General

  • Target

    13b86f3bc7e033568c9d4ab9f6fe654d_JaffaCakes118

  • Size

    1.9MB

  • MD5

    13b86f3bc7e033568c9d4ab9f6fe654d

  • SHA1

    752c89b7e38b921882257b7e57e9cd8a1a8c2cb1

  • SHA256

    5591ad311852fc0e3fcf28bbd781945347a111b1736300829ead3165c1570ec6

  • SHA512

    b16323688b7ded6ccfa5b1c754db636062dda41ef6547c51da7ed857add98be77d8248649ab99d9691a290bf51b6c0474f60677332a6491d09e2d8f30e3b18ff

  • SSDEEP

    49152:/dDah2SGfoajHBgab1QYc3mHVuRn6rRP8j9AKGLU1zR:/dS2SGfLjHjbWVjRnKDKku

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 34 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 13b86f3bc7e033568c9d4ab9f6fe654d_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/$_32_/$_33_.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $APPDATA/$_32_/main.bin
  • $APPDATA/$_38_/$_39_.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $APPDATA/$_38_/main.bin
  • $APPDATA/$_38_/userid.dll
    .dll windows:4 windows x86 arch:x86

    cb8b6e364e5cc5d3e9f9e9f92596e76f


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/$_41_/$APPDATA/$_41_/$_42_.exe
    .exe windows:4 windows x86 arch:x86

    0d2af3c0b10068d6e5f7a60816ffc534


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/$_41_/$APPDATA/$_41_/version.txt
  • $APPDATA/$_44_/$APPDATA/$_44_/$_45_.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $APPDATA/$_44_/$APPDATA/$_44_/main.bin
  • $APPDATA/$_44_/$APPDATA/$_44_/userid.dll
    .dll windows:4 windows x86 arch:x86

    cb8b6e364e5cc5d3e9f9e9f92596e76f


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/$_44_/$APPDATA/$_44_/version.txt
  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/Microsoft.VC80.CRT.manifest
  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/msvcm80.dll
    .dll windows:4 windows x86 arch:x86

    2daa984c9cad30e736f52d625c07e4dd


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    6488997e312be12f8300ea7b1c34d497


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/Microsoft.VC80.CRT/msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    7fecbc4a16a5dc85a5394a1df6217680


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/alien.lua
    .js
  • $APPDATA/Common/LuaRT/alien/core.dll
    .dll windows:4 windows x86 arch:x86

    0daba14c337fc50060a6249c9730d16f


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/alien/struct.dll
    .dll windows:4 windows x86 arch:x86

    27b11a91be6f66a4097f4d8a2586db07


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/base.lua
    .js
  • $APPDATA/Common/LuaRT/debug_ext.lua
    .js
  • $APPDATA/Common/LuaRT/debug_init.lua
  • $APPDATA/Common/LuaRT/getopt.lua
  • $APPDATA/Common/LuaRT/io_ext.lua
  • $APPDATA/Common/LuaRT/json.lua
  • $APPDATA/Common/LuaRT/json/decode.lua
    .js
  • $APPDATA/Common/LuaRT/json/decode/array.lua
  • $APPDATA/Common/LuaRT/json/decode/calls.lua
    .js
  • $APPDATA/Common/LuaRT/json/decode/number.lua
  • $APPDATA/Common/LuaRT/json/decode/object.lua
    .js
  • $APPDATA/Common/LuaRT/json/decode/others.lua
  • $APPDATA/Common/LuaRT/json/decode/strings.lua
  • $APPDATA/Common/LuaRT/json/decode/util.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/array.lua
  • $APPDATA/Common/LuaRT/json/encode/calls.lua
  • $APPDATA/Common/LuaRT/json/encode/number.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/object.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/others.lua
    .js
  • $APPDATA/Common/LuaRT/json/encode/output.lua
  • $APPDATA/Common/LuaRT/json/encode/output_utility.lua
  • $APPDATA/Common/LuaRT/json/encode/strings.lua
    .js
  • $APPDATA/Common/LuaRT/json/util.lua
  • $APPDATA/Common/LuaRT/lfs.dll
    .dll windows:4 windows x86 arch:x86

    44688f303c01867efa90e5a9628e31ce


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/list.lua
    .js
  • $APPDATA/Common/LuaRT/lpeg.dll
    .dll windows:4 windows x86 arch:x86

    457f05afa4e64845de40bab7bb7f93d6


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/ltn12.lua
    .js
  • $APPDATA/Common/LuaRT/lua5.1.dll
    .dll windows:4 windows x86 arch:x86

    df5ee731556844566bd09eb9e0c19cfb


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/lua51.dll
    .dll windows:4 windows x86 arch:x86

    a1b69e6994ef9135a30507dd76a0652e


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/luacom.dll
    .dll windows:4 windows x86 arch:x86

    dbfce946853d90f29a1a324bc8a07ecf


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/luasql/sqlite3.dll
    .dll windows:4 windows x86 arch:x86

    2e0e9ae9231aed27990848eb2f7fa2dc


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/math_ext.lua
  • $APPDATA/Common/LuaRT/mime.lua
    .js
  • $APPDATA/Common/LuaRT/mime/core.dll
    .dll windows:4 windows x86 arch:x86

    5ca78c03fb5923ac682e2dd084a26113


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/modules.lua
  • $APPDATA/Common/LuaRT/package_ext.lua
  • $APPDATA/Common/LuaRT/set.lua
  • $APPDATA/Common/LuaRT/socket.lua
    .js
  • $APPDATA/Common/LuaRT/socket/core.dll
    .dll windows:4 windows x86 arch:x86

    50f3ca3614032798654988e951a912c2


    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Common/LuaRT/socket/http.lua
    .js
  • $APPDATA/Common/LuaRT/socket/url.lua
  • $APPDATA/Common/LuaRT/std.lua
  • $APPDATA/Common/LuaRT/strbuf.lua
  • $APPDATA/Common/LuaRT/string_ext.lua
    .js
  • $APPDATA/Common/LuaRT/table_ext.lua
    .js
  • $APPDATA/Common/LuaRT/tree.lua
  • $APPDATA/Common/LuaRT/wlua.exe
    .exe windows:4 windows x86 arch:x86

    a891a4e34a2fd2cc9fd9cb94b26cc895


    Headers

    Imports

    Sections

  • $APPDATA/fbDownloader/$APPDATA/fbDownloader/uninst.exe.nsis
  • $APPDATA/fbDownloader/DotNetCheck.exe
    .exe windows:5 windows x86 arch:x86

    caab1e0b6067e1367dbddac6a76078c3


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/fbDownloader/Facebook.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $APPDATA/fbDownloader/FacebookAPI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $APPDATA/fbDownloader/FacebookDownloader_48x48_Source.ico
  • $APPDATA/fbDownloader/Microsoft.VC90.DebugCRT.manifest
  • $APPDATA/fbDownloader/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • $APPDATA/fbDownloader/content.txt
  • $APPDATA/fbDownloader/fbDownloader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/fbDownloader/msvcp90d.dll
    .dll windows:5 windows x86 arch:x86

    34e90a6eba47adfd44a08ae3e4e82158


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/fbDownloader/msvcr90d.dll
    .dll windows:5 windows x86 arch:x86

    1b75f09349f79ed0ac2dc349d0d4d0ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/fbDownloader/pdt.txt
  • $APPDATA/fbDownloader/revert.dll
    .dll windows:4 windows x86 arch:x86

    5f6a314f8a43ce0799a6de5d17e5fb32


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/EULA.txt
  • $PLUGINSDIR/Header.bmp
  • $PLUGINSDIR/LockedList.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/SelfDel.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Welcome.bmp
  • $PLUGINSDIR/netset/luarun.exe
    .exe windows:4 windows x86 arch:x86

    b4cbecb5bacc514a52f822962fb4932c


    Headers

    Imports

    Sections

  • $PLUGINSDIR/netset/main.bin
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsRichEdit.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/revert.dll
    .dll windows:4 windows x86 arch:x86

    5f6a314f8a43ce0799a6de5d17e5fb32


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/uph.dll
    .dll windows:4 windows x86 arch:x86

    46876d182e0ac36166adc9b52d5c6adf


    Headers

    Imports

    Exports

    Sections