Overview

overview

7

Static

static

7

gaccel.exe

windows7-x64

7

gaccel.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$SYSDIR/$R0.dll

windows7-x64

3

$SYSDIR/$R0.dll

windows10-2004-x64

3

$SYSDIR/$R...NT.exe

windows7-x64

1

$SYSDIR/$R...NT.exe

windows10-2004-x64

3

Rsrc32.dll

windows7-x64

3

Rsrc32.dll

windows10-2004-x64

3

gameroom.exe

windows7-x64

7

gameroom.exe

windows10-2004-x64

7

gameroom.html

windows7-x64

3

gameroom.html

windows10-2004-x64

1

gamexl.exe

windows7-x64

3

gamexl.exe

windows10-2004-x64

3

gres.dll

windows7-x64

3

gres.dll

windows10-2004-x64

3

manual.pdf

windows7-x64

3

manual.pdf

windows10-2004-x64

3

navcancl.html

windows7-x64

3

navcancl.html

windows10-2004-x64

3

notfound.html

windows7-x64

3

notfound.html

windows10-2004-x64

1

pno0001.exe

windows7-x64

3

pno0001.exe

windows10-2004-x64

3

securiweb.dll

windows7-x64

1

securiweb.dll

windows10-2004-x64

1

stop.htm

windows7-x64

3

stop.htm

windows10-2004-x64

3

新云软件.url

windows7-x64

1

新云软件.url

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c20e6e586d817c2205a6ffc39a39d359_JaffaCakes118

  • Size

    2.4MB

  • MD5

    c20e6e586d817c2205a6ffc39a39d359

  • SHA1

    99ff192ab96b99429400691d8d1b72e034b49be7

  • SHA256

    134b1c34dba3175978a6a0c44231e4055c0e242372ebeab7af68c0cb136ecad4

  • SHA512

    0d8dba084c41664fdcbc7add2d23a1d6abfe1f7340b235f9327d82386d09fde4bbeab36fc11bb703971c880763ad06a3d0252d57c9185c74310937042a378db0

  • SSDEEP

    49152:OdKgIhvAXTdUKh9vXFLndnHxO0ggx6oYxS3wrXqXht4nAgsvse6:6m+X+Kh9fhndnHxfggx6JY3wr6XhWnA4

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs
    installer

Files

  • c20e6e586d817c2205a6ffc39a39d359_JaffaCakes118
    .rar
  • gaccel.exe
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/$R0
    .dll regsvr32 windows:4 windows x86 arch:x86

    52aa5ee856953e49635e554af5207319


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/$R2/NSIS.Library.RegTool.v2.$HWNDPARENT.exe
    .exe windows:4 windows x86 arch:x86

    a56a9c58ddb2b2da8fde66551747ce70


    Headers

    Imports

    Sections

  • License.txt
  • Rsrc32.dll
    .dll windows:4 windows x86 arch:x86

    8d039900e0d1b52d35b3736f306ade17


    Headers

    Imports

    Exports

    Sections

  • back.bmp
  • clear.dat
  • default.sq
  • gameroom.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • gameroom.html
    .html
  • gamexl.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • gres.dat
    .dll windows:5 windows x86 arch:x86

    3212a2bcb209c0eace9e5387a9fee887


    Headers

    Imports

    Exports

    Sections

  • highlightimages.htm
    .html .js polyglot
  • highlightlinks.htm
    .html .js polyglot
  • highlighttable.htm
    .html .js polyglot
  • kreadme.txt
  • manual.pdf
    .pdf
  • mouseoff.dat
  • mouseon.dat
  • navcancl.html
    .html
  • network.bmp
  • notfound.bmp
  • notfound.html
    .html
  • pno0001.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • qreadme.txt
  • refresh.bmp
  • securiweb.dll
  • smart.ini
  • stop.htm
    .html
  • temp
  • web.ini
  • web2.ini
  • web3.ini
  • web4.ini
  • web5.ini
  • greadme.txt
  • 新云软件.url
    .url