Overview

overview

7

Static

static

7

27d4a5df22...18.exe

windows7-x64

7

27d4a5df22...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$SYSDIR/1rs23525.dll

windows7-x64

7

$SYSDIR/1rs23525.dll

windows10-2004-x64

7

wrar380ru.exe

windows7-x64

1

wrar380ru.exe

windows10-2004-x64

1

{7445f2b0-...ain.js

windows7-x64

3

{7445f2b0-...ain.js

windows10-2004-x64

3

{7445f2b0-...ain.js

windows7-x64

3

{7445f2b0-...ain.js

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    27d4a5df22c1d9f394f48bedcff572f8_JaffaCakes118

  • Size

    1.5MB

  • MD5

    27d4a5df22c1d9f394f48bedcff572f8

  • SHA1

    4fc663a9a25d9cdd368371c4e733e1b96d68268c

  • SHA256

    24b5f2c9fec372bec8ccb07e88a446dd7764394e3fd7efa2a6238870ced8e995

  • SHA512

    b474addd7582c1e5db1c31bd667c3ff721b46c75d4ea765d18b98fcc38b0d3fcc17e14d151646c2625c079a316de9f048416a5f2971b49427a54187c59587fa2

  • SSDEEP

    24576:LKFp6tjnpuZcobxK60eoLcvnWS+TxVUWIjcZsVcPcnlRvLG8oem:GFp6qCobxK6No0WnlmwKVcP4RDQ

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 27d4a5df22c1d9f394f48bedcff572f8_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/welcome.bmp
  • $SYSDIR/1rs23525.dll
    .dll regsvr32 windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • wrar380ru.exe
    .exe windows:4 windows x86 arch:x86

    ff7fe1c736b9a63f20ec2682d58041a9


    Headers

    Imports

    Sections

  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome.manifest
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/extensions.xul
    .js .xml polyglot
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/logo.png
    .png
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/main.js
    .js
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/main.xul
    .xml
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/q.png
    .png
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/q_gray.png
    .png
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/x.png
    .png
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/chrome/content/x_gray.png
    .png
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/defaults/preferences/main.js
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/extension.reg
  • {7445f2b0-cf99-11dd-ad8b-0800200c9a66}/install.rdf
    .xml