General

  • Target

    5b2263b31fdf0c91b335494d22c5156c_JaffaCakes118

  • Size

    1.0MB

  • MD5

    5b2263b31fdf0c91b335494d22c5156c

  • SHA1

    587317ae94a89521c3ef31f72d3d960f1af63799

  • SHA256

    79f16938bfbb43225489e05d8b75dc982720f723a07318623e7d638633f8237a

  • SHA512

    916bfa242bc5f91ed554fce6a9222e5ad92492f31f343696c81b64281a6de77b412d1ae4a0a37272490c49d331048fc12d92222be53f3826f30503836b3f30fc

  • SSDEEP

    12288:n94iIWKWdHaaNXib4W8e80M8J3OHFXC8WflEdAKEFD7z4hgK6LQf7H5jVhPcWryO:nSiIadFVibp6OOHF2HchgxeH0WryAv

Score
9/10
upx

Malware Config

Signatures

  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 5b2263b31fdf0c91b335494d22c5156c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InetLoad.dll
    .dll windows:4 windows x86 arch:x86

    24a4a671f5cc294ce3543d18a1e873cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MakeDll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsRandom.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/registry.dll
    .dll windows:4 windows x86 arch:x86

    cd53277eaa7bbb8fb5b2b678274dcb4e


    Headers

    Imports

    Exports

    Sections

  • $TEMP/v.txt
    .vbs
  • $TEMP/xcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_48_/$APPDATA/$_49_
  • $_48_/$APPDATA/xcmd.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $_48_/$DESKTOP/$_49_
  • $_48_/$STARTMENU/$_49_
  • $_48_/$SYSDIR/game.ico
  • $_48_/$SYSDIR/taobao.ico
  • $_48_/1.html
  • $_48_/3.bat
  • $_48_/3.vbs
    .vbs
  • $_48_/game.ico
  • $_48_/qq
    .vbs
  • $_48_/qq.ico
  • $_48_/taobao.ico
  • $_48_/v.txt
    .vbs
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • oem.ini
  • ֮.exe
    .exe windows:4 windows x86 arch:x86

    529e31f77e52cbf0a3f800a64416df7b


    Code Sign

    Headers

    Imports

    Sections

  • ֮.ini