General

  • Target

    1126b2b48417ac3e15daf253dd022c24_JaffaCakes118

  • Size

    2.0MB

  • MD5

    1126b2b48417ac3e15daf253dd022c24

  • SHA1

    f9b7cbb2c99aff6468d0d48e633c5ec9c44bc896

  • SHA256

    9ee3b5bc572ac12cb0f7f9ad606d07b662f377ecb95f43145b96c9fef9494d1d

  • SHA512

    5dc040cd6028d63a8d8c588df118aa883d8cfa66482004dcce7de6148406be0399338780dd3f4823104993cd0fea66ef61c0a7f3f6d4cfcf0619e7e40d021421

  • SSDEEP

    49152:IF83psuZCriEYFaN4alUQrIRQBhQNIGvEmHTXkzXQ0z:hZCrfual7g84VUzQ8

Score
3/10

Malware Config

Signatures

  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • 1126b2b48417ac3e15daf253dd022c24_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ToolbarDetector.dll
    .dll windows:5 windows x86 arch:x86

    f49ca187c9bec88b280fb2804687b8c3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    2457671c10c5aa708d9619798ec0139c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/aim_toolbar_ie.exe
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/dual.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/upgradeToolbar.exe
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:4 windows x86 arch:x86

    b5ed5b3a951d4443ce56e5453702d536


    Headers

    Imports

    Exports

    Sections

  • $R5/$R0
    .dll windows:4 windows x86 arch:x86

    114d225166e9f7ba6ffd307ffc63b4cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/dnupdatersetup.exe
    .exe windows:4 windows x86 arch:x86

    c47392731eda8da323cadbd08e81dbff


    Code Sign

    Headers

    Imports

    Sections

  • $COMMONFILES/Software Update Utility/$COMMONFILES/Software Update Utility/uninstall.exe.nsis
  • $COMMONFILES/Software Update Utility/dnu.exe
    .exe windows:4 windows x86 arch:x86

    ab024b7bd0a09f00e35c0fd48824d647


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    6bc108eed3ca99f68adee56e9c99fac6


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnu.dll
    .dll windows:4 windows x86 arch:x86

    e8db3094acef5bcc16fbc67c83a79728


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnu.xpt
  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnupdater2.dll
    .dll windows:4 windows x86 arch:x86

    996628b89af7b00fec75ba717a2b85ff


    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/Mozilla Firefox/plugins/npdnupdater2.xpt
  • $PLUGINSDIR/dual.ini
  • $PLUGINSDIR/eula.rtf
    .rtf
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    8dc5d8ec83864b4a8d299d8b4d06a888


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    238a16a49edf3ab59e2f8c89449c9af7


    Headers

    Imports

    Exports

    Sections

  • $R3/aimToolbarData/install/source.dat
  • $R3/aimToolbarData/install/upgrade.dat
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/META-INF/MANIFEST.MF
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/META-INF/ZIGBERT.RSA
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/META-INF/ZIGBERT.SF
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/chrome.manifest
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/chrome/aimtoolbar.jar
    .zip
  • content/XMLConfig.js
    .js
  • content/aboutBox.xul
    .xml
  • content/addbuddy.xul
    .js .xml polyglot
  • content/aimSearchBox.xml
    .xml
  • content/aolPrefs.js
    .js
  • content/aolQAP.js
    .js
  • content/aolXMLIO.js
    .js
  • content/aoltb.js
    .js
  • content/aoltoolbar.xul
    .xml
  • content/aoluninstall.js
    .js
  • content/bookmark.xul
    .js .xml polyglot
  • content/contents.rdf
    .xml
  • content/defaultQap.xul
    .xml
  • content/doubleQap.xul
    .xml
  • content/favplus_sidebar.xul
    .xml
  • content/firsttime.xul
    .js .xml polyglot
  • content/inbox_sidebar.xul
    .xml
  • content/mail.js
    .js
  • content/metrics.js
    .js
  • content/postQAP.xul
    .xml
  • content/postTOP.xul
    .xml
  • content/resetsurf.xul
    .xml
  • content/searchhook.xul
    .xml
  • content/settings.js
    .js
  • content/settings.xul
    .xml
  • content/surfometer.js
    .js
  • content/tbconfig.js
    .js
  • content/ticker/ticker.css
  • content/ticker/ticker.htm
    .html
  • content/ticker/ticker.js
    .js
  • content/upgrade.js
    .js
  • content/util.js
    .js
  • content/view.js
    .js
  • content/winamp.js
    .js
  • locale/en-US/aoltb.xml
    .xml
  • locale/en-US/config.xml
    .xml
  • locale/en-US/contents.rdf
    .xml
  • locale/en-US/images/icon.png
    .png
  • locale/en-US/images/install_banner_150.png
    .png
  • locale/en-US/images/large_addbtn.png
    .png
  • locale/en-US/images/large_addbtn_over.png
    .png
  • locale/en-US/images/mag_glass.png
    .png
  • locale/en-US/images/photo.png
    .png
  • locale/en-US/images/poweredby.png
    .png
  • locale/en-US/images/search.png
    .png
  • locale/en-US/images/search_over.png
    .png
  • locale/en-US/images/small_addbtn.png
    .png
  • locale/en-US/images/small_addbtn_over.png
    .png
  • locale/en-US/images/sphere.ico
  • locale/en-US/images/sphere.png
    .png
  • locale/en-US/images/truveo.png
    .png
  • locale/en-US/opensearch.xml
  • locale/en-US/plugins/bg_toolbar.jpg
    .jpg
  • locale/en-US/plugins/bg_toolbar.png
    .png
  • locale/en-US/plugins/btn_add.jpg
    .jpg
  • locale/en-US/plugins/status.htm
    .html .js polyglot
  • locale/en-US/toolbar_props.properties
    .js
  • locale/en-US/toolbar_text.dtd
  • skin/about.png
    .png
  • skin/arrow-dn.png
    .png
  • skin/arrow.png
    .png
  • skin/arrow_click.png
    .png
  • skin/arrow_over.png
    .png
  • skin/bg_postqap.png
    .png
  • skin/bg_toolbar.png
    .png
  • skin/chevron.png
    .png
  • skin/chevron_over.png
    .png
  • skin/contents.rdf
    .xml
  • skin/counter.png
    .png
  • skin/down-arrow.gif
    .gif
  • skin/email-icon.gif
    .gif
  • skin/gotoaol.png
    .png
  • skin/help.png
    .png
  • skin/im-icon.gif
    .gif
  • skin/offline.png
    .png
  • skin/online.png
    .png
  • skin/services.png
    .png
  • skin/settings.png
    .png
  • skin/staf.png
    .png
  • skin/styles.css
  • skin/uninstall.png
    .png
  • skin/up-arrow.gif
    .gif
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/components/IMailUtil.xpt
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/components/IaimUninstallObserver.xpt
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/components/MailUtil.dll
    .dll windows:4 windows x86 arch:x86

    39abe50cd17df1a41deee8a716ea54c1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/components/aimUninstallObserver.js
    .js
  • $R3/extensions/{c2f863cd-0429-48c7-bb54-db756a951760}/install.rdf
    .xml