General

  • Target

    49713fc39f8f84a45a4e2500aa9dbe6a_JaffaCakes118

  • Size

    14.8MB

  • MD5

    49713fc39f8f84a45a4e2500aa9dbe6a

  • SHA1

    4744671110a52c3727c4c326ee408487ace242de

  • SHA256

    3da2156d209fd99a785ccfa240045330f558a43462c963c25723ffbd08ab5aab

  • SHA512

    280d41d40bc94402f967cd3b9d357b1dbdbbdb68360e84ef12f95dccae2ebb2ce3ead92412697de50e9cb4b35ea379ed3c06cc0893f2f007ba714c840461e627

  • SSDEEP

    196608:5XLIfhrhSbn+WIDY3gr9RSKH+MkZLcJABOHPnK7Lip/rGWTwd64ONqX/:5b8an+L03GrHycSYH/K7Lk/yWTW1EI

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 62 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • 49713fc39f8f84a45a4e2500aa9dbe6a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • GNS3.exe
    .exe windows:5 windows x86 arch:x86

    7af2fe87a3ab930007d141d21c36ceda


    Headers

    Imports

    Sections

  • LICENSE
  • Langs/Lang_ar.qm
  • Langs/Lang_bg.qm
  • Langs/Lang_cn.qm
  • Langs/Lang_cz.qm
  • Langs/Lang_de.qm
  • Langs/Lang_en.qm
  • Langs/Lang_es.qm
  • Langs/Lang_fa.qm
  • Langs/Lang_fr.qm
  • Langs/Lang_gr.qm
  • Langs/Lang_it.qm
  • Langs/Lang_jp.qm
  • Langs/Lang_kr.qm
  • Langs/Lang_pl.qm
  • Langs/Lang_pt_br.qm
  • Langs/Lang_ro.qm
  • Langs/Lang_ru.qm
  • Langs/Lang_sk.qm
  • Langs/Lang_sr.qm
  • Langs/Lang_tr.qm
  • Langs/Lang_uk.qm
  • Langs/qt_ar.qm
  • Langs/qt_cn.qm
  • Langs/qt_cs.qm
  • Langs/qt_da.qm
  • Langs/qt_de.qm
  • Langs/qt_es.qm
  • Langs/qt_fa.qm
  • Langs/qt_fa.ts
    .xml
  • Langs/qt_fr.qm
  • Langs/qt_hu.qm
  • Langs/qt_it.qm
  • Langs/qt_it.ts
    .xml
  • Langs/qt_iw.qm
  • Langs/qt_jp.qm
  • Langs/qt_pl.qm
  • Langs/qt_pt.qm
  • Langs/qt_pt_br.qm
  • Langs/qt_ru.qm
  • Langs/qt_sk.qm
  • Langs/qt_sl.qm
  • Langs/qt_sr.qm
  • Langs/qt_sv.qm
  • Langs/qt_uk.qm
  • Loopback Manager.cmd
  • Microsoft.VC90.CRT.manifest
    .xml
  • Network device list.cmd
    .cmd .vbs
  • PyQt4.QtCore.pyd
    .dll windows:4 windows x86 arch:x86

    c1b80eb942355a7383ead89b54b8fe77


    Headers

    Imports

    Exports

    Sections

  • PyQt4.QtGui.pyd
    .dll windows:4 windows x86 arch:x86

    98c9cb518a67af27a5be336454f8c9d0


    Headers

    Imports

    Exports

    Sections

  • PyQt4.QtNetwork.pyd
    .dll windows:4 windows x86 arch:x86

    abf975f6fe88bb8e59d47c5479d18f64


    Headers

    Imports

    Exports

    Sections

  • PyQt4.QtSvg.pyd
    .dll windows:4 windows x86 arch:x86

    12588a4c56d9ed8ed94fb4da1f783dd6


    Headers

    Imports

    Exports

    Sections

  • QtCore4.dll
    .dll windows:4 windows x86 arch:x86

    14c1e3d183cff53679e0770f8d6640fa


    Headers

    Imports

    Exports

    Sections

  • QtGui4.dll
    .dll windows:4 windows x86 arch:x86

    33447e226744a054372dedc4d1cb3b04


    Headers

    Imports

    Exports

    Sections

  • QtNetwork4.dll
    .dll windows:4 windows x86 arch:x86

    10a175a9fcc5d8be50327a97f0266ba4


    Headers

    Imports

    Exports

    Sections

  • QtSvg4.dll
    .dll windows:4 windows x86 arch:x86

    c3cbfa4d7992cb84e6c7a2da01ebe1b9


    Headers

    Imports

    Exports

    Sections

  • QtXml4.dll
    .dll windows:4 windows x86 arch:x86

    cafcd73ad2c02f72bf4f8c43572eb4e8


    Headers

    Imports

    Exports

    Sections

  • SDL.dll
    .dll windows:4 windows x86 arch:x86

    3cac573b810d2b09cc2fdfb3b0f3e2c9


    Headers

    Imports

    Exports

    Sections

  • WinPcap_4_1_2.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bootOptions.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Packet.dll
    .dll windows:4 windows x86 arch:x86

    088fedd367765cf098ba8150e3ad9014


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/pthreadVC.dll
    .dll windows:4 windows x86 arch:x86

    90ee61357770484e2d085958b94141a3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/wpcap.dll
    .dll windows:4 windows x86 arch:x86

    6a6ab6ea5f347cadbd2f3e8091a86bbb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/CACE_Banner.htm
    .html
  • $TEMP/CACE_Logo.gif
    .gif
  • $TEMP/NetSol.jpg
    .jpg
  • WinPcapInstall.dll
    .dll windows:4 windows x86 arch:x86

    ad1fff2efc5a1aa2884d5c780a51aa99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • rpcapd.exe
    .exe windows:4 windows x86 arch:x86

    2b9e73ff502840fe6b381682c42d43cf


    Code Sign

    Headers

    Imports

    Sections

  • _ctypes.pyd
    .dll windows:5 windows x86 arch:x86

    727f3bf8de936a8c8058b2afe5a97589


    Headers

    Imports

    Exports

    Sections

  • _socket.pyd
    .dll .js windows:5 windows x86 arch:x86 polyglot

    0bd4d4e34e87f8e6770b511611ac7c10


    Headers

    Imports

    Exports

    Sections

  • _ssl.pyd
    .dll windows:5 windows x86 arch:x86

    c38dc3aa10f8f447e12711ca72f7bead


    Headers

    Imports

    Exports

    Sections

  • _win32sysloader.pyd
    .dll windows:5 windows x86 arch:x86

    2d360b1cc6208d7c8921b3621f11aed9


    Headers

    Imports

    Exports

    Sections

  • bamboo.dtb
  • baseconfig.txt
  • bios.bin
  • bz2.pyd
    .dll windows:5 windows x86 arch:x86

    029797b191cb62ef49b500e700a74db3


    Headers

    Imports

    Exports

    Sections

  • configspec
  • cygwin1.dll
    .dll windows:4 windows x86 arch:x86

    cf9a219d9334ecce95da8b6e9e608dfe


    Headers

    Imports

    Exports

    Sections

  • devcon_x64.exe
    .exe windows:6 windows x64 arch:x64

    ec3460d0ed22d5c758ca30873d8c198c


    Headers

    Imports

    Sections

  • devcon_x86.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • dynamips-start.cmd
  • dynamips-wxp.exe
    .exe windows:4 windows x86 arch:x86

    7d351ecc6cb81b426cc9eb3f0cb37702


    Headers

    Imports

    Sections

  • gns3.ico
  • keymaps/ar
  • keymaps/common
  • keymaps/da
  • keymaps/de
  • keymaps/de-ch
  • keymaps/en-gb
  • keymaps/en-us
  • keymaps/es
  • keymaps/et
  • keymaps/fi
  • keymaps/fo
  • keymaps/fr
  • keymaps/fr-be
  • keymaps/fr-ca
  • keymaps/fr-ch
  • keymaps/hr
  • keymaps/hu
  • keymaps/is
  • keymaps/it
  • keymaps/ja
  • keymaps/lt
  • keymaps/lv
  • keymaps/mk
  • keymaps/modifiers
  • keymaps/nl
  • keymaps/nl-be
  • keymaps/no
  • keymaps/pl
  • keymaps/pt
  • keymaps/pt-br
  • keymaps/ru
  • keymaps/sl
  • keymaps/sv
  • keymaps/th
  • keymaps/tr
  • libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    22de106f971ff0449d33ea6ca7f9dcba


    Headers

    Imports

    Exports

    Sections

  • libz-1.dll
    .dll windows:4 windows x86 arch:x86

    3fc348f396e048cb038594afc081be3d


    Headers

    Imports

    Exports

    Sections

  • mingwm10.dll
    .dll windows:4 windows x86 arch:x86

    03e7672c8b423d2d726a1731f8c39711


    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • multiboot.bin
  • nvram_export.exe
    .exe windows:4 windows x86 arch:x86

    c7fade5db45502647d83df86584b29d7


    Headers

    Imports

    Sections

  • openbios-ppc
    .elf linux ppc
  • openbios-sparc32
    .elf linux sparc
  • openbios-sparc64
    .elf linux
  • petalogix-s3adsp1800.dtb
  • plugins/iconengines/qsvgicon4.dll
    .dll windows:4 windows x86 arch:x86

    1cc80eb24bd7fab62e3ae127f59842ad


    Headers

    Imports

    Exports

    Sections

  • plugins/iconengines/qsvgicond4.dll
    .dll windows:4 windows x86 arch:x86

    6a725b2ccb97a9d24c6daaccc85f98f9


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qgif4.dll
    .dll windows:4 windows x86 arch:x86

    d98e879bda90e290670ac542f273ec31


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qgifd4.dll
    .dll windows:4 windows x86 arch:x86

    c0f1627e210302044261e14dab5cd32f


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qico4.dll
    .dll windows:4 windows x86 arch:x86

    609988977555f8ef054d5568db5442b3


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qicod4.dll
    .dll windows:4 windows x86 arch:x86

    8d12c010650da88661a1fd5863197e32


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qjpeg4.dll
    .dll windows:4 windows x86 arch:x86

    bc7a8867f826da03e64c0d3e688c6e9c


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qjpegd4.dll
    .dll windows:4 windows x86 arch:x86

    d938b3975851e8246350146bf4f30816


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qmng4.dll
    .dll windows:4 windows x86 arch:x86

    fc9554fa90580645e758722af44a555a


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qmngd4.dll
    .dll windows:4 windows x86 arch:x86

    eca784606da8159a0ebc7647f7e21e23


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qsvg4.dll
    .dll windows:4 windows x86 arch:x86

    cde9cd7d8b1b0e9f503724d0439047e1


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qsvgd4.dll
    .dll windows:4 windows x86 arch:x86

    5aa3bfd08ce02bc938b7540d7e9bd441


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qtiff4.dll
    .dll windows:4 windows x86 arch:x86

    f5a0c5db6bff4a659a5a49379b47091a


    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qtiffd4.dll
    .dll windows:4 windows x86 arch:x86

    1a4964b26d87afd82b9e613119cc16c2


    Headers

    Imports

    Exports

    Sections

  • ppc_rom.bin
  • putty.exe
    .exe windows:4 windows x86 arch:x86

    bc07e7b366ac9ad23951888606f0f0fa


    Headers

    Imports

    Sections

  • pxe-e1000.bin
  • pxe-ne2k_pci.bin
  • pxe-pcnet.bin
  • pxe-rtl8139.bin
  • python26.dll
    .dll windows:5 windows x86 arch:x86

    cdbfa0aa57da6b464afeec31f51436bc


    Headers

    Imports

    Exports

    Sections

  • pywintypes26.dll
    .dll windows:5 windows x86 arch:x86

    ed127fc54c875b98a2f3d83246da8a1c


    Headers

    Imports

    Exports

    Sections

  • qemu-img.exe
    .exe windows:4 windows x86 arch:x86

    86f6ca2583ded17d8783a0c64786da36


    Headers

    Imports

    Sections

  • qemu-io.exe
    .exe windows:4 windows x86 arch:x86

    7d9b1a22ecbb8e3dd2b4a774809ad4bf


    Headers

    Imports

    Sections

  • qemu.exe
    .exe windows:4 windows x86 arch:x86

    460b5950d94d4ec896c649b20b9557f8


    Headers

    Imports

    Exports

    Sections

  • qemuwrapper-start.cmd
    .cmd .vbs
  • qemuwrapper.exe
    .exe windows:5 windows x86 arch:x86

    b28c641d753fb51b62a00fe6115070ae


    Headers

    Imports

    Sections

  • qt.conf
  • securecrt.vbs
  • select.pyd
    .dll windows:5 windows x86 arch:x86

    58cda09000d494910e37727e961ba1b0


    Headers

    Imports

    Exports

    Sections

  • sip.pyd
    .dll windows:4 windows x86 arch:x86

    7f35ba29bbcaf09ebc3d68736f80e1de


    Headers

    Imports

    Exports

    Sections

  • unicodedata.pyd
    .dll windows:5 windows x86 arch:x86

    8b688891614f7d934eb4586d8e47db79


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • vgabios-cirrus.bin
  • vgabios.bin
  • video.x
  • w9xpopen.exe
    .exe windows:5 windows x86 arch:x86

    da05ed8eceee95a3301bcf9c3fbe3e3c


    Headers

    Imports

    Sections

  • win32api.pyd
    .dll windows:5 windows x86 arch:x86

    34877dba02c4e14cf4fb9569e6898706


    Headers

    Imports

    Exports

    Sections

  • win32pipe.pyd
    .dll windows:5 windows x86 arch:x86

    2c432fdc0272bab678728d837938b922


    Headers

    Imports

    Exports

    Sections

  • win32process.pyd
    .dll windows:5 windows x86 arch:x86

    46d9b505eb217d3b5801798b74597b84


    Headers

    Imports

    Exports

    Sections