Overview

overview

7

Static

static

7

freewb5.exe

windows7-x64

7

freewb5.exe

windows10-2004-x64

7

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

UninstallIME.exe

windows7-x64

7

UninstallIME.exe

windows10-2004-x64

7

freewb.dll

windows7-x64

3

freewb.dll

windows10-2004-x64

3

freewb.htm

windows7-x64

3

freewb.htm

windows10-2004-x64

3

freewb.dll

windows7-x64

4

freewb.dll

windows10-2004-x64

4

plugin/QueryEx.dll

windows7-x64

3

plugin/QueryEx.dll

windows10-2004-x64

3

plugin/command.dll

windows7-x64

3

plugin/command.dll

windows10-2004-x64

3

plugin/date.dll

windows7-x64

3

plugin/date.dll

windows10-2004-x64

3

plugin/queryex.dll

windows7-x64

3

plugin/queryex.dll

windows10-2004-x64

3

registry.exe

windows7-x64

7

registry.exe

windows10-2004-x64

5

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae945dfb9215638d444d0812727468f8_JaffaCakes118

  • Size

    2.1MB

  • MD5

    ae945dfb9215638d444d0812727468f8

  • SHA1

    b4ae39194325e96c444d91c98afb5b95a6be353f

  • SHA256

    b7acec30fd67b2d21e58f195339390186ffff982defe60d130feb4c014ee5fe0

  • SHA512

    412ac2f52ba2d73b23d7ead699469ef923b72ea073d4a0ac57b94f5f304b3c940a7cb0a7587c14e088513693576e777ee97609780bd176a336621b78e891c82c

  • SSDEEP

    49152:4b+tzNhZ40ZTP1VoNEX9dSUTIY/t1yd4AbQrjokES1O87S2hTEA0GNoG0:4oB4+TroNEXqUTISTa13khEAk

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • ae945dfb9215638d444d0812727468f8_JaffaCakes118
    .rar
  • freewb5.exe
    .exe windows:4 windows x86 arch:x86

    170729c4965736ee8f8f4d1bab77cf38


    Headers

    Imports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    48cfa0ea7e353e4a7dd23572da8374ef


    Headers

    Imports

    Exports

    Sections

  • UninstallIME.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • background/2ring.bmp
  • background/IPurple_GB.BMP
  • background/goose2.bmp
  • background/gray_fade.bmp
  • background/leaf.bmp
  • convert.mb
  • freewb.bex
  • freewb.bin
  • freewb.dll
    .dll windows:4 windows x86 arch:x86

    f7f6dfa449de7de3a31b7342e4089d15


    Headers

    Imports

    Exports

    Sections

  • freewb.htm
    .html
  • freewb.ime
    .dll windows:4 windows x86 arch:x86

    08afe1a1ea22a4d7c059503ed1f240ac


    Headers

    Imports

    Exports

    Sections

  • freewb.ini
  • g2b.dat
  • mb/default/attach.mb
  • mb/default/freewb.dat
  • mb/default/freewb.mb
  • mb/default/freewbcht.mb
  • mb/default/quick.mb
  • mb/default/user.ini
  • plugin/QueryEx.plg
    .dll windows:4 windows x86 arch:x86

    03e732be8c5d5333a880229dcf859dcb


    Headers

    Imports

    Exports

    Sections

  • plugin/command.plg
    .dll windows:4 windows x86 arch:x86

    d03ca480551d4a5e82df326a17feaa68


    Headers

    Imports

    Exports

    Sections

  • plugin/data/freewb.db
  • plugin/date.plg
    .dll windows:4 windows x86 arch:x86

    43d56c37aa19a600974f836bdc54fa2a


    Headers

    Imports

    Exports

    Sections

  • plugin/queryex.plg
    .dll windows:4 windows x86 arch:x86

    f23398e4c05c03a95366d0a38386af92


    Headers

    Imports

    Exports

    Sections

  • registry.exe
    .exe windows:4 windows x86 arch:x86

    b3c56e49f70d84319ca30d3d04049934


    Headers

    Imports

    Sections

  • skin/IPurple.bmp
  • skin/IPurple.ini
  • skin/IPurple_button.bmp
  • skin/IPurple_ex.bmp
  • skin/argent.BMP
  • skin/argent.ini
  • skin/argent_button.bmp
  • skin/argent_ex.bmp
  • skin/classic.bmp
  • skin/classic_button.bmp
  • skin/sic.bmp
  • skin/sic.ini
  • skin/sic_button.bmp
  • skin/sic_ex.bmp
  • skin/win.ini
  • sound/back.wav
  • sound/chong.wav
  • sound/enter.wav
  • sound/kong.wav
  • sound/letter.wav
  • sound/space.wav
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    170729c4965736ee8f8f4d1bab77cf38


    Headers

    Imports

    Sections