Overview

overview

8

Static

static

8

259c009732...18.exe

windows7-x64

7

259c009732...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

Code/Execute.exe

windows7-x64

1

Code/Execute.exe

windows10-2004-x64

1

Code/Start...rd.exe

windows7-x64

1

Code/Start...rd.exe

windows10-2004-x64

1

Code/Start...on.exe

windows7-x64

1

Code/Start...on.exe

windows10-2004-x64

1

Code/Test ...on.exe

windows7-x64

1

Code/Test ...on.exe

windows10-2004-x64

1

Code/XLTemplatePC.xls

windows7-x64

1

Code/XLTemplatePC.xls

windows10-2004-x64

1

Code/insta...rt.cmd

windows7-x64

1

Code/insta...rt.cmd

windows10-2004-x64

1

Code/insta...rt.cmd

windows7-x64

8

Code/insta...rt.cmd

windows10-2004-x64

8

Code/pdfviewer.exe

windows7-x64

1

Code/pdfviewer.exe

windows10-2004-x64

1

Code/regis...er.cmd

windows7-x64

1

Code/regis...er.cmd

windows10-2004-x64

1

Code/sfk.exe

windows7-x64

1

Code/sfk.exe

windows10-2004-x64

1

Code/sgd.exe

windows7-x64

1

Code/sgd.exe

windows10-2004-x64

1

Code/stop service.cmd

windows7-x64

1

Code/stop service.cmd

windows10-2004-x64

1

Code/testpdf.cmd

windows7-x64

3

Code/testpdf.cmd

windows10-2004-x64

7

Code/testpdf.pdf

windows7-x64

1

Code/testpdf.pdf

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    259c0097328816b607375e3a739642ed_JaffaCakes118

  • Size

    4.1MB

  • MD5

    259c0097328816b607375e3a739642ed

  • SHA1

    8636a2d9f9bafb2ae16aa9364c6875bc5c7bb1fa

  • SHA256

    b7f210dbfe383522954656d839e5bea626d20de4a4c2ab8d61976d42a744f094

  • SHA512

    48d81ca4b8c9340491443db0c32ebfa6e51fadac46e0945369f62f00d4ee992d4248f82eb3ba44bd81b253970ef5d2a5b1171470ce534fa19bacf1c5aafd995d

  • SSDEEP

    98304:UUn1BeJrUzLS32qCnt4N3G9LPkCrfVACBPhK6dWyBWoHH1zkUMUMUR:UUToEyTCnqQ979fnBPVWjo2UMUMUR

Score
8/10
macromacro_on_actionupx

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 259c0097328816b607375e3a739642ed_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    4d17be67c8d0394c5c1b8e725359ed89


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    c4fa86e78b598d87f225e209ba30786f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PROFILE/Application Data/Sun/Java/Deployment/security/trusted.certs
  • $PROFILE/Application Data/Sun/Java/Deployment/security/trusted.jssecerts
  • $PROFILE/Local Settings/Application Data/Sun/SSGD/certstore.pem
  • $PROFILE/Local Settings/Application Data/Sun/SSGD/hostsvisited
  • Code/Execute.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Code/Start Dashboard.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Code/Start Session.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Code/Test Connection.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Code/XLTemplatePC.xlt
    .xls .xlt windows office2003

    Sheet1

    ThisWorkbook

    Sheet2

    mod_AutoOpen

  • Code/ca.pem
  • Code/install firefox ssl_cert.cmd
  • Code/install ie ssl_cert.cmd
  • Code/pdfviewer.exe
    .exe windows:4 windows x86 arch:x86

    c659addef37be4de6372fa9719c92a7a


    Code Sign

    Headers

    Imports

    Sections

  • Code/readme.txt
  • Code/register pdfviewer.cmd
  • Code/sfk.exe
    .exe windows:4 windows x86 arch:x86

    def980b65401f7b3f983c63def0c5722


    Headers

    Imports

    Sections

  • Code/sgd.exe
    .exe windows:4 windows x86 arch:x86

    a6b73c78451ce4906e6987d3068e9a2f


    Headers

    Imports

    Sections

  • Code/ssl_cert.cer
  • Code/stop service.cmd
  • Code/testpdf.cmd
  • Code/testpdf.pdf
    .pdf
  • Code/winscp382.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Code/winscp382.ini
  • app.txt
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    4d17be67c8d0394c5c1b8e725359ed89


    Headers

    Imports

    Sections