Overview

overview

4

Static

static

3

AgentVer.ps1

windows7-x64

3

AgentVer.ps1

windows10-2004-x64

3

EULA.exe

windows7-x64

3

EULA.exe

windows10-2004-x64

3

EulaRes.dll

windows7-x64

3

EulaRes.dll

windows10-2004-x64

3

MCAPPINS.exe

windows7-x64

3

MCAPPINS.exe

windows10-2004-x64

3

MCUNINST.dll

windows7-x64

3

MCUNINST.dll

windows10-2004-x64

3

SETUP.exe

windows7-x64

3

SETUP.exe

windows10-2004-x64

3

SETUPRES.dll

windows7-x64

3

SETUPRES.dll

windows10-2004-x64

3

UNINST.dll

windows7-x64

3

UNINST.dll

windows10-2004-x64

3

VSCFGINS.dll

windows7-x64

1

VSCFGINS.dll

windows10-2004-x64

1

VsoVer.ps1

windows7-x64

3

VsoVer.ps1

windows10-2004-x64

3

mcinsres.dll

windows7-x64

1

mcinsres.dll

windows10-2004-x64

1

McSubMgr.dll

windows7-x64

3

McSubMgr.dll

windows10-2004-x64

3

mccomctl.dll

windows7-x64

3

mccomctl.dll

windows10-2004-x64

3

shared/MCGDMGR.dll

windows7-x64

3

shared/MCGDMGR.dll

windows10-2004-x64

3

shared/MCINSCTL.dll

windows7-x64

3

shared/MCINSCTL.dll

windows10-2004-x64

3

dunzip32.dll

windows7-x64

4

dunzip32.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    d666723851a68f311cc86fdfb71db4bf_JaffaCakes118

  • Size

    9.9MB

  • MD5

    d666723851a68f311cc86fdfb71db4bf

  • SHA1

    fd116e819deed04c4b45f8bfc67f279eef8ecd9d

  • SHA256

    2ad197ccffa8d9d9a7ec711c6548b5c11194bd6ff3be04405395ac999c23b1a0

  • SHA512

    5cc67e1e5d47e10e886e2b515c43088dd3b80551046840fd58493667e0759d9ae2d97219af05ad0c2fb5d6563ee58a2c3aa58ccedf7f05af445addced2f074c8

  • SSDEEP

    196608:7IZg5MqhyZ8bgVH9coVD/LW3shCfBn5kIG00diBVch/LGbF1fc3fm3nf:7IZhR8uH9coVD/Rsp5T4KF1fTnf

Score
3/10

Malware Config

Signatures

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

Files

  • d666723851a68f311cc86fdfb71db4bf_JaffaCakes118
    .rar
  • AGENTINS.INF
  • AgOEMVer.ini
  • AgentVer.ini
    .ps1
  • AgntIcfg.ini
  • EULA.EXE
    .exe windows:4 windows x86 arch:x86

    b2094e5ccb0e9ca64e91a9086c5b87e2


    Headers

    Imports

    Sections

  • EulaRes.dll
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • MCAPPINS.EXE
    .exe windows:4 windows x86 arch:x86

    78574f9b9c3120ba21b6335f3561fbaa


    Headers

    Imports

    Sections

  • MCAPPINS.INF
  • MCUNINST.DLL
    .dll windows:4 windows x86 arch:x86

    20a3d3944073cf43affad5adef34325a


    Headers

    Imports

    Exports

    Sections

  • SETUP.EXE
    .exe windows:4 windows x86 arch:x86

    a710771f77e0ef06dd30509e637cd387


    Headers

    Imports

    Sections

  • SETUPRES.DLL
    .dll windows:4 windows x86 arch:x86

    b2e50cc60a521158b3ea2d099cbea42b


    Headers

    Imports

    Sections

  • UNINST.DLL
    .dll windows:4 windows x86 arch:x86

    3790726a7b40262bfc5c3d357df247a7


    Headers

    Imports

    Exports

    Sections

  • VSCFGINS.DLL
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • VSCUninst.log
  • VSOINS.INF
  • VsoVer.ini
    .ps1
  • agentins.ui
    .zip
  • install.ini
  • mcinsres.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • shared/AGENTSUB.CAB
    .cab
  • McSubMgr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    e75b5c5a124caa526a9dcdf26eb433b8


    Headers

    Imports

    Exports

    Sections

  • agentsub.inf
  • shared/MCCOMCTL.CAB
    .cab
  • mccomctl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    57da3b7d668b26c10f80a2570f4dba29


    Headers

    Imports

    Exports

    Sections

  • mccomctl.inf
  • shared/MCGDMGR.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    6fc943e5f85073be21cb0f72ca057ddd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • shared/MCINSCTL.DLL
    .dll regsvr32 windows:4 windows x86 arch:x86

    79d0e77d5447c8501c97dad33b1d71d4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • shared/MGHTML.CAB
    .cab
  • dunzip32.dll
    .dll windows:1 windows x86 arch:x86

    55db3dac3abc59b975e94f989296b5e1


    Headers

    Imports

    Exports

    Sections

  • mghtml.exe
    .exe windows:4 windows x86 arch:x86

    274d9617acc0116eae65c79e1abce90d


    Headers

    Imports

    Sections

  • mghtml.inf
  • shared/McTskshd.cab
    .cab
  • McTskshd.exe
    .exe windows:4 windows x86 arch:x86

    0299606afe00a468a2d6f4fdd6f78637


    Headers

    Imports

    Sections

  • McTskshd.inf
  • shared/REGWIZ.CAB
    .cab
  • McRegWiz.exe
    .exe windows:4 windows x86 arch:x86

    80d4a0058e6b6e781b66736a31a3bf6e


    Headers

    Imports

    Sections

  • RegWizUI.dll
    .dll .vbs windows:4 windows x86 arch:x86 polyglot

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • oem.ini
  • regwiz.inf
  • rwconfig.ini
  • shared/agent.cab
    .cab
  • McDash.exe
    .exe windows:4 windows x86 arch:x86

    5d71e2acec0c0fa686774b92c9c7b3a5


    Headers

    Imports

    Sections

  • McPatch.dll
    .dll windows:4 windows x86 arch:x86

    577cdacc35c00e195ffc15f37368ec02


    Headers

    Imports

    Exports

    Sections

  • McScIndx.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    62ae64db45c661211fe8336fc99f530e


    Headers

    Imports

    Exports

    Sections

  • agent.inf
  • mcagent.exe
    .exe windows:4 windows x86 arch:x86

    937dd513ff22a1e4bfb6ddfb564941a4


    Headers

    Imports

    Sections

  • mcagntps.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    13ebdc320d233480db44de6697e336de


    Headers

    Imports

    Exports

    Sections

  • mcaping.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1e1461111737d07ed070529cbdef87c1


    Headers

    Imports

    Exports

    Sections

  • mcback.dll
    .dll windows:4 windows x86 arch:x86

    a8a09f591670182c3525fba3a38195c0


    Headers

    Imports

    Exports

    Sections

  • mcuilib.dll
    .dll windows:4 windows x86 arch:x86

    c498c2688e5ea92b9e0caa4c8419a134


    Headers

    Imports

    Exports

    Sections

  • mcupdate.exe
    .exe windows:4 windows x86 arch:x86

    e314a4fdc224e4fff3a1815f90ee6d76


    Headers

    Imports

    Sections

  • shared/agentcfg.cab
    .cab
  • Readme.txt
  • agent.chm
    .chm
  • agentcfg.inf
  • mcltvers.ini
  • mcscentr.adf
  • mscuicfg.dat
  • oemcfg.ini
  • screm.ui
    .zip
  • scres.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • uninst.ico
  • shared/agentdui.cab
    .cab
  • shared/agentupd.cab
    .cab
  • shared/mcdetect.cab
    .cab
  • shared/mcscoem.cab
    .cab
  • shared/mcuicfg.cab
    .cab
  • shared/mcunilib.cab
    .cab
  • shared/vsoreg.cab
    .cab
  • uninst.ini
  • virusscan说明.txt
  • vso/MCINSUPD.CAB
    .cab
  • vso/MCTCHDAT.CAB
    .cab
  • vso/UNICOWS.cab
    .cab
  • vso/en-us/us/AOLCFG.CAB
    .cab
  • vso/en-us/us/emlscbin.cab
    .cab
  • vso/en-us/us/emlscres.cab
    .cab
  • vso/en-us/us/imscnbin.cab
    .cab
  • vso/en-us/us/imscnres.cab
    .cab
  • vso/en-us/us/oscnbin.cab
    .cab
  • vso/en-us/us/oscnres.cab
    .cab
  • vso/en-us/us/scrpsbin.cab
    .cab
  • vso/en-us/us/scrstres.cab
    .cab
  • vso/en-us/us/shextbin.cab
    .cab
  • vso/en-us/us/shextres.cab
    .cab
  • vso/en-us/us/vsagntui.cab
    .cab
  • vso/en-us/us/vscfgui.cab
    .cab
  • vso/en-us/us/vso.cab
    .cab
  • vso/en-us/us/vsocfg.cab
    .cab
  • vso/en-us/us/wrmstbin.cab
    .cab
  • vso/en-us/us/wrmstres.cab
    .cab
  • vso/vsodat.cab
    .cab
  • vso/win9x/en-us/oasres.cab
    .cab
  • vso/win9x/oasbin.cab
    .cab
  • vso/win9x/vsoeng.cab
    .cab
  • vso/winnt/OASBIN.CAB
    .cab
  • vso/winnt/en-us/OASRES.cab
    .cab
  • vso/winnt/vsoeng.cab
    .cab
  • vsocfg.ini
  • vsoins.ui
    .zip
  • 下载说明.htm
    .html .js polyglot