General

  • Target

    c05f2a751756f92807a26183427df977_JaffaCakes118

  • Size

    6.4MB

  • MD5

    c05f2a751756f92807a26183427df977

  • SHA1

    1532f877314fad991eb29304ac0a8c32a95c4b42

  • SHA256

    478bc775fb21b6a5b667dde95715448438471883d5f7c7865a12d7f402d70b01

  • SHA512

    caa521e44a3be58811a41dc68e9d6c2b0b582c1957a4b26fe66e35715e6a790b471d14751a21afd90682b9e8b1a025ba1ee3496b06df2a8bddc8543341b1a562

  • SSDEEP

    196608:66fKGS2ugM2+pMQvJw2c2gBa2PFJ/CyiC2QDxrS:6ZbgMnMQqDBhnCyJvtu

Score
3/10

Malware Config

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • c05f2a751756f92807a26183427df977_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    24f4223e271413c25abad52fd456a9bc


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Banner.dll
    .dll windows:4 windows x86 arch:x86

    767a5b32183c6c4ff645882480adc9a6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    80469f6834e579db68a646d49780b9d5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    6b5c4f7d679059f68f1269aad3a5cecd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsisdl.dll
    .dll windows:4 windows x86 arch:x86

    d09878220c1fdc2c2325ac1b89d388da


    Headers

    Imports

    Exports

    Sections

  • $_13_/Copyright-readme.txt
  • $_13_/Queries/Address_HTML.xq
  • $_13_/Queries/Blocks_MID.xq
  • $_13_/Queries/Blocks_MIF_XY.xq
  • $_13_/Queries/Blocks_MIF_YX.xq
  • $_13_/Queries/Bounds_MID.xq
  • $_13_/Queries/Bounds_MIF_XY.xq
  • $_13_/Queries/Bounds_MIF_YX.xq
  • $_13_/Queries/EGRP_CSV.xq
  • $_13_/Queries/F17_Address_HTML.xq
  • $_13_/Queries/F17_Blocks_MID.xq
  • $_13_/Queries/F17_Blocks_MIF_XY.xq
  • $_13_/Queries/F17_Blocks_MIF_YX.xq
  • $_13_/Queries/F17_Bounds_MID.xq
  • $_13_/Queries/F17_Bounds_MIF_XY.xq
  • $_13_/Queries/F17_Bounds_MIF_YX.xq
  • $_13_/Queries/F17_DXF_AT_Lay_XY.xq
  • $_13_/Queries/F17_DXF_AT_Lay_YX.xq
  • $_13_/Queries/F17_DXF_Uni_Lay_XY.xq
  • $_13_/Queries/F17_DXF_Uni_Lay_YX.xq
  • $_13_/Queries/F17_DXF_XY_Uni.xq
  • $_13_/Queries/F17_DXF_YX_Uni.xq
  • $_13_/Queries/F17_HTML_KPT_YX.xq
  • $_13_/Queries/F17_HTML_KT_YX.xq
  • $_13_/Queries/F17_HTML_KV_YX.xq
  • $_13_/Queries/F17_MID_Uni.xq
  • $_13_/Queries/F17_MIF_XY_Uni.xq
  • $_13_/Queries/F17_MIF_YX_Uni.xq
  • $_13_/Queries/F17_OKS_CSV.xq
  • $_13_/Queries/F17_OKS_TXT.xq
  • $_13_/Queries/F17_OMS_MID.xq
  • $_13_/Queries/F17_OMS_MIF_XY.xq
  • $_13_/Queries/F17_OMS_MIF_YX.xq
  • $_13_/Queries/F17_OMS_TXT.xq
  • $_13_/Queries/F17_Obj_MID.xq
  • $_13_/Queries/F17_Obj_MIF_XY.xq
  • $_13_/Queries/F17_Obj_MIF_YX.xq
  • $_13_/Queries/F17_Par_Ords_MID.xq
  • $_13_/Queries/F17_Par_Ords_MIF_XY.xq
  • $_13_/Queries/F17_Par_Ords_MIF_YX.xq
  • $_13_/Queries/F17_Parcels_MID.xq
  • $_13_/Queries/F17_Parcels_MIF_XY.xq
  • $_13_/Queries/F17_Parcels_MIF_YX.xq
  • $_13_/Queries/F17_ZU_CSV.xq
  • $_13_/Queries/F17_ZU_TXT.xq
  • $_13_/Queries/F17_ZonesCond_MID.xq
  • $_13_/Queries/F17_ZonesCond_MIF_XY.xq
  • $_13_/Queries/F17_ZonesCond_MIF_YX.xq
  • $_13_/Queries/F17_ZonesTer_MID.xq
  • $_13_/Queries/F17_ZonesTer_MIF_XY.xq
  • $_13_/Queries/F17_ZonesTer_MIF_YX.xq
  • $_13_/Queries/New_Address_HTML.xq
  • $_13_/Queries/New_Blocks_MID.xq
  • $_13_/Queries/New_Blocks_MIF_XY.xq
  • $_13_/Queries/New_Blocks_MIF_YX.xq
  • $_13_/Queries/New_Bounds_MID.xq
  • $_13_/Queries/New_Bounds_MIF_XY.xq
  • $_13_/Queries/New_Bounds_MIF_YX.xq
  • $_13_/Queries/New_DAT_CSV.xq
  • $_13_/Queries/New_DAT_TXT.xq
  • $_13_/Queries/New_DXF_AT_Lay_XY.xq
  • $_13_/Queries/New_DXF_AT_Lay_YX.xq
  • $_13_/Queries/New_DXF_AT_XY.xq
  • $_13_/Queries/New_DXF_AT_YX.xq
  • $_13_/Queries/New_DXF_Uni_Lay_XY.xq
  • $_13_/Queries/New_DXF_Uni_Lay_YX.xq
  • $_13_/Queries/New_DXF_XY_Uni.xq
  • $_13_/Queries/New_DXF_YX_Uni.xq
  • $_13_/Queries/New_GEO_CSV.xq
  • $_13_/Queries/New_GEO_TXT.xq
  • $_13_/Queries/New_MID_Uni.xq
  • $_13_/Queries/New_MIF_XY_Uni.xq
  • $_13_/Queries/New_MIF_YX_Uni.xq
  • $_13_/Queries/New_OKS_CSV.xq
  • $_13_/Queries/New_OKS_GRP_CSV.xq
  • $_13_/Queries/New_OKS_GRP_TXT.xq
  • $_13_/Queries/New_OKS_TXT.xq
  • $_13_/Queries/New_OMS_MID.xq
  • $_13_/Queries/New_OMS_MIF_XY.xq
  • $_13_/Queries/New_OMS_MIF_YX.xq
  • $_13_/Queries/New_OMS_TXT.xq
  • $_13_/Queries/New_Obj_MID.xq
  • $_13_/Queries/New_Obj_MIF_XY.xq
  • $_13_/Queries/New_Obj_MIF_YX.xq
  • $_13_/Queries/New_Parcels_MID.xq
  • $_13_/Queries/New_Parcels_MIF_XY.xq
  • $_13_/Queries/New_Parcels_MIF_YX.xq
  • $_13_/Queries/New_ZU_CSV.xq
  • $_13_/Queries/New_ZU_GRP_CSV.xq
  • $_13_/Queries/New_ZU_GRP_TXT.xq
  • $_13_/Queries/New_ZU_TXT.xq
  • $_13_/Queries/New_ZonesCond_MID.xq
  • $_13_/Queries/New_ZonesCond_MIF_XY.xq
  • $_13_/Queries/New_ZonesCond_MIF_YX.xq
  • $_13_/Queries/New_ZonesTer_MID.xq
  • $_13_/Queries/New_ZonesTer_MIF_XY.xq
  • $_13_/Queries/New_ZonesTer_MIF_YX.xq
  • $_13_/Queries/Query_DAT_CSV.xq
  • $_13_/Queries/Query_DAT_HTML.xq
  • $_13_/Queries/Query_DAT_TXT.xq
  • $_13_/Queries/Query_DXF_AT_XY.xq
  • $_13_/Queries/Query_DXF_AT_YX.xq
  • $_13_/Queries/Query_DXF_XY_Uni.xq
  • $_13_/Queries/Query_DXF_YX_Uni.xq
  • $_13_/Queries/Query_GEO_CSV.xq
  • $_13_/Queries/Query_GEO_HTML.xq
  • $_13_/Queries/Query_GEO_TXT.xq
  • $_13_/Queries/Query_MID.xq
  • $_13_/Queries/Query_MID_Uni.xq
  • $_13_/Queries/Query_MIF_XY.xq
  • $_13_/Queries/Query_MIF_XY_Uni.xq
  • $_13_/Queries/Query_MIF_YX.xq
  • $_13_/Queries/Query_MIF_YX_Uni.xq
  • $_13_/Queries/Query_Name.xq
  • $_13_/Queries/Query_Name_2017.xq
  • $_13_/Queries/Query_TXT_NXY.xq
  • $_13_/Queries/Query_TXT_NXY_Plus.xq
  • $_13_/Queries/Zones_MID.xq
  • $_13_/Queries/Zones_MIF_XY.xq
  • $_13_/Queries/Zones_MIF_YX.xq
  • $_13_/Queries/dCategories.xsd
    .xml
  • $_13_/Queries/dParcels.xsd
    .xml
  • $_13_/Queries/dRegionsRF.xsd
    .xml
  • $_13_/Queries/dStates.xsd
    .xml
  • $_13_/Queries/dTypeStorey.xsd
    .xml
  • $_13_/Settings/RepChecks.xml
  • $_13_/Settings/XMLConverter.xml
  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    388bdf7a675a52ebd2a6f69d1df5d9e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    0aa550667198bcbc58119e455f50696f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Network.dll
    .dll windows:6 windows x86 arch:x86

    f88e3d2a1584f7f50707893015ddcfea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    76b0ab105cbe4577a76cd9499f10f657


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Xml.dll
    .dll windows:6 windows x86 arch:x86

    2ecc85e368db6768a6729b539a32cbc2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5XmlPatterns.dll
    .dll windows:6 windows x86 arch:x86

    ef4dedf6754398ee74512e826c78618f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe.nsis
  • XMLConverter-help.rtf
    .rtf
  • XMLConverter.exe
    .exe windows:6 windows x86 arch:x86

    c8c24ade91c5b619b3a3710453f298db


    Headers

    Imports

    Sections

  • msxsl.exe
    .exe windows:4 windows x86 arch:x86

    2477f6a819520981112ad254e2bd87d8


    Code Sign

    Headers

    Imports

    Sections

  • platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    061badc99d5a2cc452ed1e700d0b41c4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • quazip.dll
    .dll windows:6 windows x86 arch:x86

    6c8ef34a1ec9a5393eeec1ce77a06bda


    Headers

    Imports

    Exports

    Sections

  • styles/qwindowsvistastyle.dll
    .dll windows:6 windows x86 arch:x86

    5d127c1b9cb0b035bc8b8bba4bf5cec8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • translations/qt_ru.qm
  • zlibwapi.dll
    .dll windows:4 windows x86 arch:x86

    d8599f9d9250ce9697a38a814374b44b


    Headers

    Imports

    Exports

    Sections