Overview

overview

7

Static

static

7

5bd16d21d2...18.exe

windows7-x64

7

5bd16d21d2...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...el.dll

windows7-x64

7

$PLUGINSDI...el.dll

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...Ex.dll

windows7-x64

1

$PLUGINSDI...Ex.dll

windows10-2004-x64

1

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    5bd16d21d26816a40308ea76e26cb668_JaffaCakes118

  • Size

    642KB

  • MD5

    5bd16d21d26816a40308ea76e26cb668

  • SHA1

    8ede1d272ee316ded8eaed1e2c354d898409c3d0

  • SHA256

    e7c1d21fd04d7d98e648760167f5ff4f529a33bc30a22a200183e254be19b8f8

  • SHA512

    7d346459298cb7bff17a60cc251623412058a1ebdcfa16e50b04f054026e6fa504e3b676fc55af25f4b607a97e05920db9dd5a89e7b5da47928d62757f3e4ffe

  • SSDEEP

    12288:ghe0yihY1gQPPcIu2+1G8jVkvBe2YgqPjAkIqzhY1gOPPcIui+1G8jVkvBXUOKkP:ghHG64PD2j4nKjAjqy6CPDsj4rK4jt

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 5bd16d21d26816a40308ea76e26cb668_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SelfDel.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsProcEx.dll
    .dll windows:4 windows x86 arch:x86

    daf52b2ab14b28b4b5e48fbfeb1aab77


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/winsps.da_
  • $WINDIR/System32/svcspwin.da_
  • $WINDIR/System32/wdrwspsvc.da_
  • uninst.exe.nsis
  • winspb.da_
  • winsps.da_