Overview

overview

7

Static

static

3

a3ca373745...18.exe

windows7-x64

7

a3ca373745...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nk.dll

windows7-x64

3

$PLUGINSDI...nk.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

3

$PLUGINSDI...te.dll

windows10-2004-x64

3

$PLUGINSDI...tp.dll

windows7-x64

3

$PLUGINSDI...tp.dll

windows10-2004-x64

3

$TEMP/qq.vbs

windows7-x64

3

$TEMP/qq.vbs

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

�...��.exe

windows7-x64

6

�...��.exe

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target

    a3ca3737450550e29c939cc0bb449a7c_JaffaCakes118

  • Size

    716KB

  • MD5

    a3ca3737450550e29c939cc0bb449a7c

  • SHA1

    d7fe6c3ded72fc6d5438669e1d177b1996f78859

  • SHA256

    487f6ded35f31683cfe21fea2c6d16916540a396bf3c24867cf1a9eb15bf7971

  • SHA512

    303e24c67c0ec6188fcf65659a5331cec5717cbb9076fb6cca9de352034bce37da286ac67e66db72e4fa5e2b5d0e437cd65b74f39b6ce9fca470e5e8b915f8b0

  • SSDEEP

    12288:qjAn5+VXJJyuowtTHnyDZJqhNM0ZrJXCPtOXV7cFxcTtDNLdyDlZmGNlj73K:kc+VLLoy7yDZgDstOXV7cFxAtdEBnjHa

Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • a3ca3737450550e29c939cc0bb449a7c_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShellLink.dll
    .dll windows:4 windows x86 arch:x86

    ac2c09e68d5518a91b4912bdf6a67d1b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/locate.dll
    .dll windows:4 windows x86 arch:x86

    61142a69a9a888c92fddc2ab9dbb123a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/rfshdktp.dll
    .dll windows:4 windows x86 arch:x86

    042f3c184e7c0923b6325ab1dc09aed7


    Headers

    Imports

    Exports

    Sections

  • $TEMP/qq.ico
  • $TEMP/qq.t
    .vbs
  • oem.ini
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/time.dll
    .dll windows:4 windows x86 arch:x86

    2e3a4d1f132aea64d421c1e936bcc407


    Headers

    Imports

    Exports

    Sections

  • ޸IE ɱ.url
    .url
  • ֮.exe
    .exe windows:4 windows x86 arch:x86

    d92d1214f85668444e4185543085fbe9


    Code Sign

    Headers

    Imports

    Sections

  • ֮.ini