Overview

overview

7

Static

static

7

scanreg_setup.exe

windows7-x64

7

scanreg_setup.exe

windows10-2004-x64

7

Устан...ll.exe

windows7-x64

3

Устан...ll.exe

windows10-2004-x64

3

Documents ...er.dll

windows7-x64

1

Documents ...er.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$TEMP/A906...18.dll

windows7-x64

1

$TEMP/A906...18.dll

windows10-2004-x64

1

js/bramus/...ler.js

windows7-x64

3

js/bramus/...ler.js

windows10-2004-x64

3

js/prototy...ype.js

windows7-x64

3

js/prototy...ype.js

windows10-2004-x64

3

lic.html

windows7-x64

1

lic.html

windows10-2004-x64

1

page.html

windows7-x64

1

page.html

windows10-2004-x64

1

page3.html

windows7-x64

1

page3.html

windows10-2004-x64

1

page4.html

windows7-x64

1

page4.html

windows10-2004-x64

1

page5.html

windows7-x64

1

page5.html

windows10-2004-x64

1

$TEMP/A906...68.dll

windows7-x64

1

$TEMP/A906...68.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4029f17876c8c75c7248630311e8e05a_JaffaCakes118

  • Size

    1.3MB

  • MD5

    4029f17876c8c75c7248630311e8e05a

  • SHA1

    6770fea24ef5f40cc029c571890c4c6d78a98d1b

  • SHA256

    b2cf8ba7b3aa0a15a3f1a4a1c65fb19101d24d3b0c5ea19b4ea519b81e4e0b5b

  • SHA512

    dfe039456fa3b0246e887dbf5199c8c91c9e07c511d1c9da0936e5d4b323e3f0b404e814d77d25f4badeeacca6ff106eb8130bbc28bf704bc94d76a4fd8a7744

  • SSDEEP

    24576:Z0QJocLp0L6dvaV4SbGdbePOFoggh4P4cvRpjDpH5ZRz1dsslWFllOYs:bJJLp0OvOOhemFK63jDpH5zzzsslHX

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 4029f17876c8c75c7248630311e8e05a_JaffaCakes118
    .rar
  • scanreg_setup.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Инструкция!!! ЧИТАТЬ ВСЕМ!!!.txt
  • Установщик_PhysXloader.dll.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $EXEDIR/PhysXLoader.dll.7z
    .7z
  • Documents and Settings/UserXP/My Documents/cashmagnat/PhysXloader/PhysXLoader/PhysXLoader.dll
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $TEMP/A9065166/b1015251.bin
  • $TEMP/A9065166/d1020971.bin
  • $TEMP/A9065166/d1044084.bin
  • $TEMP/A9065166/d1060318.dll
    .dll windows:4 windows x86 arch:x86

    3726b8c597bbd6bac65abe3d0400a84f


    Headers

    Imports

    Exports

    Sections

  • $TEMP/A9065166/k1026153.bin
  • $TEMP/A9065166/q1046351.bin
  • $TEMP/A9065166/s1000342.bin
  • $TEMP/A9065166/v1004545.bin
    .7z
  • images/Thumbs.db
  • images/bg.png
    .png
  • images/bramus/Thumbs.db
  • images/bramus/percentImage.gif
    .gif
  • images/bramus/percentImage.png
    .png
  • images/bramus/percentImage_back.png
    .png
  • images/icons/Thumbs.db
  • images/icons/add.gif
    .gif
  • images/icons/empty.gif
    .gif
  • images/icons/fill.gif
    .gif
  • images/icons/get.gif
    .gif
  • images/icons/minus.gif
    .gif
  • images/icons/set.gif
    .gif
  • images/install.png
    .png
  • images/pay-header.png
    .png
  • js/bramus/jsProgressBarHandler.js
    .js
  • js/prototype/prototype.js
    .js
  • lic.html
  • page.html
    .html
  • page3.html
    .html
  • page4.html
    .html .js polyglot
  • page5.html
    .html
  • $TEMP/A9065166/y1065668.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections