Overview

overview

7

Static

static

3

87be98551d...18.exe

windows7-x64

7

87be98551d...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

INST_ZET.bat

windows7-x64

1

INST_ZET.bat

windows10-2004-x64

1

{TISK}/CUR...US.exe

windows7-x64

{TISK}/CUR...US.exe

windows10-2004-x64

{TISK}/CURL/curl.exe

windows7-x64

3

{TISK}/CURL/curl.exe

windows10-2004-x64

3

{TISK}/CUR...32.dll

windows7-x64

3

{TISK}/CUR...32.dll

windows10-2004-x64

3

{TISK}/CUR...32.dll

windows7-x64

3

{TISK}/CUR...32.dll

windows10-2004-x64

3

{TISK}/GETTIME.exe

windows7-x64

1

{TISK}/GETTIME.exe

windows10-2004-x64

3

{TISK}/MICRORUN.exe

windows7-x64

3

{TISK}/MICRORUN.exe

windows10-2004-x64

3

{TISK}/TCOPY.exe

windows7-x64

1

{TISK}/TCOPY.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    87be98551d9ccf6820e57a15c971861c_JaffaCakes118

  • Size

    1.7MB

  • MD5

    87be98551d9ccf6820e57a15c971861c

  • SHA1

    05fc9df97ab9c97811ed30acc4c44c9c1c712673

  • SHA256

    426e21aa4eef603d245d0c81752900017aea924b1ce3516244b9cec11bf6c574

  • SHA512

    9b56253f191eb6c6cf46efcd704e52b6a7d1ca972d1a5400f35e014394f22d043676a921fe9e8436f78bbd2c7912236793b3e5126e7d26141c880d16e00e5c37

  • SSDEEP

    24576:xLsJi5HI1zFb+ggZxlqZKiTi8O7dYZvyCkTH0inOZqOdOMwqbcWCOdsLFwTvtgPJ:9iip6zCOZvadvCKHDuOM3YDOSBDPJ

Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 87be98551d9ccf6820e57a15c971861c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • BANKY51.05R
  • HELP51.000
  • HELP51.T00
  • INST_ZE.000
  • INST_ZE.T00
  • INST_ZE0.000
  • INST_ZE0.T00
  • INST_ZE1.000
  • INST_ZE1.T00
  • INST_ZE3.000
  • INST_ZE4.000
  • INST_ZE5.000
  • INST_ZE6.000
  • INST_ZE8.000
  • INST_ZE8.T00
  • INST_ZET.BAT
  • INST_ZET.CAT
  • INST_ZET.RDB
  • INST_ZET.TTT
  • MODUL51.PRR
  • MODUL51.TRR
  • MODUL52.PRR
  • MODUL52.TRR
  • OBJEDNAT.UUU
  • PAR51A1.05R
  • PAR51B0.05R
  • PAR51B0.T5R
  • PAR51B1.05R
  • PAR51B1.T5R
  • PAR51C1.05R
  • SEST51.PRR
  • SEST51.TRR
  • UPG51.PRR
  • UPG51.TRR
  • UPG52.PRR
  • UPG52.TRR
  • VERZE51.ZE
  • ZET_HTTP.TXT
  • {TISK}/CURL/DOSHUS.EXE
  • {TISK}/CURL/curl.exe
    .exe windows:4 windows x86 arch:x86

    55a59619404a19abc5d586bf6d33d369


    Headers

    Imports

    Exports

    Sections

  • {TISK}/CURL/libeay32.dll
    .dll windows:4 windows x86 arch:x86

    589fe844c76090cf981ff65511311710


    Headers

    Imports

    Exports

    Sections

  • {TISK}/CURL/libssl32.dll
    .dll windows:4 windows x86 arch:x86

    4a0853fd0d9093607f262ab4ca597eeb


    Headers

    Imports

    Exports

    Sections

  • {TISK}/GETTIME.EXE
    .exe windows:4 windows x86 arch:x86

    eedd2b5a7ab1fe86bf7f68f9edf33585


    Headers

    Imports

    Sections

  • {TISK}/MICRORUN.EXE
    .exe windows:4 windows x86 arch:x86

    6b613914e481c04ff12af6bcfd6c4e21


    Headers

    Imports

    Sections

  • {TISK}/TCOPY.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections