General

  • Target

    725aaf787e45af3724762bafed23bd6d_JaffaCakes118

  • Size

    5.1MB

  • MD5

    725aaf787e45af3724762bafed23bd6d

  • SHA1

    0ba4558a6bc61a9ae4f29ad4cc17e6216e05f244

  • SHA256

    de8c8b9da365ddab4c02abcadaf9ccbf3f4b84c5ff5ea8daec4ee6165a66a68f

  • SHA512

    3ab62e87a02863d45dd83c574fa14070c688a71f6c1b74cf7268f84a68833354d7e90dc42af0b9e2cbced38d9442236d5eb47ba8b33214a1606d52089fb0c580

  • SSDEEP

    98304:M/bNJcxgxcZIfFsMn/d+mpdlGndCQEJ/hJ6ZYWo5egHVCcOI8emUhZHBEGY:M/bLQ8B1NLkEJhbvUcOwmUh9BE/

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 725aaf787e45af3724762bafed23bd6d_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GameuxInstallHelper.dll
    .dll windows:6 windows x86 arch:x86

    d46feae5913f2b33d6159af1367e8ee7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstGameInfoHelper.exe
    .exe windows:5 windows x86 arch:x86

    2f05f2531b6da725824fc913b1b92aff


    Headers

    Imports

    Sections

  • $PLUGINSDIR/IwinToolbar.exe
    .exe windows:4 windows x86 arch:x86

    72467ab5b1f21b6db7557829bab796cd


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/defaultthumbnail.bmp
  • $PLUGINSDIR/ftdownload.dat
  • $PLUGINSDIR/iwintoolbarinst.exe
    .exe windows:4 windows x86 arch:x86

    81638d02019c0bfcaaf23a9c69f2f12c


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • AdminWorker.exe
    .exe windows:5 windows x86 arch:x86

    6407cad521e3ff20fc3c203c0abb4585


    Code Sign

    Headers

    Imports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GameuxInstallHelper.dll
    .dll windows:6 windows x86 arch:x86

    d46feae5913f2b33d6159af1367e8ee7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • WebInstaller.exe
    .exe windows:5 windows x86 arch:x86

    fe31a1ea0465cd2d80098af8995d27d2


    Code Sign

    Headers

    Imports

    Sections

  • WebUpdater.bmp
  • WebUpdater.exe
    .exe windows:4 windows x86 arch:x86

    83c00363c07d1c012450b9f655248767


    Code Sign

    Headers

    Imports

    Sections

  • firefox/chrome.manifest
  • firefox/chrome/iwinarcade.jar
    .zip
  • content/contents.rdf
    .xml
  • content/iwa-ovr.js
    .js
  • content/iwa-ovr.xul
    .xml
  • content/iwinarcade.js
  • firefox/iWinArcadeLauncher.exe
    .exe windows:4 windows x86 arch:x86

    80ecfa2eb6a7155e205be13d4cdc1119


    Code Sign

    Headers

    Imports

    Sections

  • firefox/install.rdf
    .xml
  • firefox/version
  • gamepage/buynow.html
    .html .js polyglot
  • gamepage/common.js
    .js
  • gamepage/css/offline.css
  • gamepage/disconnected-upsell.html
    .html
  • gamepage/end.html
    .html
  • gamepage/expired.html
    .html
  • gamepage/images/alert32x32.gif
    .gif
  • gamepage/images/bg_header.gif
    .gif
  • gamepage/images/buttons/close-blue-28.gif
    .gif
  • gamepage/images/buttons/continue-orange-132.gif
    .gif
  • gamepage/images/buttons/yesiwantabackupcd-orange-197.gif
    .gif
  • gamepage/images/common/header-bg.gif
    .gif
  • gamepage/images/common/header-small-bg.gif
    .gif
  • gamepage/images/common/loading.gif
    .gif
  • gamepage/images/continuefreetrial-32.gif
    .gif
  • gamepage/images/global/logo-invis.gif
    .gif
  • gamepage/images/global/logo.gif
    .gif
  • gamepage/images/global/page-bg-swirly.gif
    .gif
  • gamepage/images/global/page-bg.gif
    .gif
  • gamepage/images/global/page-header-small-bg.jpg
    .jpg
  • gamepage/images/logo.jpg
    .jpg
  • gamepage/images/misc/blue-bottom-triangle.gif
    .gif
  • gamepage/images/misc/information.gif
    .gif
  • gamepage/images/ous/divider.gif
    .gif
  • gamepage/images/ous/eus.jpg
    .jpg
  • gamepage/images/ous/hotel-bg.gif
    .gif
  • gamepage/images/ous/hotel-iwin.gif
    .gif
  • gamepage/images/ous/opal.gif
    .gif
  • gamepage/images/ous/opalbox.jpg
    .jpg
  • gamepage/images/ous/ous-promo-banner.jpg
    .jpg
  • gamepage/images/plans/plan1.gif
    .gif
  • gamepage/images/plans/plan2.gif
    .gif
  • gamepage/images/plans/plan3.gif
    .gif
  • gamepage/images/product/feature.jpg
    .jpg
  • gamepage/open.html
    .html
  • gamepage/operationfailed.html
    .html .js polyglot
  • gamepage/scripts/disconnected-upsell.js
    .js
  • gamepage/scripts/popups.js
    .js
  • gamepage/scripts/prototype-1.6.js
    .js
  • gamepage/styles/base.css
  • gamepage/styles/disconnected-upsell.css
  • gamepage/styles/shoppingcart.css
  • gamepage/success.html
    .html
  • host.cfg
  • iWinGames.exe
    .exe windows:5 windows x86 arch:x86

    f15673b218ff42322d7fc5f5c0169646


    Code Sign

    Headers

    Imports

    Sections

  • iWinGamesHookIE.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    047274650477bff36e9ba8bcda1eb5af


    Headers

    Imports

    Exports

    Sections

  • iWinInfo.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    53a4d1bbb5cb295f8a3af310371f3ce4


    Headers

    Imports

    Exports

    Sections

  • iWinTrusted.exe
    .exe windows:5 windows x86 arch:x86

    8cd7ec1d569e76d3ca5c15ed1aa0ff93


    Code Sign

    Headers

    Imports

    Sections

  • pages/alert32x32.gif
    .gif
  • pages/arcadeCheck.js
    .js
  • pages/blank.html
    .html
  • pages/blank2.html
    .html
  • pages/error.html
    .html .js polyglot
  • pages/error404.css
  • pages/iwin_logo.gif
    .gif
  • pages/login.html
    .html
  • pages/maintenance.html
    .html
  • pages/offline.css
  • pages/offline.html
    .html
  • pages/offline.jpg
    .jpg
  • pages/offlineBg.gif
    .gif
  • pages/offline_tag.gif
    .gif
  • pages/orange-im-connected-60.gif
    .gif
  • pages/terrie404.gif
    .gif
  • pages/test.html
    .html .js polyglot
  • sounds/animation.wav
  • sounds/animationBack.wav
  • sounds/button_click.wav
  • sounds/coins.wav
  • sounds/download_completed.wav
  • sounds/slidebackin.wav
  • sounds/slideout.wav
  • sounds/start.wav