General

  • Target

    cdd61232bc84a79bcf7b80a82b8680cd_JaffaCakes118

  • Size

    3.9MB

  • MD5

    cdd61232bc84a79bcf7b80a82b8680cd

  • SHA1

    d36282286c4a08de521b34cbece5f89313d99376

  • SHA256

    b71a09ec054a92f464c4d2ca43ca46d019bfb64551aeab74a0921146d3cd2b29

  • SHA512

    2f86cd8824c63dfc7018f268469dbcb481b4da876a02367e49d26dce0906271d3536bd0b116a4149fd088b856c9ede76ff96f41cc4928e5ab0aa5f7fa60c5a35

  • SSDEEP

    98304:CkHqeRDAoQqBBnhkjcQHpPEFrvxxXxNlb5SW5hCO8pUbkUb/Yg960n2IbzR8i2S:3HRRfVpQHpPEpJlx/VSG9X/9rXzW4

Score
7/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • cdd61232bc84a79bcf7b80a82b8680cd_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    e160ef8e55bb9d162da4e266afd9eef3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Headers

    Imports

    Exports

    Sections

  • CHANGELOG.txt
  • COPYING/COPYING.pdf
    .pdf
    • http://sniperscan.de

    • http://www.gnu.org/licenses/.

  • COPYING/COPYING.rtf
  • COPYING/deleteme.txt
  • LICENSE.txt
  • Microsoft.VC80.CRT.manifest
  • TODOS.txt
  • VERSION.txt
  • clamd.exe
    .exe windows:4 windows x86 arch:x86

    36a3ed4b09011c61d3fcd58dd9802e9e


    Headers

    Imports

    Sections

  • clamdscan.exe
    .exe windows:4 windows x86 arch:x86

    23c1bc0bc15ad86c0f6ad1e67ed74559


    Headers

    Imports

    Sections

  • conf/freshclam.conf
  • conf/options.ini
  • conf/sniperscan.conf
  • conf/sniperscanengine.conf
  • database/deleteme.txt
  • database/mirrors.dat
  • freshclam.exe
    .exe windows:4 windows x86 arch:x86

    9f982ec570a649da60260954cd7f7389


    Headers

    Imports

    Sections

  • ico/ressource.dll
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ico/sniper.ico
  • ico/sniperscan.ico
  • libclamav.dll
    .dll windows:4 windows x86 arch:x86

    3ad7cf7d9b06be4e698715182bebfe95


    Headers

    Imports

    Exports

    Sections

  • libclamunrar.dll
    .dll windows:4 windows x86 arch:x86

    7ba648c0e64d7bd538f22de4e6dd47ed


    Headers

    Imports

    Sections

  • libclamunrar_iface.dll
    .dll windows:4 windows x86 arch:x86

    617f9990454385cb2f9c6ea7739465cc


    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:5 windows x86 arch:x86

    8854f076f54b914555538520497b053d


    Headers

    Imports

    Exports

    Sections

  • msvcm80.dll
    .dll windows:4 windows x86 arch:x86

    83e6ecedcb8a69cca8d85e1481140fa0


    Headers

    Imports

    Exports

    Sections

  • msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    6488997e312be12f8300ea7b1c34d497


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    7fecbc4a16a5dc85a5394a1df6217680


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • quarantine/deleteme.txt
  • snipedscan.exe
    .exe windows:4 windows x86 arch:x86

    23c1bc0bc15ad86c0f6ad1e67ed74559


    Headers

    Imports

    Sections

  • sniperscan.exe
    .exe windows:5 windows x86 arch:x86

    cae167cd04ec2982fcdb300bc5300e29


    Headers

    Imports

    Sections

  • sniperscan.reg
  • sniperscanengine.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • sniperscanregistrationde.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • temp/deleteme.txt
  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    e160ef8e55bb9d162da4e266afd9eef3


    Headers

    Imports

    Sections

  • update/deleteme.txt
  • updater_de.exe
    .exe windows:5 windows x86 arch:x86

    caa5e6a2892587c2324418efee31c648


    Headers

    Imports

    Sections

  • version/VERSION.txt