Overview

overview

7

Static

static

7

4df10abbfa...18.exe

windows7-x64

7

4df10abbfa...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/fct.dll

windows7-x64

3

$PLUGINSDIR/fct.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

bho_project.dll

windows7-x64

6

bho_project.dll

windows10-2004-x64

6

chromeaddo...ded.js

windows7-x64

3

chromeaddo...ded.js

windows10-2004-x64

3

chromeaddo...d.html

windows7-x64

1

chromeaddo...d.html

windows10-2004-x64

1

chromeaddo...ded.js

windows7-x64

3

chromeaddo...ded.js

windows10-2004-x64

3

facetheme/build.sh

ubuntu-18.04-amd64

3

facetheme/build.sh

debian-9-armhf

3

facetheme/build.sh

debian-9-mips

3

facetheme/build.sh

debian-9-mipsel

3

facetheme/...ild.sh

ubuntu-18.04-amd64

facetheme/...ild.sh

debian-9-armhf

facetheme/...ild.sh

debian-9-mips

facetheme/...ild.sh

debian-9-mipsel

facetheme/...lay.js

windows7-x64

3

facetheme/...lay.js

windows10-2004-x64

3

facetheme/...oku.js

windows7-x64

3

facetheme/...oku.js

windows10-2004-x64

3

facetheme/...oku.js

windows7-x64

3

facetheme/...oku.js

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4df10abbfafa32bbc9a5a2e29519dad6_JaffaCakes118

  • Size

    140KB

  • MD5

    4df10abbfafa32bbc9a5a2e29519dad6

  • SHA1

    65855116e100f15cb335344d114f654b56f58329

  • SHA256

    d86b50c9f03cd6ffe84c271ac875e4a40636285410baa6f6ea43294ae8c164f3

  • SHA512

    1f66361146b8f9386926adca774e929ffce4c9db35b1af7cfb91412f30ee8bf990a2ee167a0c791ae82a0f333a4d3597908dec7cb96c75660e2c25594e92e92a

  • SSDEEP

    3072:sgXdZt9P6D3XJ/ZfFsuGClOK2MQjVzf+vt6HmBnQo4sG:se345Zuu/lp2MgktFBnQ3

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 4df10abbfafa32bbc9a5a2e29519dad6_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/fct.dll
    .dll windows:4 windows x86 arch:x86

    ea6c66dd8fdf3fe3fb04ddbc357acc4c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • ChromeAddon.pem
  • bho_project.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    0e706f7e1a186465bb0a1ca4a8b35a73


    Headers

    Imports

    Exports

    Sections

  • chromeaddon/._included.js
  • chromeaddon/background.html
    .html .js polyglot
  • chromeaddon/included.js
    .js
  • chromeaddon/manifest.json
  • facetheme/build.sh
    .sh linux
  • facetheme/chrome.manifest
  • facetheme/config_build.sh
    .sh linux
  • facetheme/content/.DS_Store
  • facetheme/content/firefoxOverlay.xul
    .js .xml polyglot
  • facetheme/content/overlay.js
    .js
  • facetheme/content/sudoku.js
    .js
  • facetheme/defaults/.DS_Store
  • facetheme/defaults/preferences/.DS_Store
  • facetheme/defaults/preferences/._sudoku.js
  • facetheme/defaults/preferences/sudoku.js
  • facetheme/files
  • facetheme/install.rdf
    .xml
  • facetheme/locale/.DS_Store
  • facetheme/locale/en-US/.DS_Store
  • facetheme/locale/en-US/sudoku.dtd
  • facetheme/locale/en-US/sudoku.properties
  • facetheme/readme.txt
  • facetheme/skin/overlay.css
  • facetheme_uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections