Overview

overview

8

Static

static

8

bin/3proxy.exe

windows7-x64

1

bin/3proxy.exe

windows10-2004-x64

1

bin/PCREPlugin.dll

windows7-x64

3

bin/PCREPlugin.dll

windows10-2004-x64

3

bin/StringsPlugin.dll

windows7-x64

3

bin/StringsPlugin.dll

windows10-2004-x64

3

bin/TrafficPlugin.dll

windows7-x64

3

bin/TrafficPlugin.dll

windows10-2004-x64

3

bin/Window...on.dll

windows7-x64

1

bin/Window...on.dll

windows10-2004-x64

1

bin/countersutil.exe

windows7-x64

1

bin/countersutil.exe

windows10-2004-x64

1

bin/dighosts.exe

windows7-x64

1

bin/dighosts.exe

windows10-2004-x64

1

bin/mycrypt.exe

windows7-x64

1

bin/mycrypt.exe

windows10-2004-x64

1

cfg/3proxy.cfg.sample

ubuntu-18.04-amd64

cfg/3proxy.cfg.sample

debian-9-armhf

cfg/3proxy.cfg.sample

debian-9-mips

cfg/3proxy.cfg.sample

debian-9-mipsel

cfg/sql/report.xls

windows7-x64

1

cfg/sql/report.xls

windows10-2004-x64

1

doc/devel/devref.rtf

windows7-x64

4

doc/devel/devref.rtf

windows10-2004-x64

1

doc/html/faqe.html

windows7-x64

1

doc/html/faqe.html

windows10-2004-x64

1

doc/html/faqr.html

windows7-x64

1

doc/html/faqr.html

windows10-2004-x64

1

doc/html/howtoe.html

windows7-x64

1

doc/html/howtoe.html

windows10-2004-x64

1

doc/html/howtor.html

windows7-x64

1

doc/html/howtor.html

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    621698b9beee0dbe68aa84ecfef9d1e9_JaffaCakes118

  • Size

    580KB

  • MD5

    621698b9beee0dbe68aa84ecfef9d1e9

  • SHA1

    638dd87aafa2cfd685b037b40a127111a6973e2a

  • SHA256

    8ac32fc7cd97690b5bc5fc43d791919a6002e3cffa0e2db0314786ab0271ccd4

  • SHA512

    78939bc2ee94954d0ee934e54d69a563f1390714adbabcfe58c7076580e4085abbbda6099adff3b5715a6231066bea6b738a34e2ac25acf274ab38365e50b739

  • SSDEEP

    12288:UirU3q3w3+9919uy+FXmUWIkDWER1FuBwxD5SQ/IeQgq5Nd+:YfcUy57R/uCdSyRQguv+

Score
8/10
macro

Malware Config

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 621698b9beee0dbe68aa84ecfef9d1e9_JaffaCakes118
    .zip
  • Changelog
  • Readme
  • authors
  • bin/3proxy.exe
    .exe windows:4 windows x86 arch:x86

    a1beb1b3f5af3d8816a3c2eaee5a1e76


    Headers

    Imports

    Sections

  • bin/PCREPlugin.dll
    .dll windows:4 windows x86 arch:x86

    927f93568fa9337f0d03dce32397f721


    Headers

    Imports

    Exports

    Sections

  • bin/StringsPlugin.dll
    .dll windows:4 windows x86 arch:x86

    af27f8630a1ed4291941c0cfcd196a6e


    Headers

    Imports

    Exports

    Sections

  • bin/TrafficPlugin.dll
    .dll windows:4 windows x86 arch:x86

    0b93c4ade4233ed58878ebb6072ffdaa


    Headers

    Imports

    Exports

    Sections

  • bin/WindowsAuthentication.dll
    .dll windows:4 windows x86 arch:x86

    e03bdd1998d92d56b569992045e9eb14


    Headers

    Imports

    Exports

    Sections

  • bin/countersutil.exe
    .exe windows:4 windows x86 arch:x86

    c00f169032f7d9e9fc5953c23db29843


    Headers

    Imports

    Sections

  • bin/dighosts.exe
    .exe windows:4 windows x86 arch:x86

    de2444828b8fda0f2072e3d0cd43a6a8


    Headers

    Imports

    Sections

  • bin/mycrypt.exe
    .exe windows:4 windows x86 arch:x86

    2dcbc36e1de884d24da48a008515a5a0


    Headers

    Imports

    Sections

  • bin/rus-koi8-r.3ps
  • bin/rus-win1251.3ps
  • cfg/0.scenario.txt
  • cfg/3proxy.cfg.sample
    .sh linux
  • cfg/counters.sample
  • cfg/sql/3proxy.cfg
  • cfg/sql/create.sql
  • cfg/sql/report.xls
    .xls windows office2003

    ЭтаКнига

    Лист1

    Лист2

    Лист3

    Module1

  • copying
  • doc/devel/devref.rtf
    .rtf
  • doc/html/faqe.html
  • doc/html/faqr.html
  • doc/html/howtoe.html
  • doc/html/howtor.html
  • doc/html/index.html
    .html
  • doc/html/man3/3proxy.cfg.3.html
  • doc/html/man8/3proxy.8.html
  • doc/html/man8/3proxy.conf.3.html
  • doc/html/man8/ftppr.8.html
  • doc/html/man8/pop3p.8.html
  • doc/html/man8/proxy.8.html
  • doc/html/man8/socks.8.html
  • doc/html/man8/tcppm.8.html
  • doc/html/man8/udppm.8.html
  • doc/html/securityen.html
  • doc/ru/3proxy_for_dummies.rtf
    .rtf
  • doc/ru/example1.txt
  • doc/ru/iodbc.txt
  • doc/ru/odbc.txt
  • news