General

  • Target

    d1057dbc2c27bdfa946ccb677b790ad2_JaffaCakes118

  • Size

    4.5MB

  • MD5

    d1057dbc2c27bdfa946ccb677b790ad2

  • SHA1

    e143480af0e51323edc81bb4dca4d4ceaa9ba4da

  • SHA256

    78b16af6b4d348a70990d5c365f1e360f872a663e992eb81118f091a96e7333a

  • SHA512

    eca8d7533be4bcee2bb33e3b6c6fab8056714aae08f8c0d6b7558111cdeb2bbcd0fb8eeca968b7c9440e42282060fd42fddb1d797aac65920e8c7167fb70d08b

  • SSDEEP

    98304:MwvJqY9dqoRDun7ir9sFPVsVGpEZXcgr6JpjMnqiwaxfSbDL9t9DDyn1gcJw:MwvwYhDU7Y9sFtuG+cgYxMnRw2fSbVfF

Score
3/10

Malware Config

Signatures

  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • d1057dbc2c27bdfa946ccb677b790ad2_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    18b26e3ef7317852fa83fde4ebd910ac


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Processes.dll
    .dll windows:4 windows x86 arch:x86

    f5edecae12589e705677a6e272ad0394


    Headers

    Imports

    Exports

    Sections

  • BuildNumber.txt
  • CSpace.exe
    .exe windows:4 windows x86 arch:x86

    614f2f297e39b385fe407be551a4f1c1


    Headers

    Imports

    Sections

  • CSpaceFileReceiver.exe
    .exe windows:4 windows x86 arch:x86

    614f2f297e39b385fe407be551a4f1c1


    Headers

    Imports

    Sections

  • CSpaceFileSender.exe
    .exe windows:4 windows x86 arch:x86

    614f2f297e39b385fe407be551a4f1c1


    Headers

    Imports

    Sections

  • CSpaceIM.exe
    .exe windows:4 windows x86 arch:x86

    614f2f297e39b385fe407be551a4f1c1


    Headers

    Imports

    Sections

  • CSpaceVNCClient.exe
    .exe windows:4 windows x86 arch:x86

    614f2f297e39b385fe407be551a4f1c1


    Headers

    Imports

    Sections

  • CSpaceVNCServer.exe
    .exe windows:4 windows x86 arch:x86

    614f2f297e39b385fe407be551a4f1c1


    Headers

    Imports

    Sections

  • CSpaceVNCViewer.exe
    .exe windows:4 windows x86 arch:x86

    2481f304730138d08040e9b3ae65d04c


    Code Sign

    Headers

    Imports

    Sections

  • CSpaceWinVNC.exe
    .exe windows:4 windows x86 arch:x86

    3db1fd6b216af6faf4f06dfd44bcdbb9


    Headers

    Imports

    Sections

  • ContactActions/RemoteDesktop/Action
  • ContactActions/RemoteDesktop/Command
  • ContactActions/RemoteDesktop/SortOrder
  • ContactActions/SendFiles/Action
  • ContactActions/SendFiles/Command
  • ContactActions/SendFiles/SortOrder
  • ContactActions/TextChat/Action
  • ContactActions/TextChat/Command
  • ContactActions/TextChat/SortOrder
  • MSVCR71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • QtCore.pyd
    .dll windows:4 windows x86 arch:x86

    0a62affb2ba801fd510b0341729e78f1


    Headers

    Imports

    Exports

    Sections

  • QtCore4.dll
    .dll windows:4 windows x86 arch:x86

    b22b8fa6184d262d4b4ab417ad04671a


    Headers

    Imports

    Exports

    Sections

  • QtGui.pyd
    .dll windows:4 windows x86 arch:x86

    ab26cba06fcc076a0331aa12dc5c7d72


    Headers

    Imports

    Exports

    Sections

  • QtGui4.dll
    .dll windows:4 windows x86 arch:x86

    6bf7786071b3ab0931b915820391f2bd


    Headers

    Imports

    Exports

    Sections

  • Services/FileTransfer
  • Services/RemoteDesktop
  • Services/TextChat
  • VNCHooks.dll
    .dll windows:4 windows x86 arch:x86

    79c6a35a7e5a1b093797710bc8306f57


    Headers

    Imports

    Exports

    Sections

  • _ctypes.pyd
    .dll windows:4 windows x86 arch:x86

    7d09b100670e44610baa710ad670c77d


    Headers

    Imports

    Exports

    Sections

  • _ncrypt.pyd
    .dll windows:4 windows x86 arch:x86

    5669a6d437705cd1ff0615e6632eac21


    Headers

    Imports

    Exports

    Sections

  • _socket.pyd
    .dll .js windows:4 windows x86 arch:x86 polyglot

    42d0cd8d57d5b2b90953e2db3a0499e4


    Headers

    Imports

    Exports

    Sections

  • bz2.pyd
    .dll windows:4 windows x86 arch:x86

    f96e14c0ce2ce0e57331aadb0490b20e


    Headers

    Imports

    Exports

    Sections

  • library.zip
    .zip
  • PyQt4/QtCore.pyc
  • PyQt4/QtGui.pyc
  • PyQt4/__init__.pyc
  • StringIO.pyc
  • UserDict.pyc
  • __future__.pyc
  • _ctypes.pyc
  • _ncrypt.pyc
  • _socket.pyc
  • _strptime.pyc
  • _threading_local.pyc
  • atexit.pyc
  • base64.pyc
  • bdb.pyc
  • bisect.pyc
  • bz2.pyc
  • calendar.pyc
  • cmd.pyc
  • codecs.pyc
  • copy.pyc
  • copy_reg.pyc
  • cspace/__init__.pyc
  • cspace/dht/__init__.pyc
  • cspace/dht/client.pyc
  • cspace/dht/firewalltest.pyc
  • cspace/dht/node.pyc
  • cspace/dht/params.pyc
  • cspace/dht/proto.pyc
  • cspace/dht/rpc.pyc
  • cspace/dht/util.pyc
  • cspace/main/__init__.pyc
  • cspace/main/app.pyc
  • cspace/main/appletserver.pyc
  • cspace/main/autoupdater.pyc
  • cspace/main/common.pyc
  • cspace/main/dialogs.pyc
  • cspace/main/incomingprompt.pyc
  • cspace/main/permissions.pyc
  • cspace/main/profile.pyc
  • cspace/main/session.pyc
  • cspace/main/sslbridge.pyc
  • cspace/main/ui/Ui_AddContactDialog.pyc
  • cspace/main/ui/Ui_ContactInfoDialog.pyc
  • cspace/main/ui/Ui_CreateKeyDialog.pyc
  • cspace/main/ui/Ui_CreateKeyDoneDialog.pyc
  • cspace/main/ui/Ui_GoOnlineDialog.pyc
  • cspace/main/ui/Ui_IncomingPromptWindow.pyc
  • cspace/main/ui/Ui_KeyInfoDialog.pyc
  • cspace/main/ui/Ui_MainWindow.pyc
  • cspace/main/ui/Ui_PermissionsDialog.pyc
  • cspace/main/ui/Ui_UpdateNotifyWindow.pyc
  • cspace/main/ui/__init__.pyc
  • cspace/main/ui/images_rc.pyc
  • cspace/network/__init__.pyc
  • cspace/network/connector.pyc
  • cspace/network/listener.pyc
  • cspace/network/localip.pyc
  • cspace/network/location.pyc
  • cspace/network/locationcache.pyc
  • cspace/network/noderunner.pyc
  • cspace/network/nodetable.pyc
  • cspace/network/router.pyc
  • cspace/network/routerclient.pyc
  • cspace/network/sslutil.pyc
  • cspace/util/__init__.pyc
  • cspace/util/delaygc.pyc
  • cspace/util/eventer.pyc
  • cspace/util/flashwin.pyc
  • cspace/util/hexcode.pyc
  • cspace/util/queue.pyc
  • cspace/util/rpc.pyc
  • cspace/util/settings.pyc
  • cspace/util/spawn.pyc
  • cspace/util/statemachine.pyc
  • cspace/util/validate.pyc
  • cspace/util/wordcode.pyc
  • cspaceapps/__init__.pyc
  • cspaceapps/appletutil.pyc
  • cspaceapps/filetransfer/Ui_FileReceiverWindow.pyc
  • cspaceapps/filetransfer/Ui_FileSenderWindow.pyc
  • cspaceapps/filetransfer/__init__.pyc
  • cspaceapps/filetransfer/fileclient.pyc
  • cspaceapps/filetransfer/fileproto.pyc
  • cspaceapps/filetransfer/fileserver.pyc
  • cspaceapps/im/Ui_IMWindow.pyc
  • cspaceapps/im/__init__.pyc
  • cspaceapps/images_rc.pyc
  • ctypes/__init__.pyc
  • ctypes/_endian.pyc
  • difflib.pyc
  • dis.pyc
  • doctest.pyc
  • dummy_thread.pyc
  • email/Charset.pyc
  • email/Encoders.pyc
  • email/Errors.pyc
  • email/FeedParser.pyc
  • email/Generator.pyc
  • email/Header.pyc
  • email/Iterators.pyc
  • email/Message.pyc
  • email/Parser.pyc
  • email/Utils.pyc
  • email/__init__.pyc
  • email/_parseaddr.pyc
  • email/base64MIME.pyc
  • email/quopriMIME.pyc
  • encodings/__init__.pyc
  • encodings/aliases.pyc
  • encodings/ascii.pyc
  • encodings/base64_codec.pyc
  • encodings/big5.pyc
  • encodings/big5hkscs.pyc
  • encodings/bz2_codec.pyc
  • encodings/charmap.pyc
  • encodings/cp037.pyc
  • encodings/cp1006.pyc
  • encodings/cp1026.pyc
  • encodings/cp1140.pyc
  • encodings/cp1250.pyc
  • encodings/cp1251.pyc
  • encodings/cp1252.pyc
  • encodings/cp1253.pyc
  • encodings/cp1254.pyc
  • encodings/cp1255.pyc
  • encodings/cp1256.pyc
  • encodings/cp1257.pyc
  • encodings/cp1258.pyc
  • encodings/cp424.pyc
  • encodings/cp437.pyc
  • encodings/cp500.pyc
  • encodings/cp737.pyc
  • encodings/cp775.pyc
  • encodings/cp850.pyc
  • encodings/cp852.pyc
  • encodings/cp855.pyc
  • encodings/cp856.pyc
  • encodings/cp857.pyc
  • encodings/cp860.pyc
  • encodings/cp861.pyc
  • encodings/cp862.pyc
  • encodings/cp863.pyc
  • encodings/cp864.pyc
  • encodings/cp865.pyc
  • encodings/cp866.pyc
  • encodings/cp869.pyc
  • encodings/cp874.pyc
  • encodings/cp875.pyc
  • encodings/cp932.pyc
  • encodings/cp949.pyc
  • encodings/cp950.pyc
  • encodings/euc_jis_2004.pyc
  • encodings/euc_jisx0213.pyc
  • encodings/euc_jp.pyc
  • encodings/euc_kr.pyc
  • encodings/gb18030.pyc
  • encodings/gb2312.pyc
  • encodings/gbk.pyc
  • encodings/hex_codec.pyc
  • encodings/hp_roman8.pyc
  • encodings/hz.pyc
  • encodings/idna.pyc
  • encodings/iso2022_jp.pyc
  • encodings/iso2022_jp_1.pyc
  • encodings/iso2022_jp_2.pyc
  • encodings/iso2022_jp_2004.pyc
  • encodings/iso2022_jp_3.pyc
  • encodings/iso2022_jp_ext.pyc
  • encodings/iso2022_kr.pyc
  • encodings/iso8859_1.pyc
  • encodings/iso8859_10.pyc
  • encodings/iso8859_11.pyc
  • encodings/iso8859_13.pyc
  • encodings/iso8859_14.pyc
  • encodings/iso8859_15.pyc
  • encodings/iso8859_16.pyc
  • encodings/iso8859_2.pyc
  • encodings/iso8859_3.pyc
  • encodings/iso8859_4.pyc
  • encodings/iso8859_5.pyc
  • encodings/iso8859_6.pyc
  • encodings/iso8859_7.pyc
  • encodings/iso8859_8.pyc
  • encodings/iso8859_9.pyc
  • encodings/johab.pyc
  • encodings/koi8_r.pyc
  • encodings/koi8_u.pyc
  • encodings/latin_1.pyc
  • encodings/mac_cyrillic.pyc
  • encodings/mac_greek.pyc
  • encodings/mac_iceland.pyc
  • encodings/mac_latin2.pyc
  • encodings/mac_roman.pyc
  • encodings/mac_turkish.pyc
  • encodings/mbcs.pyc
  • encodings/palmos.pyc
  • encodings/ptcp154.pyc
  • encodings/punycode.pyc
  • encodings/quopri_codec.pyc
  • encodings/raw_unicode_escape.pyc
  • encodings/rot_13.pyc
  • encodings/shift_jis.pyc
  • encodings/shift_jis_2004.pyc
  • encodings/shift_jisx0213.pyc
  • encodings/string_escape.pyc
  • encodings/tis_620.pyc
  • encodings/undefined.pyc
  • encodings/unicode_escape.pyc
  • encodings/unicode_internal.pyc
  • encodings/utf_16.pyc
  • encodings/utf_16_be.pyc
  • encodings/utf_16_le.pyc
  • encodings/utf_7.pyc
  • encodings/utf_8.pyc
  • encodings/uu_codec.pyc
  • encodings/zlib_codec.pyc
  • fnmatch.pyc
  • ftplib.pyc
  • getopt.pyc
  • getpass.pyc
  • glob.pyc
  • gopherlib.pyc
  • heapq.pyc
  • httplib.pyc
  • inspect.pyc
  • linecache.pyc
  • locale.pyc
  • logging/__init__.pyc
  • macpath.pyc
  • macurl2path.pyc
  • mimetools.pyc
  • mimetypes.pyc
  • ncrypt/__init__.pyc
  • ncrypt/dh.pyc
  • ncrypt/digest.pyc
  • ncrypt/rand.pyc
  • ncrypt/rsa.pyc
  • ncrypt/ssl.pyc
  • ncrypt/x509.pyc
  • new.pyc
  • nitro/__init__.pyc
  • nitro/async.pyc
  • nitro/bencode.pyc
  • nitro/errors.pyc
  • nitro/hirestimer.pyc
  • nitro/http.pyc
  • nitro/linestream.pyc
  • nitro/qt4reactor.pyc
  • nitro/reactor.pyc
  • nitro/selectreactor.pyc
  • nitro/ssl.pyc
  • nitro/tcp.pyc
  • nitro/tcpbridge.pyc
  • ntpath.pyc
  • nturl2path.pyc
  • opcode.pyc
  • os.pyc
  • os2emxpath.pyc
  • pdb.pyc
  • pickle.pyc
  • popen2.pyc
  • posixpath.pyc
  • pprint.pyc
  • pycurl.pyc
  • pyreadline/__init__.pyc
  • pyreadline/clipboard.pyc
  • pyreadline/console.pyc
  • pyreadline/init_rl.pyc
  • pyreadline/keysyms.pyc
  • pyreadline/logger.pyc
  • pyreadline/release.pyc
  • pyreadline/rlmain.pyc
  • pyreadline/winconstants.pyc
  • qtrayicon.pyc
  • quopri.pyc
  • random.pyc
  • re.pyc
  • readline.pyc
  • repr.pyc
  • rfc822.pyc
  • select.pyc
  • sip.pyc
  • socket.pyc
  • sre.pyc
  • sre_compile.pyc
  • sre_constants.pyc
  • sre_parse.pyc
  • stat.pyc
  • string.pyc
  • stringprep.pyc
  • subprocess.pyc
  • tempfile.pyc
  • threading.pyc
  • token.pyc
  • tokenize.pyc
  • traceback.pyc
  • types.pyc
  • unicodedata.pyc
  • unittest.pyc
  • urllib.pyc
  • urlparse.pyc
  • uu.pyc
  • warnings.pyc
  • zlib.pyc
  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • pycurl.pyd
    .dll windows:4 windows x86 arch:x86

    ca351aeeae3a20cb14dbd986cda6cf80


    Headers

    Imports

    Exports

    Sections

  • python24.dll
    .dll windows:4 windows x86 arch:x86

    5f16412dcd9d6c93371e429a9bd67165


    Headers

    Imports

    Exports

    Sections

  • qtrayicon.pyd
    .dll windows:4 windows x86 arch:x86

    1244c83fadf0b000d3d0cdf4e0b0cdb3


    Headers

    Imports

    Exports

    Sections

  • select.pyd
    .dll windows:4 windows x86 arch:x86

    bd65522c7a44bb2521a205721f798621


    Headers

    Imports

    Exports

    Sections

  • sip.pyd
    .dll windows:4 windows x86 arch:x86

    ba0d6327e3e6029d79be05490898a90e


    Headers

    Imports

    Exports

    Sections

  • unicodedata.pyd
    .dll windows:4 windows x86 arch:x86

    04083dbbfdcb95209cdd53a62ad22b00


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    18b26e3ef7317852fa83fde4ebd910ac


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Processes.dll
    .dll windows:4 windows x86 arch:x86

    f5edecae12589e705677a6e272ad0394


    Headers

    Imports

    Exports

    Sections

  • w9xpopen.exe
    .exe windows:4 windows x86 arch:x86

    3fa43cf6494afaa362b5996b590f5baa


    Headers

    Imports

    Sections

  • zlib.pyd
    .dll windows:4 windows x86 arch:x86

    9ab28c8b5bdd5694a52d9c66582ee2d6


    Headers

    Imports

    Exports

    Sections