General

  • Target

    132da82c2af611e4916a8c403d311b52_JaffaCakes118

  • Size

    2.8MB

  • MD5

    132da82c2af611e4916a8c403d311b52

  • SHA1

    87ceb57e114ec51b5521c12be23d18ecd7f4d686

  • SHA256

    931c1cc724e9bb532821e2b55b05a464a7e9a22f5ca308641c82ed2173a62b44

  • SHA512

    e20de8cf776631e2e47362d099e4dc26b23bd3ab505ce6e439f93e57ee3b0adcb9101f342fdcb55b0f73cdf7b509cfa8b4d858ee7ec3c7c6396ca79f4d456a69

  • SSDEEP

    49152:T8YrZ36vIdxJs49ssWCrAxJ8G9SazmPEAewFCwtwckTn+4ZmrKhlc:IaZqvIPyPCSqUmPEANCOwcO+rcG

Score
8/10
upx

Malware Config

Signatures

  • Patched UPX-packed file 1 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 19 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 132da82c2af611e4916a8c403d311b52_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/DcryptDll.dll
    .dll windows:4 windows x86 arch:x86

    5e1d3f49e5b7590e18325930cd3084f1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/locate.dll
    .dll windows:4 windows x86 arch:x86

    7f8181c74f882a780c7cd485241e8b51


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsRandom.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/xml.dll
    .dll windows:4 windows x86 arch:x86

    b5ed5b3a951d4443ce56e5453702d536


    Headers

    Imports

    Exports

    Sections

  • $TEMP/key.lky
  • MSVCR70.DLL
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • plugin.FXP
  • plugin.PRG
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • upx.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • upxel.exe
    .exe windows:4 windows x86 arch:x86

    b04ef2ce16a107646a9b8c3ed4515513


    Headers

    Imports

    Sections

  • vfp8r.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • vfp8rchs.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections