General

  • Target

    06ef1e87328447cef639e237babdc0d2_JaffaCakes118

  • Size

    207KB

  • MD5

    06ef1e87328447cef639e237babdc0d2

  • SHA1

    dd7af47b41b0e17e2db6be68d7ba963fb4d3cacf

  • SHA256

    9f35709ee9747f0c7e1ee12b0fe2f01bd0e72b1c7858d41c4904abb7e8768347

  • SHA512

    f50493ba09fc6d3dec38cb9ad716eae9996b90a0078877571c0655332898e7a0f4c3982af64f84c7e21aac9cfefc01931694169b20a00b8f8569efd0146d6b0a

  • SSDEEP

    6144:UOY6VT8petmhQ7Vq4qLUXTJE/CDnhMkf63N:XY6VT800Y+4XTJE/CDnhMk63N

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 06ef1e87328447cef639e237babdc0d2_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    1776ef176e821fae67f5fb6eb56cce45


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • PMSystem.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Plugins/Sami HTTP Server/SamiHTTP.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Plugins/Sami HTTP Server/Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    1776ef176e821fae67f5fb6eb56cce45


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • license.txt