Overview

overview

7

Static

static

7

705008beb5...18.exe

windows7-x64

7

705008beb5...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

ffmpeg/ffmpeg.exe

windows7-x64

3

ffmpeg/ffmpeg.exe

windows10-2004-x64

3

ffmpeg/ffmpeg.url

windows7-x64

6

ffmpeg/ffmpeg.url

windows10-2004-x64

3

infolib.dll

windows7-x64

3

infolib.dll

windows10-2004-x64

3

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

url/buy.url

windows7-x64

6

url/buy.url

windows10-2004-x64

3

url/software.url

windows7-x64

6

url/software.url

windows10-2004-x64

3

wsrp2010.exe

windows7-x64

7

wsrp2010.exe

windows10-2004-x64

7

wsrphook.dll

windows7-x64

3

wsrphook.dll

windows10-2004-x64

3

wsrphook.exe

windows7-x64

3

wsrphook.exe

windows10-2004-x64

3

wsrphook64.dll

windows7-x64

1

wsrphook64.dll

windows10-2004-x64

1

wsrphook64.exe

windows7-x64

1

wsrphook64.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    705008beb5dd0115c023303cfd08c294_JaffaCakes118

  • Size

    4.9MB

  • MD5

    705008beb5dd0115c023303cfd08c294

  • SHA1

    9fc6305a1f9609173902ac13ed5d3035cc824b78

  • SHA256

    799c1009dee9610e48f1a5ddb674759177a1210232344b573e175c8fd3660592

  • SHA512

    a87ba3fe17645aedd7da85d6a50df03d1c7be3dbd93de6e467f5357ef93c5e5529bd47ff08839c5f1818c79b59b52e48a273d7a6bddcbb35526dc85cca05890c

  • SSDEEP

    98304:1Wv+eTZqXgxYwpn7k7JMbRz3bc5I9TJWWkwlnD0e14c1xIXqo9K7iCmwhFlHCRG9:gv+etwMV7k7qhbPN68DjHw9YXm2PHiG9

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 705008beb5dd0115c023303cfd08c294_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • ffmpeg/ffmpeg.exe
    .exe windows:4 windows x86 arch:x86

    2bc0e0586060f3c7ff75aeb1d017268a


    Headers

    Imports

    Sections

  • ffmpeg/ffmpeg.url
  • infolib.dll
    .dll windows:5 windows x86 arch:x86

    91f009da19a32309b95696f78aa117f8


    Headers

    Imports

    Exports

    Sections

  • license.txt
  • sounds/done.wav
  • sounds/error.wav
  • sounds/gotcha.wav
  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • url/buy.url
  • url/software.url
  • wsrp2010.exe
    .exe windows:5 windows x86 arch:x86

    23a401da948b04cf5e6e4a48d9c67f54


    Headers

    Imports

    Sections

  • wsrphook.dll
    .dll windows:5 windows x86 arch:x86

    360a4f099e4e973016a2ed53dc217970


    Headers

    Imports

    Exports

    Sections

  • wsrphook.exe
    .exe windows:5 windows x86 arch:x86

    52ddb15c4ad98e8f3f29c96d92dcf1f9


    Headers

    Imports

    Sections

  • wsrphook64.dll
    .dll windows:5 windows x64 arch:x64

    b8a878fe6e9ed63743bdb0ee23f5f100


    Headers

    Imports

    Exports

    Sections

  • wsrphook64.exe
    .exe windows:5 windows x64 arch:x64

    27edcd9078ca57eaad05b79a60b58a43


    Headers

    Imports

    Sections