Overview

overview

7

Static

static

3

FtpPasswor...e.html

windows7-x64

3

FtpPasswor...e.html

windows10-2004-x64

3

FtpPasswor...se.rtf

windows7-x64

4

FtpPasswor...se.rtf

windows10-2004-x64

1

FtpPasswor...or.exe

windows7-x64

7

FtpPasswor...or.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

FtpPasswor...or.exe

windows7-x64

3

FtpPasswor...or.exe

windows10-2004-x64

3

Readme.html

windows7-x64

3

Readme.html

windows10-2004-x64

3

SecurityXp...se.rtf

windows7-x64

4

SecurityXp...se.rtf

windows10-2004-x64

1

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    105bdd12bcc295081b4a6b389c16d96a_JaffaCakes118

  • Size

    1.8MB

  • MD5

    105bdd12bcc295081b4a6b389c16d96a

  • SHA1

    bba9ddc36d75da5e53a92a16c218a94f18b5f23d

  • SHA256

    abb8ac413fd99b9abf5e8f743a03fd7e7812f1c7ce7409c618dd3912584c5657

  • SHA512

    3bf78394a3eeff3fd12fcd744ca7bbcf450e4f51af1d3f178295ff2eea275bd640b11546fcd8a5e4869b8dccba679bd1d2f22d86f41c14b0b1cb19e32dfc3e8b

  • SSDEEP

    49152:r51ZAUTUsmVlXYwq1IH+wHfUIZXI0008JBOBIPv8G:rlAUTU9VdYBnwscXt0LM8L

Score
3/10

Malware Config

Signatures

  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 105bdd12bcc295081b4a6b389c16d96a_JaffaCakes118
    .zip
  • FtpPasswordDecryptor/Readme.html
    .html
  • FtpPasswordDecryptor/SecurityXploded_License.rtf
    .rtf
  • FtpPasswordDecryptor/Setup_FtpPasswordDecryptor.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Confirm.ini
  • $PLUGINSDIR/Finish.ini
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/btmimg.bmp
  • $PLUGINSDIR/header.bmp
  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/isWelcome.ini
  • $PLUGINSDIR/leftimg.bmp
  • FtpPasswordDecryptor.exe
    .exe windows:5 windows x86 arch:x86

    c416ab8b60d3a39fc8d13b30e62f83a3


    Headers

    Imports

    Sections

  • Readme.html
    .html
  • SecurityXploded_License.rtf
    .rtf
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Confirm.ini
  • $PLUGINSDIR/Finish.ini
  • $PLUGINSDIR/btmimg.bmp
  • $PLUGINSDIR/header.bmp
  • $PLUGINSDIR/isWelcome.ini
  • $PLUGINSDIR/leftimg.bmp