General

  • Target

    b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118

  • Size

    3.6MB

  • MD5

    b1a93a43d827c25d075e016bf411d7f6

  • SHA1

    6242d3e8e9e7be06a978e5264a68d68e9e11d2ac

  • SHA256

    74d1eff84e7c043b96e2694cd9c4aab19b377d858f281b54ace68e1a1a2e95de

  • SHA512

    873c80871f3602b7701004075608b059f87140749cab196c0d78ade6a80674d2cc740ddfce85836cae2de5c547996d6b417f0ab68ac05317920b06ff54f01d7d

  • SSDEEP

    49152:h0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIayLmEa:h36ivJDiSFdph1mPYAlO/hJ6ZYWGqn

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • b1a93a43d827c25d075e016bf411d7f6_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GameuxInstallHelper.dll
    .dll windows:6 windows x86 arch:x86

    d46feae5913f2b33d6159af1367e8ee7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstGameInfoHelper.exe
    .exe windows:5 windows x86 arch:x86

    2f05f2531b6da725824fc913b1b92aff


    Headers

    Imports

    Sections

  • $PLUGINSDIR/IwinToolbar.exe
    .exe windows:4 windows x86 arch:x86

    72467ab5b1f21b6db7557829bab796cd


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/defaultthumbnail.bmp
  • $PLUGINSDIR/ftdownload.dat
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/smartinstallAllinOne.exe
    .exe windows:4 windows x86 arch:x86

    81638d02019c0bfcaaf23a9c69f2f12c


    Code Sign

    Headers

    Imports

    Sections

  • AdminWorker.exe
    .exe windows:5 windows x86 arch:x86

    211467ece9f5deba02730cdb9a9df33f


    Code Sign

    Headers

    Imports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GameuxInstallHelper.dll
    .dll windows:6 windows x86 arch:x86

    d46feae5913f2b33d6159af1367e8ee7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • WebInstaller.exe
    .exe windows:5 windows x86 arch:x86

    fe31a1ea0465cd2d80098af8995d27d2


    Code Sign

    Headers

    Imports

    Sections

  • WebUpdater.bmp
  • WebUpdater.exe
    .exe windows:4 windows x86 arch:x86

    83c00363c07d1c012450b9f655248767


    Code Sign

    Headers

    Imports

    Sections

  • firefox/chrome.manifest
  • firefox/chrome/iwinarcade.jar
    .zip
  • content/about.css
  • content/about.xul
    .xml
  • content/contents.rdf
    .xml
  • content/icon.png
    .png
  • content/iwa-ovr.js
    .js
  • content/iwa-ovr.xul
    .xml
  • content/iwinarcade.js
  • content/uninstall.html
    .html
  • firefox/iWinArcadeLauncher.exe
    .exe windows:4 windows x86 arch:x86

    80ecfa2eb6a7155e205be13d4cdc1119


    Code Sign

    Headers

    Imports

    Sections

  • firefox/install.rdf
    .xml
  • firefox/version
  • gamepage/buynow.html
    .html .js polyglot
  • gamepage/common.js
    .js
  • gamepage/css/offline.css
  • gamepage/disconnected-upsell.html
    .html
  • gamepage/end.html
    .html
  • gamepage/expired.html
    .html
  • gamepage/images/alert32x32.gif
    .gif
  • gamepage/images/bg_header.gif
    .gif
  • gamepage/images/buttons/close-blue-28.gif
    .gif
  • gamepage/images/buttons/continue-orange-132.gif
    .gif
  • gamepage/images/buttons/yesiwantabackupcd-orange-197.gif
    .gif
  • gamepage/images/common/header-bg.gif
    .gif
  • gamepage/images/common/header-small-bg.gif
    .gif
  • gamepage/images/common/loading.gif
    .gif
  • gamepage/images/continuefreetrial-32.gif
    .gif
  • gamepage/images/global/logo-invis.gif
    .gif
  • gamepage/images/global/logo.gif
    .gif
  • gamepage/images/global/page-bg-swirly.gif
    .gif
  • gamepage/images/global/page-bg.gif
    .gif
  • gamepage/images/global/page-header-small-bg.jpg
    .jpg
  • gamepage/images/logo.jpg
    .jpg
  • gamepage/images/misc/blue-bottom-triangle.gif
    .gif
  • gamepage/images/misc/information.gif
    .gif
  • gamepage/images/ous/divider.gif
    .gif
  • gamepage/images/ous/eus.jpg
    .jpg
  • gamepage/images/ous/hotel-bg.gif
    .gif
  • gamepage/images/ous/hotel-iwin.gif
    .gif
  • gamepage/images/ous/opal.gif
    .gif
  • gamepage/images/ous/opalbox.jpg
    .jpg
  • gamepage/images/ous/ous-promo-banner.jpg
    .jpg
  • gamepage/images/plans/plan1.gif
    .gif
  • gamepage/images/plans/plan2.gif
    .gif
  • gamepage/images/plans/plan3.gif
    .gif
  • gamepage/images/product/feature.jpg
    .jpg
  • gamepage/open.html
    .html
  • gamepage/operationfailed.html
    .html .js polyglot
  • gamepage/scripts/disconnected-upsell.js
    .js
  • gamepage/scripts/popups.js
    .js
  • gamepage/scripts/prototype-1.6.js
    .js
  • gamepage/styles/base.css
  • gamepage/styles/disconnected-upsell.css
  • gamepage/styles/shoppingcart.css
  • gamepage/success.html
    .html
  • host.cfg
  • iWinGames.exe
    .exe windows:5 windows x86 arch:x86

    cda7ae01f6db653db8cf27d38fabeb34


    Code Sign

    Headers

    Imports

    Sections

  • iWinGamesHookIE.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    047274650477bff36e9ba8bcda1eb5af


    Headers

    Imports

    Exports

    Sections

  • iWinInfo.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    bd39a104c7ab499fe29cbb6f46c52ae5


    Headers

    Imports

    Exports

    Sections

  • iWinTrusted.exe
    .exe windows:5 windows x86 arch:x86

    8cd7ec1d569e76d3ca5c15ed1aa0ff93


    Code Sign

    Headers

    Imports

    Sections

  • pages/alert32x32.gif
    .gif
  • pages/arcadeCheck.js
    .js
  • pages/blank.html
    .html
  • pages/blank2.html
    .html
  • pages/error.html
    .html .js polyglot
  • pages/error404.css
  • pages/iwin_logo.gif
    .gif
  • pages/login.html
    .html
  • pages/maintenance.html
    .html
  • pages/offline.css
  • pages/offline.html
    .html
  • pages/offline.jpg
    .jpg
  • pages/offlineBg.gif
    .gif
  • pages/offline_tag.gif
    .gif
  • pages/orange-im-connected-60.gif
    .gif
  • pages/terrie404.gif
    .gif
  • pages/test.html
    .html .js polyglot
  • sounds/animation.wav
  • sounds/animationBack.wav
  • sounds/button_click.wav
  • sounds/coins.wav
  • sounds/download_completed.wav
  • sounds/slidebackin.wav
  • sounds/slideout.wav
  • sounds/start.wav