.xul
    .js .xml polyglot
  • firefoxaddon/content/overlay.js
    .js
  • firefoxaddon/content/sudoku.js
    .js
  • firefoxaddon/defaults/.DS_Store
  • firefoxaddon/defaults/preferences/.DS_Store
  • firefoxaddon/defaults/preferences/._sudoku.js
  • firefoxaddon/defaults/preferences/sudoku.js
  • firefoxaddon/files
  • firefoxaddon/install.rdf
    .xml
  • firefoxaddon/locale/.DS_Store
  • firefoxaddon/locale/en-US/.DS_Store
  • firefoxaddon/locale/en-US/sudoku.dtd
  • firefoxaddon/locale/en-US/sudoku.properties
  • firefoxaddon/readme.txt
  • firefoxaddon/skin/overlay.css
  • vfd-ob_uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • wget.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • wget.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections