General

  • Target

    0a50c3f880c9aa9bab659a5b9bbe2292_JaffaCakes118

  • Size

    1.3MB

  • MD5

    0a50c3f880c9aa9bab659a5b9bbe2292

  • SHA1

    a3a16a76208e07b5e15ea3e8fcc4f4198d15d357

  • SHA256

    ff1994e3c168982d3d64f825dbf7475f860a809e40d77415ae6ee48946bce4de

  • SHA512

    7618298c1dc8ad3752224a820f824b657cc41f2ec503150f640f486c214db0d54caf985ec37dda3cd64d3600b627f0d7667abcd9fc0110dd8a0d4ab58aefb536

  • SSDEEP

    24576:cCPT1Vg0MzdOOve4HkjTlR8aYKpL/EVavN/hsCybPAqEZ99zRX:W0Mzdb3SlRdYK96uNvwPAqEZnRX

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 0a50c3f880c9aa9bab659a5b9bbe2292_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/$_32_/$_33_.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $APPDATA/$_32_/main.bin
  • $APPDATA/$_38_/$_39_.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $APPDATA/$_38_/main.bin
  • $APPDATA/$_38_/userid.dll
    .dll windows:4 windows x86 arch:x86

    cb8b6e364e5cc5d3e9f9e9f92596e76f


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/$_41_/$APPDATA/$_41_/$_42_.exe
    .exe windows:4 windows x86 arch:x86

    0d2af3c0b10068d6e5f7a60816ffc534


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/$_41_/$APPDATA/$_41_/version.txt
  • $APPDATA/$_44_/$APPDATA/$_44_/$_45_.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $APPDATA/$_44_/$APPDATA/$_44_/main.bin
  • $APPDATA/$_44_/$APPDATA/$_44_/userid.dll
    .dll windows:4 windows x86 arch:x86

    cb8b6e364e5cc5d3e9f9e9f92596e76f


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/$_44_/$APPDATA/$_44_/version.txt
  • $APPDATA/$_44_/$LOCALAPPDATA/ext_piccshare/ext_piccshare.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    8514826ce2112f638322270316a37fa9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/$_44_/$LOCALAPPDATA/ext_piccshare_uninst.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/$_44_/$R1/ext_piccshare/ext_piccshare.crx
    .zip
  • icon128.png
    .png
  • icon16.png
    .png
  • icon48.png
    .png
  • manifest.json
  • piccshare-min.js
    .js
  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/Microsoft.VC80.CRT.manifest
  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/msvcm80.dll
    .dll windows:4 windows x86 arch:x86

    2daa984c9cad30e736f52d625c07e4dd


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    6488997e312be12f8300ea7b1c34d497


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    7fecbc4a16a5dc85a5394a1df6217680


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/alien.lua
    .js
  • $APPDATA/Common/LuaRT/alien/core.dll
    .dll windows:4 windows x86 arch:x86

    0daba14c337fc50060a6249c9730d16f


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/alien/struct.dll
    .dll windows:4 windows x86 arch:x86

    27b11a91be6f66a4097f4d8a2586db07


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/base.lua
    .js
  • $APPDATA/Common/LuaRT/debug_ext.lua
    .js
  • $APPDATA/Common/LuaRT/debug_init.lua
  • $APPDATA/Common/LuaRT/getopt.lua
  • $APPDATA/Common/LuaRT/io_ext.lua
  • $APPDATA/Common/LuaRT/json.lua
  • $APPDATA/Common/LuaRT/json/decode.lua
    .js
  • $APPDATA/Common/LuaRT/json/decode/array.lua
  • $APPDATA/Common/LuaRT/json/decode/calls.lua
    .js
  • $APPDATA/Common/LuaRT/json/decode/number.lua
  • $APPDATA/Common/LuaRT/json/decode/object.lua
    .js
  • $APPDATA/Common/LuaRT/json/decode/others.lua
  • $APPDATA/Common/LuaRT/json/decode/strings.lua
  • $APPDATA/Common/LuaRT/json/decode/util.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/array.lua
  • $APPDATA/Common/LuaRT/json/encode/calls.lua
  • $APPDATA/Common/LuaRT/json/encode/number.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/object.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/others.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/output.lua
  • $APPDATA/Common/LuaRT/json/encode/output_utility.lua
  • $APPDATA/Common/LuaRT/json/encode/strings.lua
    .js
  • $APPDATA/Common/LuaRT/json/util.lua
  • $APPDATA/Common/LuaRT/lfs.dll
    .dll windows:4 windows x86 arch:x86

    44688f303c01867efa90e5a9628e31ce


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/list.lua
    .js
  • $APPDATA/Common/LuaRT/lpeg.dll
    .dll windows:4 windows x86 arch:x86

    457f05afa4e64845de40bab7bb7f93d6


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/ltn12.lua
    .js
  • $APPDATA/Common/LuaRT/lua5.1.dll
    .dll windows:4 windows x86 arch:x86

    df5ee731556844566bd09eb9e0c19cfb


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/lua51.dll
    .dll windows:4 windows x86 arch:x86

    a1b69e6994ef9135a30507dd76a0652e


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/luacom.dll
    .dll windows:4 windows x86 arch:x86

    dbfce946853d90f29a1a324bc8a07ecf


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/luasql/sqlite3.dll
    .dll windows:4 windows x86 arch:x86

    2e0e9ae9231aed27990848eb2f7fa2dc


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/math_ext.lua
  • $APPDATA/Common/LuaRT/mime.lua
    .js
  • $APPDATA/Common/LuaRT/mime/core.dll
    .dll windows:4 windows x86 arch:x86

    5ca78c03fb5923ac682e2dd084a26113


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/modules.lua
  • $APPDATA/Common/LuaRT/package_ext.lua
  • $APPDATA/Common/LuaRT/set.lua
  • $APPDATA/Common/LuaRT/socket.lua
    .js
  • $APPDATA/Common/LuaRT/socket/core.dll
    .dll windows:4 windows x86 arch:x86

    50f3ca3614032798654988e951a912c2


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/socket/http.lua
    .js
  • $APPDATA/Common/LuaRT/socket/url.lua
  • $APPDATA/Common/LuaRT/std.lua
  • $APPDATA/Common/LuaRT/strbuf.lua
  • $APPDATA/Common/LuaRT/string_ext.lua
    .js
  • $APPDATA/Common/LuaRT/table_ext.lua
    .js
  • $APPDATA/Common/LuaRT/tree.lua
  • $APPDATA/Common/LuaRT/wlua.exe
    .exe windows:4 windows x86 arch:x86

    a891a4e34a2fd2cc9fd9cb94b26cc895


    Headers

    Imports

    Sections

  • $PLUGINSDIR/EULA.txt
  • $PLUGINSDIR/Header.bmp
  • $PLUGINSDIR/LockedList.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/SelfDel.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Welcome.bmp
  • $PLUGINSDIR/netset/luarun.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $PLUGINSDIR/netset/main.bin
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsJSON.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/nsRichEdit.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/revert.dll
    .dll windows:4 windows x86 arch:x86

    5f6a314f8a43ce0799a6de5d17e5fb32


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/uph.dll
    .dll windows:4 windows x86 arch:x86

    46876d182e0ac36166adc9b52d5c6adf


    Headers

    Imports

    Exports

    Sections

  • $TEMP/ext_piccshare.xpi
    .zip
  • chrome.manifest
  • chrome/content/icon.png
    .png
  • chrome/content/piccshare-min.js
    .js
  • chrome/content/piccshare.xul
    .xml
  • chrome/content/piccshare_ff_loader.js
    .js
  • install.rdf
    .xml