Overview

overview

7

Static

static

3

WindowsVau...e.html

windows7-x64

3

WindowsVau...e.html

windows10-2004-x64

3

WindowsVau...se.rtf

windows7-x64

4

WindowsVau...se.rtf

windows10-2004-x64

1

WindowsVau...or.exe

windows7-x64

7

WindowsVau...or.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

Readme.html

windows7-x64

3

Readme.html

windows10-2004-x64

3

SecurityXp...se.rtf

windows7-x64

4

SecurityXp...se.rtf

windows10-2004-x64

1

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

WindowsVau...32.exe

windows7-x64

3

WindowsVau...32.exe

windows10-2004-x64

3

WindowsVau...64.exe

windows7-x64

1

WindowsVau...64.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    43db7a82c767f00520eb08a5340f1cd5_JaffaCakes118

  • Size

    2.9MB

  • MD5

    43db7a82c767f00520eb08a5340f1cd5

  • SHA1

    50c812f3ad6bb7713b8d2c427ce5a5b885bd32ca

  • SHA256

    7d12aeccd571a72297784d31cc446167823110c31722fc0a122e6b4f1d2a997b

  • SHA512

    ded2b3aa319aca2fc2a72f876c978784143963b65ab4f447d5d4a67d5664f40b531c82b96789951abdc30857d0271eae6baa9e21279a415795ca4aedd680feae

  • SSDEEP

    49152:nphy/fVTaiM4NISWPjd5K+77/nVopO4Z+RqElGFw7X3D06pvSv8jTa:njWfYx2ISWPjXdH/Vop3IRqElG+I8jTa

Score
3/10

Malware Config

Signatures

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 43db7a82c767f00520eb08a5340f1cd5_JaffaCakes118
    .zip
  • WindowsVaultPasswordDecryptor/Readme.html
    .html
  • WindowsVaultPasswordDecryptor/SecurityXploded_License.rtf
    .rtf
  • WindowsVaultPasswordDecryptor/Setup_WindowsVaultPasswordDecryptor.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Confirm.ini
  • $PLUGINSDIR/Finish.ini
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/btmimg.bmp
  • $PLUGINSDIR/header.bmp
  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/isWelcome.ini
  • $PLUGINSDIR/leftimg.bmp
  • Readme.html
    .html
  • SecurityXploded_License.rtf
    .rtf
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Confirm.ini
  • $PLUGINSDIR/Finish.ini
  • $PLUGINSDIR/btmimg.bmp
  • $PLUGINSDIR/header.bmp
  • $PLUGINSDIR/isWelcome.ini
  • $PLUGINSDIR/leftimg.bmp
  • WindowsVaultPasswordDecryptor32.exe
    .exe windows:5 windows x86 arch:x86

    5ab8cf7142a1e0b442c5f28b9aaa994e


    Headers

    Imports

    Sections

  • WindowsVaultPasswordDecryptor64.exe
    .exe windows:5 windows x64 arch:x64

    d8cf507ce197d852ed547e6805f7ec21


    Headers

    Imports

    Sections