General

  • Target

    4d56f93bae5f3eee2da08f801a8a75d1_JaffaCakes118

  • Size

    11.2MB

  • MD5

    4d56f93bae5f3eee2da08f801a8a75d1

  • SHA1

    e1a6b94f1859130caa1cedab6e2467ae5d50ce51

  • SHA256

    49238080396aad5857a84b519f84b262cca2b5d937930848209948fe7abab023

  • SHA512

    2ddf41accc85c69ce2a573e812f945e3fd56f34a9a373e31e44e5e1d6cef56a6b83986ed7c8d3fd559bf7d8795cc8245a9088b7c1a17b437c8b5047436b75ac5

  • SSDEEP

    196608:eK3tgJjBP6CCm9SfQdAckgyp0miexuXBKOqEtHW1iYz56gJOfzPb92/Pq96yb/U:eCmK/fQdYp0kxg4UxYzKfzT3D/U

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 4d56f93bae5f3eee2da08f801a8a75d1_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • CCleaner.exe
    .exe windows:4 windows x86 arch:x86

    61c5d0f873f720dd1c7be1d3202eac71


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.VC80.CRT.manifest
    .xml
  • Microsoft.VC90.CRT.manifest
  • Microsoft.mshtml.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • cafw.exe
    .exe windows:5 windows x86 arch:x86

    4710e694cbc904bbde58b1960e1a3f6b


    Headers

    Imports

    Sections

  • cafw.exe.config
    .xml
  • cladgenius.chm
    .chm
  • db/bpap.sql
  • db/bpap0717.sql
  • db/bpap0804.sql
  • db/bpap0809.sql
  • db/bpap0864.sql
  • db/bpap1034.sql
  • db/bpap1035.sql
  • db/bpap1036.sql
  • db/bpap1054.sql
  • db/bpap1142.sql
  • db/bpap1278.sql
  • db/bpap1295.sql
  • db/bpap1298.sql
  • db/bpap1300.sql
  • db/bpap1334.sql
  • db/bpap1335.sql
  • db/bpap1337.sql
  • db/bpap1338.sql
  • db/bpap1390.sql
  • db/bpap1450.sql
  • db/bpap1451.sql
  • db/bpap1460.sql
  • db/cafw.sql
  • db/cafw0763.sql
  • db/cafw0775.sql
  • db/cafw0776.sql
  • db/cafw0791.sql
  • db/cafw0809.sql
  • db/cafw0810.sql
  • db/cafw0826.sql
  • db/cafw0829.sql
  • db/cafw0834.sql
  • db/cafw0836.sql
  • db/cafw0881.sql
  • db/cafw0887.sql
  • db/cafw0896.sql
  • db/cafw0901.sql
  • db/cafw0912.sql
  • db/cafw0933.sql
  • db/cafw0935.sql
  • db/cafw0947.sql
  • db/cafw0958.sql
  • db/cafw0962.sql
  • db/cafw1001.sql
  • db/cafw1006.sql
  • db/cafw1033.sql
  • db/cafw1076.sql
  • db/cafw1092.sql
  • db/cafw1128.sql
  • db/cafw1140.sql
  • db/cafw1152.sql
  • db/cafw1159.sql
  • db/cafw1205.sql
  • db/cafw1277.sql
  • db/cafw1300.sql
  • db/cafw1305.sql
  • db/cafw1312.sql
  • db/cafw1334.sql
  • db/cafw1335.sql
  • db/cafw1346.sql
  • db/cafw1371.sql
  • db/cafw1388.sql
  • db/cafw1391.sql
  • db/cafw1395.sql
  • db/cafw1396.sql
  • db/cagm.sql
  • db/cahm.sql
  • db/clap.sql
  • db/clap0754.sql
  • db/clap0759.sql
  • db/clap0787.sql
  • db/clap0788.sql
  • db/clap0792.sql
  • db/clap0809.sql
  • db/clap0826.sql
  • db/clap0840.sql
  • db/clap0843.sql
  • db/clap0869.sql
  • db/clap0872.sql
  • db/clap0883.sql
  • db/clap0894.sql
  • db/clap0904.sql
  • db/clap0951.sql
  • db/clap0956.sql
  • db/clap0957.sql
  • db/clap0958.sql
  • db/clap0966.sql
  • db/clap1006.sql
  • db/clap1065.sql
  • db/clap1077.sql
  • db/clap1102.sql
  • db/clap1124.sql
  • db/clap1129.sql
  • db/clap1140.sql
  • db/clap1168.sql
  • db/clap1200.sql
  • db/clap1253.sql
  • db/clap1259.sql
  • db/clap1277.sql
  • db/clap1334.sql
  • db/clap1354.sql
  • db/clap1419.sql
  • db/clap1473.sql
  • db/kiap.sql
  • db/kiap0809.sql
  • db/kiap0873.sql
  • db/kiap1074.sql
  • db/kiap1102.sql
  • db/kiap1103.sql
  • db/kiap1213.sql
  • db/kiap1214.sql
  • db/kiap1215.sql
  • db/kiap1216.sql
  • db/kiap1224.sql
  • db/kiap1312.sql
  • db/kiap1334.sql
  • db/kiap1354.sql
  • db/kiap1447.sql
  • db/prsp.sql
  • decaptcher.dll
    .dll windows:4 windows x86 arch:x86

    ea8805c61d622df6eaee4161fb6b710f


    Headers

    Imports

    Exports

    Sections

  • eula.txt
  • fbclient.dll
    .dll windows:4 windows x86 arch:x86

    3e57f561fc826c2ff17b3af7fd3613f9


    Headers

    Imports

    Exports

    Sections

  • firebird.conf
  • firebird.msg
  • hdbg/Interop.mfncomLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • hdbg/hdbg.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • hdbg/mfncom.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    428d18ead28f26f0adc3d6d332444e4f


    Headers

    Imports

    Exports

    Sections

  • hdbg/mfnhks32.dll
    .dll windows:5 windows x86 arch:x86

    20b856a64e36a590ff24e0aebc90cac3


    Headers

    Imports

    Exports

    Sections

  • hdbg/mfnhks64.dll
    .dll windows:5 windows x64 arch:x64

    6f16cbf9a06a786ea86359bedd0b5576


    Headers

    Imports

    Exports

    Sections

  • hdbg/mfnsp32.dll
    .dll windows:5 windows x86 arch:x86

    c1420907f7d54fc731719684b6e9d891


    Headers

    Imports

    Exports

    Sections

  • hdbg/mfnsp64.dll
    .dll windows:5 windows x64 arch:x64

    210071e732364676e5edc2942934568d


    Headers

    Imports

    Exports

    Sections

  • hdbg/mfnspinst32.exe
    .exe windows:5 windows x86 arch:x86

    a9c40577ce8b71e2feb4f36b96aae545


    Headers

    Imports

    Sections

  • hdbg/mfnspinst64.exe
    .exe windows:5 windows x64 arch:x64

    9dcdff4bb1867fc8345e1c12f1ab71f0


    Headers

    Imports

    Sections

  • hdbg/mfnsvc.exe
    .exe windows:5 windows x86 arch:x86

    ae14648899ae5c8bae3a2216b55cabb3


    Headers

    Imports

    Sections

  • holfix.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • ibprovider.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    bbbb1f48f3cf8299b104330fe60ca1f7


    Headers

    Imports

    Exports

    Sections

  • icudt30.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • icuin30.dll
    .dll windows:4 windows x86 arch:x86

    9beb482b2a2508a095c34c1fa62d842c


    Headers

    Imports

    Exports

    Sections

  • icuuc30.dll
    .dll windows:4 windows x86 arch:x86

    46b127392715a22298552eac440752c6


    Headers

    Imports

    Exports

    Sections

  • msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    9fb682fe34f5d965faf4cf424fa6c000


    Headers

    Imports

    Exports

    Sections

  • msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    2dec2d42421b088bfcddeba53b046464


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    8eb98c77a1ada89df5027bd5bf01c2f6


    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0453db624ecaef7c4f3da938cd1d0fc5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/cupd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • wm_hooks.dll
    .dll windows:5 windows x86 arch:x86

    41bb4d885b3f33a71b60c014092700d0


    Headers

    Imports

    Exports

    Sections