General

  • Target

    JaffaCakes118_f21fc236f99382ba56941352a456882e65c4d99bcb9ce0094a0981920e9dba09

  • Size

    1.4MB

  • MD5

    38d95a020f777979c1939e0881be2115

  • SHA1

    29b9dcd417dff7ce4693fa60c13bb8778db89f70

  • SHA256

    f21fc236f99382ba56941352a456882e65c4d99bcb9ce0094a0981920e9dba09

  • SHA512

    f4df4c8608abf0fa1c7d293a1d2ea6086c432cb17b18ad5fc45c2045dc7bb9f49677b49cd88e60a58a10a2e3e5d7d18427458058fe4b758c88654d2ff22ebf38

  • SSDEEP

    24576:9KHFVDf5/jH9paD8lqAvd/XnHuUrcEj+qx/blRQXBqbPdh0ZWhdbUkT0b4z4u1O:UHFVDfwxa/XHuqcm94AOWhdbUkT0btmO

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_f21fc236f99382ba56941352a456882e65c4d99bcb9ce0094a0981920e9dba09
    .zip

    Password: infected

  • 72c35df79a994d9623c4cfc717808f39a663c7c9c754488cab6123480f68643d
    .zip
  • Untrimmed.exe
    .exe windows:4 windows x86 arch:x86

    7ed0d71376e55d58ab36dc7d3ffda898


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • Devastatingly143/Begyndelsesordene/network-wired-acquiring-symbolic.svg
  • Devastatingly143/Begyndelsesordene/start-here-symbolic.symbolic.png
    .png
  • Devastatingly143/Begyndelsesordene/trophy-gold.png
    .png
  • Devastatingly143/Begyndelsesordene/view-pin-symbolic.svg
    .xml
  • Devastatingly143/Begyndelsesordene/vmrawdskver.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Sections

  • Laursens/Synstetiskes/Laquais/Ttsiddende/ServiceCore.dll
    .dll windows:6 windows x64 arch:x64

    be6e213fa7580cb0840f3582136e536d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Laursens/Synstetiskes/Laquais/Ttsiddende/System.Xml.ReaderWriter.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Laursens/Synstetiskes/Laquais/Ttsiddende/battery-caution-symbolic.symbolic.png
    .png
  • Laursens/Synstetiskes/Laquais/Ttsiddende/dialog-password-symbolic.symbolic.png
    .png
  • Laursens/Synstetiskes/Laquais/Ttsiddende/emblem-default.png
    .png
  • Prostatism/Mellemfristet/Aprioriskes/format-justify-fill-symbolic.svg
    .xml
  • Prostatism/Mellemfristet/Aprioriskes/help-browser.png
    .png
  • Prostatism/Mellemfristet/Aprioriskes/lang-5146.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Prostatism/Mellemfristet/Aprioriskes/libfreetype-6.dll
    .dll windows:4 windows x64 arch:x64

    1146bb668972f1fbf26bf7714c615b95


    Headers

    Imports

    Exports

    Sections

  • Puntlatsh/Chromophobic30/APM_Aiff.dll
    .dll windows:5 windows x86 arch:x86

    3e064ee4c6db94f08b3e7aaf4c13b6ee


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Puntlatsh/Chromophobic30/Corbin.Und
  • Puntlatsh/Chromophobic30/Siddebadets.Eng
  • Symbranchia/libgmp-10.dll
    .dll windows:4 windows x64 arch:x64

    50d3e0798b0b3d30fc332b48dda65861


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Symbranchia/microphone-hardware-disabled-symbolic.symbolic.png
    .png
  • Symbranchia/network-idle-symbolic.svg
  • Udspecificerendes/Kommunekemis/demasculinisation/Blizzard.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Udspecificerendes/Kommunekemis/demasculinisation/Bluetooth Suite help_LV.chm
    .chm
  • Udspecificerendes/Kommunekemis/demasculinisation/How-To CFF Extension.pdf
    .pdf
    • http://rcCheckButton.top

    • http://www.codeproject.com/