Overview

overview

7

Static

static

7

0226c77db7...18.exe

windows7-x64

7

0226c77db7...18.exe

windows10-2004-x64

7

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$TEMP/TIP2D002.exe

windows7-x64

7

$TEMP/TIP2D002.exe

windows10-2004-x64

7

$TEMP/mb.exe

windows7-x64

6

$TEMP/mb.exe

windows10-2004-x64

6

$TEMP/setup.exe

windows7-x64

7

$TEMP/setup.exe

windows10-2004-x64

7

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/ad...ve.exe

windows7-x64

7

$SYSDIR/ad...ve.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$_6_.dll

windows7-x64

6

$_6_.dll

windows10-2004-x64

6

$TEMP/setu...dz.exe

windows7-x64

7

$TEMP/setu...dz.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    0226c77db71b0f759c666633b3f29e15_JaffaCakes118

  • Size

    516KB

  • MD5

    0226c77db71b0f759c666633b3f29e15

  • SHA1

    528e92d22869dfb1558fb7b27ad379570097e1bc

  • SHA256

    ceab53344864dac8e20a93583e71db40fb04d7c49ebecd95d11cc4633bd2f3a4

  • SHA512

    af98f9beeb6f150b5065c6d12b60feb8bcc3352d82caf2f2db56d26a3a542e85ed2b691398b9e856cb30f39cc004cde22c0137dccf275117afe6def419b8ae28

  • SSDEEP

    12288:aaiqkfw8lygRfIo1nOcO0GbzkiivkqV+Jk6DrU:V6w8lRfIyJOxwXvkK+Jk8U

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs
    installer

Files

  • 0226c77db71b0f759c666633b3f29e15_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    dd1742eadfc6df18ded3c26ae64ad610


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsFlash.dll
    .dll windows:4 windows x86 arch:x86

    df84ff683dd1cdee9be9c1d3b230f6c5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/splash.swf
  • $TEMP/TIP2D002.exe
    .exe windows:4 windows x86 arch:x86

    1dd686b4e37ff24d1f71a814766c2e52


    Headers

    Imports

    Sections

  • $TEMP/mb.exe
    .exe windows:4 windows x86 arch:x86

    057b8b4d60c25f394428f3a68309297d


    Headers

    Imports

    Sections

  • $TEMP/setup.exe
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Math.dll
    .dll windows:4 windows x86 arch:x86

    fedb8e95b3698a6c05b69204d3c2de7a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/adssite-remove.exe
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Math.dll
    .dll windows:4 windows x86 arch:x86

    fedb8e95b3698a6c05b69204d3c2de7a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/validate.ini
  • $_6_
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $TEMP/setup_rightonadz.exe
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections