Overview

overview

7

Static

static

7

44d84f318f...18.exe

windows7-x64

7

44d84f318f...18.exe

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...rl.dll

windows7-x64

3

$PLUGINSDI...rl.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...rl.dll

windows7-x64

3

$PLUGINSDI...rl.dll

windows10-2004-x64

3

Play.exe

windows7-x64

5

Play.exe

windows10-2004-x64

5

PlayGame.exe

windows7-x64

3

PlayGame.exe

windows10-2004-x64

3

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

mame.exe

windows7-x64

5

mame.exe

windows10-2004-x64

5

roms/�...32.chm

windows7-x64

1

roms/�...32.chm

windows10-2004-x64

1

roms/�...up.exe

windows7-x64

3

roms/�...up.exe

windows10-2004-x64

3

roms/�...nt.dll

windows7-x64

5

roms/�...nt.dll

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44d84f318f49e138bd56d26ee4b60421_JaffaCakes118

  • Size

    23.3MB

  • MD5

    44d84f318f49e138bd56d26ee4b60421

  • SHA1

    7b95ee2589398cbe71c22561a38be13bd4467e4d

  • SHA256

    56cae288ee86c68d1bed935233f73d6cbfaf241bc8278b1b967128d29e1f0f9c

  • SHA512

    e8aa3b61988064824dc46795df572848a857e8fd5d5ac34d48389cde864970e9aa916ab0fb414671d042e48bfeb52d00e51b6992f4c5c0c965eeb8c8d8c88c06

  • SSDEEP

    393216:r0IzB2Kg/o0136MAxwg0OJFKOHS5X4cRYzT8/+FpTmvff9mh7zekbx+/3hv7pMSQ:DzBhyo0cMAxH04STROFp84hI317p+fFr

Score
7/10
upxaspackv2

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 44d84f318f49e138bd56d26ee4b60421_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    135de77644e2add2fd9dd8176740e7e0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WaterCtrl.dll
    .dll windows:4 windows x86 arch:x86

    cd2ffec7e2da8a6dd4a84791a95597a7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/waterctrl.dll
    .dll windows:4 windows x86 arch:x86

    cd2ffec7e2da8a6dd4a84791a95597a7


    Headers

    Imports

    Exports

    Sections

  • Play.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Play.ico
  • PlayGame.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • cfg/chmplst2.cfg
    .xml
  • cfg/default.cfg
    .xml
  • mame.dll
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • nvram/chmplst2.nv
  • roms/chmplst2/igsm0501.u7
  • roms/chmplst2/igsm0502.u4
  • roms/chmplst2/igsm0502.u5
  • roms/chmplst2/igss0503.u38
  • roms/chmplst2/maj2v185h.u29
  • roms/֮ȭ3/MAME32kui.ini
  • roms/֮ȭ3/Mame32.chm
    .chm
  • roms/֮ȭ3/cfg/default.cfg
  • roms/֮ȭ3/info/Setup.exe
    .exe windows:4 windows x86 arch:x86

    056b1b4df9b044110abe5852f3ed9654


    Headers

    Imports

    Sections

  • roms/֮ȭ3/ini/MAME32k.ini
  • roms/֮ȭ3/join.wav
  • roms/֮ȭ3/kaillera.txt
  • roms/֮ȭ3/kailleraclient.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • roms/֮ȭ3/mame32k.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • roms/֮ȭ3/readme.txt
  • roms/֮ȭ3/roms/aof3.zip
    .zip
  • AOF3_C1.ROM
  • AOF3_C2.ROM
  • AOF3_C3.ROM
  • AOF3_C4.ROM
  • AOF3_C5.ROM
  • AOF3_C6.ROM
  • AOF3_C7.ROM
  • AOF3_C8.ROM
  • AOF3_M1.ROM
  • AOF3_P1.ROM
  • AOF3_P2.ROM
  • AOF3_S1.ROM
  • AOF3_V1.ROM
  • AOF3_V2.ROM
  • AOF3_V3.ROM
  • roms/֮ȭ3/roms/neogeo.zip
    .zip
  • neo-geo.rom
  • ng-lo.rom
  • ng-sfix.rom
  • ng-sm1.rom
  • roms/֮ȭ3/uninst.exe
    .exe windows:4 windows x86 arch:x86

    dd1742eadfc6df18ded3c26ae64ad610


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • roms/֮ȭ3/zip32.dll
    .dll windows:4 windows x86 arch:x86

    db1e4d25a40dfd2a9f2ff326c81166fe


    Headers

    Imports

    Exports

    Sections

  • roms/֮ȭ3/Ϸ˵.txt
  • rungame.ini
  •  II.url
  • Ϸ˵.txt