Overview

overview

7

Static

static

7

2a5e3f17fb...18.exe

windows7-x64

7

2a5e3f17fb...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows7-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

1

BHO.dll

windows7-x64

6

BHO.dll

windows10-2004-x64

6

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a5e3f17fb10a4563e7596f1a163c885_JaffaCakes118

  • Size

    703KB

  • MD5

    2a5e3f17fb10a4563e7596f1a163c885

  • SHA1

    faf136b60cf0bd620cfacf7e2cca0eae085eb00a

  • SHA256

    737dac882bbacfd5b483c79f559d4214cd06a45cfc21995acb21a496bf2f3254

  • SHA512

    5bc77f3f225d7ec0baccd786661af03114395d44a760b55052970de41a9997f4fdc934b30945be7a1c855f70a1d40071c7dca4642c31678f7c7e7d23a79356e7

  • SSDEEP

    12288:Sn3HSdtYaKtTRt9qQqn+oOaU3EfCuQLVOfpH5dZW04w9m8346dysK/Gq:S3ydtYRtdqM3BpohNWcRo6YX/Gq

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 2a5e3f17fb10a4563e7596f1a163c885_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    ee75cece63794fa22feebed80a358b16


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ZipDLL.dll
    .dll windows:4 windows x86 arch:x86

    f10b94e3705eae25c7617ba56a648b77


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    e886a412cdaf11998a8eeffda508e913


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisXML.dll
    .dll windows:4 windows x86 arch:x86

    177dccc4d0323e428824818efd241cc7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisos.dll
    .dll windows:1 windows x86 arch:x86

    a70233c77fd258ec47709388c2338273


    Headers

    Imports

    Exports

    Sections

  • BHO.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    c761ee75e6ee4a51e7561318a338d3c5


    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    ee75cece63794fa22feebed80a358b16


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    e886a412cdaf11998a8eeffda508e913


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsisXML.dll
    .dll windows:4 windows x86 arch:x86

    177dccc4d0323e428824818efd241cc7


    Headers

    Imports

    Exports

    Sections

  • gplplugin.crx
    .zip
  • background.html
    .html .js polyglot
  • gameplaylabs.png
    .png
  • gameplaylabsplugin.js
    .js
  • manifest.json
  • npGamePlayLabsPlugin.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    9100feedaf2ba624188f295beb0fca7a


    Headers

    Imports

    Exports

    Sections

  • gplplugin.xpi
    .zip
  • chrome.manifest
  • chrome/content/ff-overlay.xul
    .xml
  • chrome/content/icon.png
    .png
  • chrome/content/overlay.js
    .js
  • chrome/locale/en-US/overlay.properties
  • defaults/preferences/prefs.js
  • install.rdf
    .xml