Overview

overview

7

Static

static

3

2a7c238087...18.exe

windows7-x64

7

2a7c238087...18.exe

windows10-2004-x64

7

$1/CN_Mini...ch.htm

windows7-x64

1

$1/CN_Mini...ch.htm

windows10-2004-x64

1

$1/CN_Mini...ge.htm

windows7-x64

1

$1/CN_Mini...ge.htm

windows10-2004-x64

1

$1/CN_Mini...op.htm

windows7-x64

1

$1/CN_Mini...op.htm

windows10-2004-x64

1

$1/StartPa...x.html

windows7-x64

1

$1/StartPa...x.html

windows10-2004-x64

1

$1/StartPa...1.html

windows7-x64

1

$1/StartPa...1.html

windows10-2004-x64

1

$1/StartPa...2.html

windows7-x64

1

$1/StartPa...2.html

windows10-2004-x64

1

$1/local/b...nk.htm

windows7-x64

1

$1/local/b...nk.htm

windows10-2004-x64

1

$1/local/o...rch.js

windows7-x64

3

$1/local/o...rch.js

windows10-2004-x64

3

$1/local/s...ex.htm

windows7-x64

1

$1/local/s...ex.htm

windows10-2004-x64

1

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...nk.dll

windows7-x64

3

$PLUGINSDI...nk.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2a7c238087ca0a59b007716e9d2d3d43_JaffaCakes118

  • Size

    314KB

  • MD5

    2a7c238087ca0a59b007716e9d2d3d43

  • SHA1

    64f81abc60510ac43e7b1d18e63852bc181a9d8f

  • SHA256

    2e63527c95d9941ef7d1cc7028f14854859c953df79e965028110ae8133d4a51

  • SHA512

    6810e26ba8665fab19b20746705717308400664cf833c5235bf2e2fbaa6526b3c7d36ab32a4517be96aef7bb4fd9508590593a03d85d9eb944fcb82734309037

  • SSDEEP

    6144:keTeM/Ck0zF0tTaFS/nWJjn7dFfHfAHI08ZTkEY82VIeWxHTtTF1:kMKWcs/nWh7XfHfw8ZTjY82VIeWNRT

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 2a7c238087ca0a59b007716e9d2d3d43_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $0/Resource/SearchEngine.ini.default
  • $0/SharedAccount/Config/Config.ini
  • $0/SharedAccount/Config/ui.xml
    .xml
  • $0/User/GreenBrowser.ini
  • $0/lexplorer.ini
  • $0/local/start/custom.ini
  • $0/local/start/initsearcheng.txt
  • $0/search/searchs.ini
  • $1/CN_MiniIE.txt
  • $1/CN_MiniIE_LeftChannel.txt
  • $1/CN_MiniIE_Search.htm
    .html
  • $1/CN_MiniIE_StartPage.htm
    .html
  • $1/CN_MiniIE_StartPage_Top.htm
    .html
  • $1/Config.ini
  • $1/Config/Config.xml
    .xml
  • $1/Config/Data.xml
    .xml
  • $1/Config/FileList.xml
    .xml
  • $1/Config/SaaYaa_Config.dat
    .xml
  • $1/Config/saayaa.config.dat
    .xml
  • $1/Data/lastunclose.htm
    .html .js polyglot
  • $1/Defaults/Config.dat
  • $1/Resource/SearchEngine.ini.default
  • $1/StartPage/Local/index.html
    .html .js polyglot
  • $1/StartPage/Local/index1.html
    .html .js polyglot
  • $1/StartPage/Local/index2.html
    .html .js polyglot
  • $1/TheWorld.ini
  • $1/User/LastVisit.ini
  • $1/User/SearchEngine.ini
  • $1/User/te.xml
    .xml
  • $1/local/blank/aboutblank.htm
  • $1/local/blank/iqblank.htm
    .html .js polyglot
  • $1/local/blank/iqsearch.htm
    .html .js polyglot
  • $1/local/option/js/_360quick.search.js
    .js
  • $1/local/start/index.htm
    .js
  • $1/oem.ini
  • $1/preferences.ini
  • $APPDATA/360se/360SE.ini
  • $APPDATA/SogouExplorer/Config.xml
    .xml
  • $APPDATA/Tencent/TencentTraveler/100/TtConf.dat
  • $PLUGINSDIR/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    135de77644e2add2fd9dd8176740e7e0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:4 windows x86 arch:x86

    ac2c09e68d5518a91b4912bdf6a67d1b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    3f1149a3053980fe6b461521d2b55a2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/locate.dll
    .dll windows:4 windows x86 arch:x86

    61142a69a9a888c92fddc2ab9dbb123a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/regtest5.ini
  • $PLUGINSDIR/regtest6.ini
  • $PLUGINSDIR/rfshdktp.dll
    .dll windows:4 windows x86 arch:x86

    042f3c184e7c0923b6325ab1dc09aed7


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Weather/$2/UserData/Profiles/Program/Toolbox.xml
  • KKRIEGER.EXE
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • Ϸгԭ򼰽.txt