Overview

overview

7

Static

static

5

3c9ba99dab...18.exe

windows7-x64

7

3c9ba99dab...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

Easy_Burning.exe

windows7-x64

6

Easy_Burning.exe

windows10-2004-x64

6

Uninst Eas...ng.exe

windows7-x64

7

Uninst Eas...ng.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

VisualISO.exe

windows7-x64

3

VisualISO.exe

windows10-2004-x64

3

cdrecord.exe

windows7-x64

1

cdrecord.exe

windows10-2004-x64

3

check_file.exe

windows7-x64

5

check_file.exe

windows10-2004-x64

5

compare.exe

windows7-x64

3

compare.exe

windows10-2004-x64

3

cygwin1.dll

windows7-x64

3

cygwin1.dll

windows10-2004-x64

3

info.html

windows7-x64

3

info.html

windows10-2004-x64

3

language.exe

windows7-x64

5

language.exe

windows10-2004-x64

5

mkisofs.exe

windows7-x64

1

mkisofs.exe

windows10-2004-x64

3

problem.pdf

windows7-x64

3

problem.pdf

windows10-2004-x64

3

visualiso.chm

windows7-x64

1

visualiso.chm

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    3c9ba99dabd8a71a8b067f8f12958b1e_JaffaCakes118

  • Size

    1.7MB

  • MD5

    3c9ba99dabd8a71a8b067f8f12958b1e

  • SHA1

    6f74bff0a18e86903cea92d89a7106426f87744b

  • SHA256

    a82c46c82c0a620e62b84705d64c74942494ea76b5fba782d782febf19fbe4f4

  • SHA512

    d4c41b434910df3e810e34efc63515435f82ec9d5b8d4bdb4bcd8ec8f3fece54efe1ae88b03de3132efa450219d2e32afe4ef3769682e95fb696bc18fb91a133

  • SSDEEP

    49152:53E5GiGasVhXPsCqqC1rvAUwYv8wGG99qMCG92oWKjHS:53EUasnVCTjv8wRDHS

Score
5/10
pdflinkupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 3c9ba99dabd8a71a8b067f8f12958b1e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    946eb0a1e85c9ade4acaf634eb5a64f1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Easy_Burning.exe
    .exe windows:4 windows x86 arch:x86

    f424ea085243e561c786308a0bf15646


    Headers

    Imports

    Sections

  • Uninst Easy_Burning.exe
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    946eb0a1e85c9ade4acaf634eb5a64f1


    Headers

    Imports

    Exports

    Sections

  • VisualISO.exe
    .exe windows:4 windows x86 arch:x86

    f2b5224d1722450654e9192cb2ae83e3


    Headers

    Imports

    Sections

  • cdrecord.exe
    .exe windows:4 windows x86 arch:x86

    4c9cf243b831189de5ff43457e78f83d


    Headers

    Imports

    Sections

  • check_file.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • compare.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections

  • cygwin1.dll
    .dll windows:4 windows x86 arch:x86

    400661656de0b22c9631b8a6779c390b


    Headers

    Imports

    Exports

    Sections

  • fifo.cfg
  • file_id.diz
  • info.html
    .html
  • language.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • language/Turkish.lng
  • language/ZH-TW.lng
  • language/catalan.lng
  • language/czech.lng
  • language/danish.lng
  • language/deutsch.lng
  • language/english.lng
  • language/finnish.lng
  • language/french.lng
  • language/galician.lng
  • language/hungarian.lng
  • language/italian.lng
  • language/japanese.lng
  • language/korean.lng
  • language/macedonian.lng
  • language/nederlands.lng
  • language/polish.lng
  • language/portuguese.lng
  • language/pt-BR.lng
  • language/russian.lng
  • language/sc.lng
  • language/serbian.lng
  • language/spanish.lng
  • language/srpski-ascii.lng
  • language/srpski-cir.lng
  • language/srpski-lat.lng
  • language/svenska.lng
  • language/translation_info.txt
  • language/ukrainian.lng
  • license.txt
  • mkisofs.exe
    .exe windows:4 windows x86 arch:x86

    c30a503ca471c9aae6faee3b0991cc3f


    Headers

    Imports

    Sections

  • problem.pdf
    .pdf

    • http://forum.paehl.de

    • http://www.nu2.nu/aspiUnder

  • prodvd.key
  • readme_first.txt
  • trans.txt
  • translate.txt
  • visualiso.chm
    .chm