General

  • Target

    4de033db9fbc9b3814df3d8f9bb6021e_JaffaCakes118

  • Size

    3.6MB

  • MD5

    4de033db9fbc9b3814df3d8f9bb6021e

  • SHA1

    2dc5326e69fcb4d5fcaffa425d26da9078105471

  • SHA256

    fad489fe0b2faa9dd686667136dd9b7895c941614b5d2b80308fc675874b4339

  • SHA512

    5e6821dc0191a0bddc6bd4b9ad6686222b2147add94e2cb4d220e5f8904868774af205d09d5a6fe6c7a49902e79da5039755239588908287a486422c67e2b381

  • SSDEEP

    98304:pLIFNPOUR4Zpw1tyUeGcBAx91ylzPtn7z/:pLIFIGUJUeZAAn7z/

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 59 IoCs

    Checks for missing Authenticode signature.

Files

  • 4de033db9fbc9b3814df3d8f9bb6021e_JaffaCakes118
    .rar
  • FixOD/AutoPach使用说明.txt
  • FixOD/AutoPath.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • FixOD/Ollydbg.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • FixOD/下载说明.htm
    .html .js polyglot
  • LIB/MFC42.Lib
  • LIB/mfc71.Lib
  • LIB/下载说明.htm
    .html .js polyglot
  • Labeler.def
  • Labeler.dll
    .dll windows:4 windows x86 arch:x86

    06ea2d72a19948d127c668a02c20d871


    Headers

    Imports

    Exports

    Sections

  • OLLYDBG.HLP
  • OLLYDBG_EN.HLP
  • OMS/HelloWorld.oms
  • OMS/Include.oms
  • OMS/UPX.omb
  • OMS/UPX.oms
  • OMS/下载说明.htm
    .html .js polyglot
  • Ollydbg.exe
    .exe windows:4 windows x86 arch:x86

    601aae4d9b90819ecbda85f5864d7478


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/AJunk.dll
    .dll windows:4 windows x86 arch:x86

    ffe44f26c0d9297089f8f0ce09ddcbeb


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/APIBREAK.GID
  • PLUGIN/APIBREAK.HLP
  • PLUGIN/ApiBreak.dll
    .dll windows:4 windows x86 arch:x86

    d1b047fb25cf87c47f56c7c1f6c36481


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/Asm2Clipboard.dll
    .dll windows:4 windows x86 arch:x86

    e61f2f894125bb9afbf614ac34b38d66


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/BOOKMARK.DLL
    .dll windows:4 windows x86 arch:x86

    da6b10b05e8674fb7aecee87da89a0b5


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/CMDLINE.DLL
    .dll windows:4 windows x86 arch:x86

    579abc59a4397386f6b066abf5b0a808


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/CMDLINE.GID
  • PLUGIN/CMDLINE.HLP
  • PLUGIN/CleanupEx.dll
    .dll windows:4 windows x86 arch:x86

    0fe2f15fa556a8a4f603d1aa98436e5b


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/CmdBar.dll
    .dll windows:4 windows x86 arch:x86

    8237a071a93d3584cd8637b75759e33d


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/CmdBar.ini
  • PLUGIN/DBGHELP.DLL
    .dll windows:5 windows x86 arch:x86

    515ee46e8930abe46e0569a1a18643ae


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/DeJunk.dll
    .dll windows:4 windows x86 arch:x86

    5c7e6e129f3d0db37da67a25bf1c7c2d


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/DeJunk.ini
  • PLUGIN/DeJunk.sfv
  • PLUGIN/GODUP.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PLUGIN/HideCapt.dll
    .dll windows:4 windows x86 arch:x86

    aac81007ee11dd5bd3becaca32d8f557


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/HideDebugger.dll
    .dll windows:4 windows x86 arch:x86

    650c3e9a8e7dd4b7fd346d6390f402dc


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/HideDebugger.ini
  • PLUGIN/IsDebug V1.4.dll
    .dll windows:4 windows x86 arch:x86

    68c17316b24998c2b049601d0b1cb191


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/Junkdb.cfg
  • PLUGIN/Labeler.def
  • PLUGIN/Labeler.dll
    .dll windows:4 windows x86 arch:x86

    06ea2d72a19948d127c668a02c20d871


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/Labelmaster.dll
    .dll windows:4 windows x86 arch:x86

    eda943ffeef7e454ec8615ec94f3283c


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/LoadMap.dll
    .dll windows:4 windows x86 arch:x86

    3f99bf734aac3ee09ec3cf76b1a38a22


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/MapConv.dll
    .dll windows:4 windows x86 arch:x86

    b94d712b8fa0d054b21e650b95d330eb


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/MapConv.txt
  • PLUGIN/MemoryManage.dll
    .dll windows:4 windows x86 arch:x86

    8edd555285671dd08f37de21556e2210


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/ODbgScript.dll
    .dll windows:4 windows x86 arch:x86

    5b9bf3a8bd6f4682c0bd5436ae6ff14a


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/OllyDump.dll
    .dll windows:4 windows x86 arch:x86

    5a3ef0fd287f0ec4556b6cfd980bb4f8


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/OllyDump.ini
  • PLUGIN/OllyFlow.dll
    .dll windows:4 windows x86 arch:x86

    506afa0cf48ee2fe0ef045543f83b1ca


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/OllyHelper.dll
    .dll windows:4 windows x86 arch:x86

    a0d01e71f240618f72e04b3154723f8d


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/OllyMachine 手册.chm
    .chm
  • PLUGIN/OllyMachine.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PLUGIN/OllyMachine.ini
  • PLUGIN/OllyScript.dll
    .dll windows:4 windows x86 arch:x86

    64396bbdb5c627bbaf0d0a7c8d690e5a


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/OllyScript中文说明.txt
  • PLUGIN/StayOntop.dll
    .dll windows:4 windows x86 arch:x86

    9260652e20586b72289e6453ec96f112


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/TracKid.dll
    .dll windows:4 windows x86 arch:x86

    97c3807720f0f6f83a1750bbbba2de94


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/UnhExcFlt.DLL
    .dll windows:1 windows x86 arch:x86

    4fe780c7e8f5ca7f06f744a177dc9d91


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/UnhExcFlt.txt
  • PLUGIN/WatchMan.dll
    .dll windows:4 windows x86 arch:x86

    5c68a0c6cac471c2955db195e9827dc6


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/dejunk 1.2.txt
  • PLUGIN/dumpsig.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PLUGIN/extracopy.dll
    .dll windows:4 windows x86 arch:x86

    4ff0fb7a18877b21e2fd37dc5295776d


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/mapgen.plw
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • PLUGIN/olly2html.pl
    .pl .sh linux
  • PLUGIN/pedumper.dll
    .dll windows:4 windows x86 arch:x86

    b0ecd0eb613df2039cc7fc8ad77ec216


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/pedumper.txt
  • PLUGIN/ustrrefadd.dll
    .dll windows:4 windows x86 arch:x86

    a01cccc8e3ba52324654aff7eb74f12a


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/windowinfos.dll
    .dll windows:4 windows x86 arch:x86

    c488b1f3e4ae48af92ad4f0457f5cd8d


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/windowjuggler.dll
    .dll windows:4 windows x86 arch:x86

    20719683fbe13dd831fa72bb684ec1d2


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/wingraph32.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PLUGIN/下载说明.htm
    .html .js polyglot
  • PLUGIN/备用/OllyDump_2.21.dll
    .dll windows:4 windows x86 arch:x86

    e6d1da18fcee526ee7459f2bd43b4f00


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/备用/PuntosMagicos.dll
    .dll windows:4 windows x86 arch:x86

    a7a0643acd26728f7f35d1b9352818ce


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/备用/olly_bp_man.dll
    .dll windows:4 windows x86 arch:x86

    267dcf9ab873041acf68448fd4586747


    Headers

    Imports

    Exports

    Sections

  • PLUGIN/备用/ustrref.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • PSAPI.DLL
    .dll windows:5 windows x86 arch:x86

    cc0703efce46b4b2d90e7279fd0456d8


    Headers

    Imports

    Exports

    Sections

  • Scripts/32Lite 0.03a.txt
  • Scripts/ARMADiLLO DETECTiVE v1.00.txt
  • Scripts/ASPR 1.23RC4.txt
  • Scripts/ASPR 1.23RC4findOEP.txt
  • Scripts/ASProtect 1.2-1.2c.txt
  • Scripts/ASProtect 1.22 - 1.23 Beta 21-Rc1.txt
  • Scripts/ASProtect 2.0 Unpack.txt
  • Scripts/ASpack 1.x-2.x.txt
  • Scripts/Arm 3.7Std_release.txt
  • Scripts/Asprotect1.x.txt
  • Scripts/Crunch v1.0.txt
  • Scripts/CrunchPE Heuristic.txt
  • Scripts/Dxpack 0.86.txt
  • Scripts/EXE Stealth2.72.txt
  • Scripts/EXE Stealth2.74.txt
  • Scripts/EXE32Pack 1.3X.txt
  • Scripts/EZIP 1.0.txt
  • Scripts/JDPack 1.01.txt
  • Scripts/Krypton0.5.txt
  • Scripts/MoleBox2.X 跳过IAT加密.TXT
  • Scripts/NSpack 1.3.txt
  • Scripts/Neolite 2.0 .txt
  • Scripts/PC Shrinker 0.71.txt
  • Scripts/PC-Guard 5.0.txt
  • Scripts/PE-SHiELD V0.25.txt
  • Scripts/PECompact 2.x.txt
  • Scripts/PECompact 2.xx.txt
  • Scripts/PEDiminishe 0.1.txt
  • Scripts/PEPack 1.0.txt
  • Scripts/PESpin V0.1.txt
  • Scripts/PEbundle V2.3 Oep+ Patch IAT.txt
  • Scripts/PEncrypt 4.0.TXT
  • Scripts/PKLITE32 1.1.txt
  • Scripts/PeLock1.06c.txt
  • Scripts/Pecompact 1.x.txt
  • Scripts/Petite 2.2 Patch IAT.txt
  • Scripts/Petite 2.2.txt
  • Scripts/Stolen code Finder.txt
  • Scripts/Telock0.98x.txt
  • Scripts/UPX-Scrambler RC1.x.txt
  • Scripts/UPX.osc
  • Scripts/UPXShit 0.x.txt
  • Scripts/Upx 1.x.txt
  • Scripts/VGCrypt PE Encryptor V0.75.txt
  • Scripts/WWPack32 1.x.txt
  • Scripts/anti-debug_lastex.txt
  • Scripts/arma_detach.txt
  • Scripts/arma_unpack.txt
  • Scripts/aspack.txt
  • Scripts/aspack_1.08.02.txt
  • Scripts/aspack_212.txt
  • Scripts/aspr_123_rc4.txt
  • Scripts/aspr_130b.txt
  • Scripts/aspr_131b.txt
  • Scripts/aspr_generic.txt
  • Scripts/asprbp.txt
  • Scripts/asprotect 1.23 RC4.txt
  • Scripts/asprotect_13b_stolen_code.txt
  • Scripts/asprsoep.txt
  • Scripts/asprsto.txt
  • Scripts/dbpe2x.txt
  • Scripts/dbpe_2.x.txt
  • Scripts/execryptor_1.5x.txt
  • Scripts/exeshield_0x.txt
  • Scripts/exestealth_2.7.txt
  • Scripts/exestealth_2.74.txt
  • Scripts/ezip_10.txt
  • Scripts/fsg2.0.txt
  • Scripts/fsg_1.33.txt
  • Scripts/fsg_1.33_2.txt
  • Scripts/fsg_2_0.txt
  • Scripts/krypton_0.5.txt
  • Scripts/lastex.txt
  • Scripts/mew10_1_0.txt
  • Scripts/molebox_2x.txt
  • Scripts/morphine_1.2.txt
  • Scripts/morphine_13.txt
  • Scripts/neolite 2.0.txt
  • Scripts/neolite20.txt
  • Scripts/obsidium_1_0061.txt
  • Scripts/pcguard_150.txt
  • Scripts/pebundle_2x.txt
  • Scripts/pecompact_1_76.txt
  • Scripts/pecompact_1_84.txt
  • Scripts/pediminisher_1_0.txt
  • Scripts/pelock_204.txt
  • Scripts/pepack10.txt
  • Scripts/peshield.txt
  • Scripts/pespin_0.3.txt
  • Scripts/pespin_0304_vb.txt
  • Scripts/pespin_07.txt
  • Scripts/petite22.txt
  • Scripts/pex_0_99.txt
  • Scripts/pklite32_1.1.txt
  • Scripts/protection_plus_oep.txt
  • Scripts/stolen bytes.txt
  • Scripts/svkp_13x.txt
  • Scripts/svkpoep.txt
  • Scripts/tElock 0.9-1.0 OEP Finder.txt
  • Scripts/telock098.osc
  • Scripts/telock098.txt
  • Scripts/telock_0.9.txt
  • Scripts/uprot1_def.txt
  • Scripts/uprot1_vb.txt
  • Scripts/upx.txt
  • Scripts/upx_upxprot.txt
  • Scripts/upxprotector_10x.txt
  • Scripts/upxscr_rc1.txt
  • Scripts/upxshit006.txt
  • Scripts/virogen_075.txt
  • Scripts/y0da_crypter_1.2.txt
  • Scripts/yoda's Crypter V1.2-1.3.txt
  • Scripts/yoda's cryptor 1.x modified.txt
  • Scripts/下载说明.htm
    .html .js polyglot
  • Scripts/中文ReadMe.txt
  • Scripts/变形fsg1.33.txt
  • Scripts/普通fsg1.33.txt
  • Scripts/普通变形 fsg1.33.txt
  • Signs.txt
  • Tools/API地址专家/API地址专家.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Tools/IDT Protector/IDTProt.exe
    .exe windows:4 windows x86 arch:x86

    4026a1632994b3e2bbfb45b4791f5f45


    Headers

    Imports

    Sections

  • Tools/IDT Protector/cyclotron.sys
    .sys windows:4 windows x86 arch:x86

    f6f312186fcbea7e206cd83593bb86d8


    Headers

    Imports

    Sections

  • Tools/IDT Protector/readme.txt
  • Tools/IDTools For WinXP/IdtTool.exe
    .exe windows:4 windows x86 arch:x86

    105e8604e5e2cbcaa7cc7f3eda5d2e39


    Headers

    Imports

    Sections

  • Tools/IDTools For WinXP/IdtTool.sys
    .sys windows:4 windows x86 arch:x86

    f6f312186fcbea7e206cd83593bb86d8


    Headers

    Imports

    Sections

  • Tools/IDTools For WinXP/osrloader.exe
    .exe windows:4 windows x86 arch:x86

    78ba2a8c49c789dd4d35b2b39406811e


    Headers

    Imports

    Sections

  • Tools/OSCEditor/Chinese.Lng
  • Tools/OSCEditor/Chinese.lst
  • Tools/OSCEditor/English.Lng
  • Tools/OSCEditor/English.lst
  • Tools/OSCEditor/OSEditor.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Tools/OSCEditor/OllyScripts/ACprotect1.22D.TXT
  • Tools/OSCEditor/OllyScripts/ACprotect1.22VB.TXT
  • Tools/OSCEditor/OllyScripts/ALEX Protector1.0.txt
  • Tools/OSCEditor/OllyScripts/ASPACKDLL.txt
  • Tools/OSCEditor/OllyScripts/ASPR13b.TXT
  • Tools/OSCEditor/OllyScripts/Arm3.7Std_release.txt
  • Tools/OSCEditor/OllyScripts/EPE2003518.txt
  • Tools/OSCEditor/OllyScripts/EXE Shield v0.5.txt
  • Tools/OSCEditor/OllyScripts/EXECryptor1.53.TXT
  • Tools/OSCEditor/OllyScripts/EZip 1.0.txt
  • Tools/OSCEditor/OllyScripts/ExEStealth2.74.txt
  • Tools/OSCEditor/OllyScripts/Krypton0.5.txt
  • Tools/OSCEditor/OllyScripts/MoleBox2.TXT
  • Tools/OSCEditor/OllyScripts/Obsidium1.061vb.txt
  • Tools/OSCEditor/OllyScripts/Obsidium114.txt
  • Tools/OSCEditor/OllyScripts/PCGURAD5.TXT
  • Tools/OSCEditor/OllyScripts/PEBundle 2.0x.txt
  • Tools/OSCEditor/OllyScripts/PELock1.x.txt
  • Tools/OSCEditor/OllyScripts/PESPIN v0.7.TXT
  • Tools/OSCEditor/OllyScripts/PESpin0.3sc.TXT
  • Tools/OSCEditor/OllyScripts/PETITE2.2.txt
  • Tools/OSCEditor/OllyScripts/PePack1.0.txt
  • Tools/OSCEditor/OllyScripts/Pecompact.txt
  • Tools/OSCEditor/OllyScripts/SoftSentry3.txt
  • Tools/OSCEditor/OllyScripts/TELOCK 0.9.TXT
  • Tools/OSCEditor/OllyScripts/UPX.txt
  • Tools/OSCEditor/OllyScripts/a.txt
  • Tools/OSCEditor/OllyScripts/arm.txt
  • Tools/OSCEditor/OllyScripts/asp2test.txt
  • Tools/OSCEditor/OllyScripts/aspack.txt
  • Tools/OSCEditor/OllyScripts/aspr1.23rc1.txt
  • Tools/OSCEditor/OllyScripts/aspr1.23rc4.txt
  • Tools/OSCEditor/OllyScripts/dbpe2x.txt
  • Tools/OSCEditor/OllyScripts/fsg1.33.txt
  • Tools/OSCEditor/OllyScripts/jdpack.txt
  • Tools/OSCEditor/OllyScripts/morphine1.2.TXT
  • Tools/OSCEditor/OllyScripts/neolite 2.0.txt
  • Tools/OSCEditor/OllyScripts/pecompact208.TXT
  • Tools/OSCEditor/OllyScripts/svk1.32.TXT
  • Tools/OSCEditor/OllyScripts/tElock098.txt
  • Tools/OSCEditor/OllyScripts/telock-forgot.txt
  • Tools/OSCEditor/OllyScripts/upxshit.txt
  • Tools/OSCEditor/config.ini
  • Tools/OSCEditor/help.chm
    .chm
  • Tools/dll_loader/Dll_LoadEx.exe
    .exe windows:4 windows x86 arch:x86

    e545064de16acbfb75832a11d68a3dd7


    Headers

    Imports

    Sections

  • Tools/下载说明.htm
    .html .js polyglot
  • license.txt
  • loaddll.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • ollydbg.ini
  • readme.txt
  • register.txt
  • 下载说明.htm
    .html .js polyglot
  • 原版界面/Ollydbg.exe
    .exe windows:4 windows x86 arch:x86

    601aae4d9b90819ecbda85f5864d7478


    Headers

    Imports

    Exports

    Sections

  • 原版界面/下载说明.htm
    .html .js polyglot
  • 汉化说明.txt
  • 英文配置补丁/下载说明.htm
    .html .js polyglot
  • 英文配置补丁/配置文件恢复为英文补丁.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections