General

  • Target

    b1603897d7ac9b5a56a75bed0d531569_JaffaCakes118

  • Size

    2.0MB

  • MD5

    b1603897d7ac9b5a56a75bed0d531569

  • SHA1

    1a4647f17ef299dadde9b619584ae5533c1a51d0

  • SHA256

    c2f6a4fb68cae66c358f63688af05ff971dce9c79a0a6c159bc907bccd2a6326

  • SHA512

    d137ce2096fdcc80517a385b9ab413078d0ac32f9bb9bc712455dfdfe524a541bffd6c9930a983a8badedb1a2b0aabc7f27e24e8a35dc2807091073603365c25

  • SSDEEP

    49152:0F83psumsSVdMFTIyJf6tTjBUDWAzQ0Mhm17TJ9s3h:1PPIyJcBI0E1PC

Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • b1603897d7ac9b5a56a75bed0d531569_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ToolbarDetector.dll
    .dll windows:5 windows x86 arch:x86

    8c39145cf6479a9d8fb641b621682fa7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    2457671c10c5aa708d9619798ec0139c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/dnupdatersetup.exe
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Code Sign

    Headers

    Imports

    Sections

  • $COMMONFILES/Software Update Utility/$COMMONFILES/Software Update Utility/uninstall.exe.nsis
  • $COMMONFILES/Software Update Utility/dnu.exe
    .exe windows:4 windows x86 arch:x86

    ab024b7bd0a09f00e35c0fd48824d647


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    6bc108eed3ca99f68adee56e9c99fac6


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnu.dll
    .dll windows:4 windows x86 arch:x86

    e8db3094acef5bcc16fbc67c83a79728


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnu.xpt
  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnupdater2.dll
    .dll windows:4 windows x86 arch:x86

    996628b89af7b00fec75ba717a2b85ff


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnupdater2.xpt
  • $PLUGINSDIR/dual.ini
  • $PLUGINSDIR/eula.rtf
    .rtf
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/mapquest_toolbar_ie.exe
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/dual.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/xml.dll
    .dll windows:4 windows x86 arch:x86

    b5ed5b3a951d4443ce56e5453702d536


    Headers

    Imports

    Exports

    Sections

  • $R5/$R0
    .dll windows:4 windows x86 arch:x86

    114d225166e9f7ba6ffd307ffc63b4cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    8dc5d8ec83864b4a8d299d8b4d06a888


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    238a16a49edf3ab59e2f8c89449c9af7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/upgrade.xml
  • $PLUGINSDIR/xml.dll
    .dll windows:4 windows x86 arch:x86

    b5ed5b3a951d4443ce56e5453702d536


    Headers

    Imports

    Exports

    Sections

  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/chrome.manifest
  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/chrome/mapquesttoolbar.jar
    .zip
  • content/XMLConfig.js
    .js
  • content/aboutBox.xul
    .js .xml polyglot
  • content/addbuddy.xul
    .js .xml polyglot
  • content/aolPrefs.js
    .js
  • content/aolQAP.js
    .js
  • content/aolXMLIO.js
    .js
  • content/aoltb.js
    .js
  • content/aoltoolbar.xul
    .xml
  • content/aoluninstall.js
    .js
  • content/bookmark.xul
    .js .xml polyglot
  • content/bubble.xul
    .xml
  • content/contents.rdf
    .xml
  • content/defaultQap.xul
    .xml
  • content/doubleQap.xul
    .xml
  • content/favplus_sidebar.xul
    .xml
  • content/firsttime.xul
    .js .xml polyglot
  • content/inbox_sidebar.xul
    .xml
  • content/mail.js
    .js
  • content/mapquestSearchBox.xml
    .xml
  • content/metrics.js
    .js
  • content/postQAP.xul
    .xml
  • content/postTOP.xul
    .xml
  • content/resetsurf.xul
    .xml
  • content/searchhook.xul
    .xml
  • content/settings.js
    .js
  • content/settings.xul
    .xml
  • content/surfometer.js
    .js
  • content/tbconfig.js
    .js
  • content/ticker/rss_right.gif
    .gif
  • content/ticker/rss_tile.gif
    .gif
  • content/ticker/ticker.css
  • content/ticker/ticker.htm
    .html
  • content/ticker/ticker.jpg
    .jpg
  • content/ticker/ticker.js
    .js
  • content/upgrade.js
    .js
  • content/util.js
    .js
  • content/view.js
    .js
  • content/winamp.js
    .js
  • locale/en-US/aoltb.xml
    .xml
  • locale/en-US/config.xml
    .xml
  • locale/en-US/contents.rdf
    .xml
  • locale/en-US/images/icon.png
    .png
  • locale/en-US/images/install_banner_150.png
    .png
  • locale/en-US/images/large_addbtn.png
    .png
  • locale/en-US/images/large_addbtn_over.png
    .png
  • locale/en-US/images/logo10.png
    .png
  • locale/en-US/images/logo10_over.png
    .png
  • locale/en-US/images/poweredby.png
    .png
  • locale/en-US/images/search.png
    .png
  • locale/en-US/images/search_over.png
    .png
  • locale/en-US/images/small_addbtn.png
    .png
  • locale/en-US/images/small_addbtn_over.png
    .png
  • locale/en-US/images/sphere.ico
  • locale/en-US/images/sphere.png
    .png
  • locale/en-US/images/web.png
    .png
  • locale/en-US/opensearch.xml
  • locale/en-US/toolbar_props.properties
    .js
  • locale/en-US/toolbar_text.dtd
  • skin/about.png
    .png
  • skin/arrow-dn.png
    .png
  • skin/arrow.png
    .png
  • skin/arrow_click.png
    .png
  • skin/arrow_over.png
    .png
  • skin/bg_postqap.png
    .png
  • skin/bg_toolbar.png
    .png
  • skin/chevron.png
    .png
  • skin/chevron_over.png
    .png
  • skin/contents.rdf
    .xml
  • skin/counter.png
    .png
  • skin/down-arrow.gif
    .gif
  • skin/email-icon.gif
    .gif
  • skin/generic.gif
    .gif
  • skin/gotoaol.png
    .png
  • skin/help.png
    .png
  • skin/im-icon.gif
    .gif
  • skin/offline.png
    .png
  • skin/online.png
    .png
  • skin/services.png
    .png
  • skin/settings.png
    .png
  • skin/staf.png
    .png
  • skin/styles.css
  • skin/uninstall.png
    .png
  • skin/up-arrow.gif
    .gif
  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/components/IMailUtil.xpt
  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/components/ImapquestUninstallObserver.xpt
  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/components/MailUtil.dll
    .dll windows:5 windows x86 arch:x86

    18d483e08d68a6ba20514d016177924e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/components/mapquestAddonObserver.js
    .js
  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/components/mapquestUninstallObserver.js
    .js
  • $R3/extensions/{4D1E692F-D179-413b-A987-EEEAAD85DDB3}/install.rdf
    .xml
  • $R3/mapquestToolbarData/install/source.dat
  • $R3/mapquestToolbarData/install/upgrade.dat