General

  • Target
    25db368cc7c0308d014ce0397bd7adac_JaffaCakes118
  • Size 3.9MB
  • Sample240704-xffqksvgrd
  • SHA256 d2623ed0469b4a7a8f9371cb91bad7bb803564bdda76fdcc5972905edb12f8b9
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

File Explorer

  • 25db368cc7c0308d014ce0397bd7adac_JaffaCakes118
    .exe 3.9MB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/LangDLL.dll
    .dll 5KB
  • $PLUGINSDIR/NSISdl.dll
    .dll 14KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • CCleaner.exe
    .exe 1.6MB
  • Microsoft.VC80.CRT.manifest
    .xml 522B
  • Microsoft.VC90.CRT.manifest
    1KB
  • Microsoft.mshtml.dll
    .dll 7.6MB
  • cafw.exe.config
    .xml 1KB
  • decaptcher.dll
    .dll 72KB
  • eula.txt
    15KB
  • fbclient.dll
    .dll 3.6MB
  • firebird.conf
    26KB
  • firebird.msg
    144KB
  • holfix.exe
    .exe 256KB
  • out.upx
    .exe 733KB
  • ibprovider.dll
    .dll 22KB
  • icudt30.dll
    .dll 1.5MB
  • icuin30.dll
    .dll 408KB
  • icuuc30.dll
    .dll 660KB
  • msvcp80.dll
    .dll 536KB
  • msvcp90.dll
    .dll 556KB
  • msvcr80.dll
    .dll 612KB
  • msvcr90.dll
    .dll 637KB
  • wm_hooks.dll
    .dll 449KB

25db368cc7c0308d014ce0397bd7adac_JaffaCakes118

  • IMPHASH 099c0646ea7282d232219f8807883be0
  • SHA256 d2623ed0469b4a7a8f9371cb91bad7bb803564bdda76fdcc5972905edb12f8b9
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

  • NSIS installer

Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths