Overview

overview

7

Static

static

7

freewb51ex.exe

windows7-x64

7

freewb51ex.exe

windows10-2004-x64

7

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

UninstallIME.exe

windows7-x64

7

UninstallIME.exe

windows10-2004-x64

7

freewb.dll

windows7-x64

3

freewb.dll

windows10-2004-x64

3

freewb.htm

windows7-x64

1

freewb.htm

windows10-2004-x64

1

freewb.dll

windows7-x64

1

freewb.dll

windows10-2004-x64

1

plugin/command.dll

windows7-x64

3

plugin/command.dll

windows10-2004-x64

3

plugin/date.dll

windows7-x64

3

plugin/date.dll

windows10-2004-x64

3

plugin/queryex.dll

windows7-x64

1

plugin/queryex.dll

windows10-2004-x64

1

registry.exe

windows7-x64

7

registry.exe

windows10-2004-x64

5

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    48f18a4dca3b50b237d169e48d2db255_JaffaCakes118

  • Size

    2.8MB

  • MD5

    48f18a4dca3b50b237d169e48d2db255

  • SHA1

    3539f459ee80801f1ab431c602a0b22146763f76

  • SHA256

    6154061310ed2d2b059db3575f2dc84265e945b2eea6cd4782ca2257dd10500a

  • SHA512

    807944b7c22570d2f577cad79ef0f84f6170d6ad244e2e44fb3f4bb5e655d1814c7eaf448294bd2a2840b0950efeff2860f27cf6b1d2e4001e39329db4d23bd5

  • SSDEEP

    49152:0BEJX4JQFJm5mSsf6RvwY87xVh5wWuZezFRUVxIoaw1XE4BD:c7OnqY3xzTOezF2IDUXzD

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 48f18a4dca3b50b237d169e48d2db255_JaffaCakes118
    .rar
  • freewb51ex.exe
    .exe windows:4 windows x86 arch:x86

    42134c4fb1b2d3cf6b447e018a5de700


    Headers

    Imports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    48cfa0ea7e353e4a7dd23572da8374ef


    Headers

    Imports

    Exports

    Sections

  • UninstallIME.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • convert.mb
  • freewb.bex
  • freewb.bin
  • freewb.dll
    .dll windows:4 windows x86 arch:x86

    b30df96f2b1fd3bae49019b9763e9ed8


    Headers

    Imports

    Exports

    Sections

  • freewb.gif
    .gif
  • freewb.htm
    .html
  • freewb.ime
    .dll windows:4 windows x86 arch:x86

    9b957d2219c021fec7ae5ea2f1d8f1e1


    Headers

    Imports

    Exports

    Sections

  • freewb.ini
  • g2b.dat
  • mb/default/attach.mb
  • mb/default/freewb.dat
  • mb/default/freewb.mb
  • mb/default/freewbcht.mb
  • mb/default/quick.mb
  • mb/default/user.ini
  • plugin/command.plg
    .dll windows:4 windows x86 arch:x86

    43ac3a3fc8729e16d2cc38311ad00920


    Headers

    Imports

    Exports

    Sections

  • plugin/data/guobiao.db
  • plugin/data/queryex.ini
  • plugin/date.plg
    .dll windows:4 windows x86 arch:x86

    7f59204c7dba5226ac5d258a558007ea


    Headers

    Imports

    Exports

    Sections

  • plugin/queryex.plg
    .dll windows:4 windows x86 arch:x86

    d85c3cd24c9e49e19c2a7017df05670a


    Headers

    Imports

    Exports

    Sections

  • registry.exe
    .exe windows:4 windows x86 arch:x86

    c52809fe412bfadab53f233998b13261


    Headers

    Imports

    Sections

  • skin/Armor/Armor.BMP
  • skin/Armor/Armor_BG.bmp
  • skin/Armor/Armor_button.BMP
  • skin/Armor/Armor_ex.BMP
  • skin/Armor/candidate.bmp
  • skin/Armor/skin.ini
  • skin/Elegant/candidate.bmp
  • skin/Elegant/elegant.bmp
  • skin/Elegant/elegant_bg.bmp
  • skin/Elegant/elegant_button.bmp
  • skin/Elegant/elegant_ex.bmp
  • skin/Elegant/skin.ini
  • skin/blueness/blueness.bmp
  • skin/blueness/blueness_bg.bmp
  • skin/blueness/blueness_button.bmp
  • skin/blueness/blueness_ex.bmp
  • skin/blueness/candidate.bmp
  • skin/blueness/skin.ini
  • skin/expert/Paper.bmp
  • skin/expert/candidate.bmp
  • skin/expert/skin.ini
  • skin/simple/candidate.bmp
  • skin/simple/gray_fade.bmp
  • skin/simple/simple.bmp
  • skin/simple/simple_button.bmp
  • skin/simple/simple_ex.bmp
  • skin/simple/skin.ini
  • sound/back.wav
  • sound/chong.wav
  • sound/enter.wav
  • sound/kong.wav
  • sound/letter.wav
  • sound/space.wav
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    42134c4fb1b2d3cf6b447e018a5de700


    Headers

    Imports

    Sections

  • 下载说明.htm
    .html .js polyglot