Overview

overview

7

Static

static

5

89e15ace32...18.exe

windows7-x64

7

89e15ace32...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nk.dll

windows7-x64

3

$PLUGINSDI...nk.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

3

$PLUGINSDI...te.dll

windows10-2004-x64

3

$PLUGINSDI...tp.dll

windows7-x64

3

$PLUGINSDI...tp.dll

windows10-2004-x64

3

$TEMP/qq.vbs

windows7-x64

1

$TEMP/qq.vbs

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

�...��.exe

windows7-x64

3

�...��.exe

windows10-2004-x64

3

�...��.exe

windows7-x64

6

�...��.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    89e15ace3247cfbb21b5672c371a2a1e_JaffaCakes118

  • Size

    1.4MB

  • MD5

    89e15ace3247cfbb21b5672c371a2a1e

  • SHA1

    ff37f30b47ae63dea3b0131800fc2e9c6e71125e

  • SHA256

    c0caac22ac8a0be66f7e253a9d5b6daa0faa567dab63bfbb0950e2b068c26f8b

  • SHA512

    e49ade62c30f646fa6069423cf131fd95509d705d37cffe18476d2372406f644c25bf1a1815582451f8769a4771fe464246da96641a9a76974cb7b0a1e349746

  • SSDEEP

    24576:k7Z0+VLLoy7yDZgDstOXV7cFxAtdEBn5ho32x+KtEvhcCgUos1cHcsqr5kBE2NT5:4Z0yH7yFgiOt2Bn/BcKCqCpr1lOpNt

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 89e15ace3247cfbb21b5672c371a2a1e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:4 windows x86 arch:x86

    ac2c09e68d5518a91b4912bdf6a67d1b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/locate.dll
    .dll windows:4 windows x86 arch:x86

    61142a69a9a888c92fddc2ab9dbb123a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/rfshdktp.dll
    .dll windows:4 windows x86 arch:x86

    042f3c184e7c0923b6325ab1dc09aed7


    Headers

    Imports

    Exports

    Sections

  • $TEMP/qq.ico
  • $TEMP/qq.t
    .vbs
  • oem.ini
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/time.dll
    .dll windows:4 windows x86 arch:x86

    2e3a4d1f132aea64d421c1e936bcc407


    Headers

    Imports

    Exports

    Sections

  • ޸IE ɱ.url
    .url
  • ֮.exe
    .exe windows:5 windows x86 arch:x86

    870b8e75c7190e202e9c6c81dff1040c


    Headers

    Imports

    Sections

  • ֮.ini
  • ֮.nls
    .exe windows:4 windows x86 arch:x86

    d92d1214f85668444e4185543085fbe9


    Code Sign

    Headers

    Imports

    Sections