Overview

overview

7

Static

static

5

5bb4bf4abf...18.exe

windows7-x64

7

5bb4bf4abf...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nk.dll

windows7-x64

3

$PLUGINSDI...nk.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDI...tp.dll

windows7-x64

1

$PLUGINSDI...tp.dll

windows10-2004-x64

1

$TEMP/qq.vbs

windows7-x64

3

$TEMP/qq.vbs

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

�...��.exe

windows7-x64

3

�...��.exe

windows10-2004-x64

3

�...��.exe

windows7-x64

6

�...��.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5bb4bf4abfd408422d700e32523e962a_JaffaCakes118

  • Size

    1.4MB

  • MD5

    5bb4bf4abfd408422d700e32523e962a

  • SHA1

    35fecbcbf96d18c8c6f93799708adc1687e36f7f

  • SHA256

    8779168270de0ccf60a1ba0e571135d448f435df4ffd2bd47195c531634d1762

  • SHA512

    788ae203db0d75f5d16bd258623591f7312c4ac09586f5319dd16feb81134771c7d73dd198dac47e9d8e0a0659ccb3f42f9b6731195b6783d8900c3cef0bf9a7

  • SSDEEP

    24576:k7Z0+VLLoy7yDZgDstOXV7cFxAtdEBn5ho32x+KtEvhcCgUos1cHcsqr5kBE2NTg:4Z0yH7yFgiOt2Bn/BcKCqCpr1lOpNk

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 5bb4bf4abfd408422d700e32523e962a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:4 windows x86 arch:x86

    ac2c09e68d5518a91b4912bdf6a67d1b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/locate.dll
    .dll windows:4 windows x86 arch:x86

    61142a69a9a888c92fddc2ab9dbb123a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/rfshdktp.dll
    .dll windows:4 windows x86 arch:x86

    042f3c184e7c0923b6325ab1dc09aed7


    Headers

    Imports

    Exports

    Sections

  • $TEMP/qq.ico
  • $TEMP/qq.t
    .vbs
  • oem.ini
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/time.dll
    .dll windows:4 windows x86 arch:x86

    2e3a4d1f132aea64d421c1e936bcc407


    Headers

    Imports

    Exports

    Sections

  • ޸IE ɱ.url
    .url
  • ֮.exe
    .exe windows:5 windows x86 arch:x86

    870b8e75c7190e202e9c6c81dff1040c


    Headers

    Imports

    Sections

  • ֮.ini
  • ֮.nls
    .exe windows:4 windows x86 arch:x86

    d92d1214f85668444e4185543085fbe9


    Code Sign

    Headers

    Imports

    Sections