Overview

overview

7

Static

static

7

eaab7858ee...18.exe

windows7-x64

7

eaab7858ee...18.exe

windows10-2004-x64

7

$PLUGINSDI...if.dll

windows7-x64

3

$PLUGINSDI...if.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...nt.dll

windows7-x64

3

$PLUGINSDI...nt.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...tc.dll

windows7-x64

3

$PLUGINSDI...tc.dll

windows10-2004-x64

3

$PLUGINSDI...eb.dll

windows7-x64

3

$PLUGINSDI...eb.dll

windows10-2004-x64

3

$PLUGINSDI...rs.dll

windows7-x64

3

$PLUGINSDI...rs.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...ay.dll

windows7-x64

7

$PLUGINSDI...ay.dll

windows10-2004-x64

7

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

7

$PLUGINSDI...on.dll

windows10-2004-x64

7

$TEMP/free...xt.rtf

windows7-x64

4

$TEMP/free...xt.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118

  • Size

    1.8MB

  • MD5

    eaab7858ee68fef371d269c5f29ac42e

  • SHA1

    375d1116acd741fa35c3491da1191fb4c053dd30

  • SHA256

    067a096b7dbb8efc36d920c001f9fc332f468d439b071fe6fb6a464879776b94

  • SHA512

    bb3bf338e68ba53b9b58c5983987f39f160c887d992ed29d0cfb61c35aa0b5490a8b8cf9629f2e16306592456f4dac676c99898991d61e5f2dd61d872376298c

  • SSDEEP

    49152:KpqyOqAiCA4KQ7iIe3XHBQ440lLq7Gid4TG3U:Kpqy5v4KeEXHG4476I4

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs
    installer

Files

  • eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/AnimGif.dll
    .dll windows:4 windows x86 arch:x86

    f600fe515bbb976d5966dd4286e0ebd4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/BgWorker.dll
    .dll windows:4 windows x86 arch:x86

    db2755f409b81c4dbfc04f648cfb80b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ButtonEvent.dll
    .dll windows:5 windows x86 arch:x86

    0ece15e7d9bb35972aec701f46192460


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:5 windows x86 arch:x86

    b997a221e444f5e6463b28778735cf2b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/IpConfig.dll
    .dll windows:5 windows x86 arch:x86

    a9988f98d52a3c7d16228f87844f85ea


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ThreadTimer.dll
    .dll windows:5 windows x86 arch:x86

    cd7699c6e9370d6d4c4bcc96b7286a04


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TkInetc.dll
    .dll windows:6 windows x86 arch:x86

    e963599f352f9ccccdef45b7dd338c91


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TkNsweb.dll
    .dll windows:6 windows x86 arch:x86

    0d00b915273c786c7050422fa4b6ee7a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ToolkitOffers.dll
    .dll windows:6 windows x86 arch:x86

    7b6556e8d791451e97a064e6e490441e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsArray.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/version.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $TEMP/3dboxes_pcspeedup.bmp
  • $TEMP/addlyrics_image1.bmp
  • $TEMP/ajax_loader.gif
    .gif
  • $TEMP/config.xml
    .xml
  • $TEMP/dealply_largo.bmp
  • $TEMP/freetwittube_image1.bmp
  • $TEMP/freetwittube_logo.bmp
  • $TEMP/freetwittube_text.rtf
    .rtf
  • $TEMP/iminent_offerscreen_image.bmp
  • $TEMP/instloffer.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/license.rtf
    .rtf
  • $TEMP/logo_pcspeedup.bmp
  • $TEMP/lollipop_moreinfo.bmp
  • $TEMP/mockup_browseforthecause.bmp
  • $TEMP/mockup_softwareupdater.bmp
  • $TEMP/moreinfo_boxore.bmp
  • $TEMP/moreinfo_iminent.bmp
  • $TEMP/moreinfo_offerbox.bmp
  • $TEMP/moreinfo_playbrite.bmp
  • $TEMP/optimizerpro_image1.bmp
  • $TEMP/optimizerpro_name.bmp
  • $TEMP/optimizerpro_title.bmp
  • $TEMP/pricepeep_logo.bmp
  • $TEMP/richtext1.rtf
    .rtf
  • $TEMP/square_addlyrics.bmp
  • $TEMP/square_boxore.bmp
  • $TEMP/square_browseforthecause.bmp
  • $TEMP/square_dealply.bmp
  • $TEMP/square_fastfreeconvertor.bmp
  • $TEMP/square_freetwittube.bmp
  • $TEMP/square_lollipop.bmp
  • $TEMP/square_offerbox.bmp
  • $TEMP/square_optimizerpro.bmp
  • $TEMP/square_pcspeedup.bmp
  • $TEMP/square_playbrite.bmp
  • $TEMP/square_pricepeep.bmp
  • $TEMP/square_softwareupdater.bmp
  • $TEMP/square_southstar.bmp
  • $TEMP/square_strongvault.bmp
  • $TEMP/square_wajam.bmp
  • $TEMP/strongvault_image.bmp
  • $TEMP/strongvault_richtext.rtf
    .rtf
  • $TEMP/wajam_image1.bmp
  • $TEMP/yontoo.bmp