Overview

overview

7

Static

static

7

5b36a809f5...18.exe

windows7-x64

7

5b36a809f5...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

NeoTheme.exe

windows7-x64

7

NeoTheme.exe

windows10-2004-x64

7

system/rep...ge.vbs

windows7-x64

1

system/rep...ge.vbs

windows10-2004-x64

1

system/rep...al.cmd

windows7-x64

1

system/rep...al.cmd

windows10-2004-x64

1

system/rep...ap.exe

windows7-x64

1

system/rep...ap.exe

windows10-2004-x64

1

system/rep...er.cmd

windows7-x64

4

system/rep...er.cmd

windows10-2004-x64

4

Clear_WFP_Message.vbs

windows7-x64

1

Clear_WFP_Message.vbs

windows10-2004-x64

1

Special.cmd

windows7-x64

1

Special.cmd

windows10-2004-x64

1

Zap.exe

windows7-x64

1

Zap.exe

windows10-2004-x64

1

system/uxt...me.dll

windows7-x64

1

system/uxt...me.dll

windows10-2004-x64

1

system/uxt...me.dll

windows7-x64

1

system/uxt...me.dll

windows10-2004-x64

1

system/uxt...me.dll

windows7-x64

1

system/uxt...me.dll

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b36a809f5540c7ae63b24307e2f5f8c_JaffaCakes118

  • Size

    400KB

  • MD5

    5b36a809f5540c7ae63b24307e2f5f8c

  • SHA1

    3ab10179ad96c377063e0f4e884922359e7a6aeb

  • SHA256

    d83c0c1d705680e7cbc222b0aedec2b9601d0f575b70d6a7ffc9d68de9237da8

  • SHA512

    90ec2c96d83dee39df9514441ab3b6ec9d866dc7d8e821b3a477a8a2bc656c16000f634c3868940d81c413b25b85c79953d9842a992d595a2ba379354702eb55

  • SSDEEP

    6144:ECP0r7k3nVHJlbD0hN2Px592nbFheTYkXELuSI/OdGiYWabf3y7IJGhCo4X0zrE/:dk43ntLPMGmbFhq+yakghKEPE9kA

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 5b36a809f5540c7ae63b24307e2f5f8c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    1cf4252ebbb4f173d97a6ef4f79a60b5


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    922b855d216a21490e4bcbf6c29b7f7d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    aebc3107701149edfc563b8db7a789fd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Changelog.txt
  • License.txt
  • NeoTheme.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Readme.txt
  • system/001.gif
    .gif
  • system/002.gif
    .gif
  • system/Thumbs.db
  • system/neowin_icon.ico
  • system/replacer/.ReplacerTemp/Clear_WFP_Message.vbs
    .vbs
  • system/replacer/.ReplacerTemp/Messages.txt
  • system/replacer/.ReplacerTemp/Special.cmd
    .cmd .vbs
  • system/replacer/.ReplacerTemp/Zap.exe
    .exe windows:1 windows x86 arch:x86

    685f13adf8c237dbc6d064cafff5d908


    Headers

    Imports

    Sections

  • system/replacer/Replacer.cmd
    .cmd .vbs
  • system/replacer/data
    .cab
  • Clear_WFP_Message.vbs
    .vbs
  • Messages.txt
  • Special.cmd
    .cmd .vbs
  • Zap.exe
    .exe windows:1 windows x86 arch:x86

    685f13adf8c237dbc6d064cafff5d908


    Headers

    Imports

    Sections

  • system/replacer/readme.txt
  • system/uxtheme/nosp/uxtheme.dll
    .dll windows:5 windows x86 arch:x86

    b4b28d10a600e958ea46ec9ce2c6dbc2


    Headers

    Imports

    Exports

    Sections

  • system/uxtheme/sp1/uxtheme.dll
    .dll windows:5 windows x86 arch:x86

    f01fd9772195faafb57dcadf07c223c7


    Headers

    Imports

    Exports

    Sections

  • system/uxtheme/sp1/vorte[x].nfo
  • system/uxtheme/sp2/uxtheme.dll
    .dll windows:5 windows x86 arch:x86

    a7749dbee9f6101268b6fc01b6b578dc


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    1cf4252ebbb4f173d97a6ef4f79a60b5


    Headers

    Imports

    Sections