General

  • Target
    JaffaCakes118_40b8e98df567505d12e5b5c8eb3c41c9
  • Size 2.1MB
  • Sample250127-sapdbavjdr
  • SHA256 b4d38ca8d15ea651ac5e1a5de5d81c4e2edc54845d6ae7a7beb03a243c3965f6
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

File Explorer

  • JaffaCakes118_40b8e98df567505d12e5b5c8eb3c41c9
    .exe 2.1MB
  • $PLUGINSDIR/Licence.txt
    8KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/XL7InstallUIPlugin.dll
    .dll 53KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 129KB
  • $SYSDIR/atl71.dll
    .dll 88KB
  • $SYSDIR/msvcp71.dll
    .dll 492KB
  • $SYSDIR/msvcr71.dll
    .dll 340KB
  • $TEMP/XL7InstallUI/Photos/01.png
    .png 24KB
  • $TEMP/XL7InstallUI/Photos/02.png
    .png 104KB
  • $TEMP/XL7InstallUI/Photos/03.png
    .png 28KB
  • $TEMP/XL7InstallUI/Photos/04.png
    .png 50KB
  • $TEMP/XL7InstallUI/Photos/05.png
    .png 24KB
  • $TEMP/XL7InstallUI/Photos/06.png
    .png 24KB
  • $TEMP/XL7InstallUI/Photos/Arrow.png
    .png 1KB
  • $TEMP/XL7InstallUI/Photos/Close.png
    .png 2KB
  • $TEMP/XL7InstallUI/Photos/Folder.png
    .png 3KB
  • $TEMP/XL7InstallUI/Photos/GeneralPro.png
    .png 1KB
  • $TEMP/XL7InstallUI/Photos/Light.png
    .png 4KB
  • $TEMP/XL7InstallUI/Photos/MessageBack.png
    .png 4KB
  • $TEMP/XL7InstallUI/Photos/ProBlue.png
    .png 596B
  • $TEMP/XL7InstallUI/Photos/baiduBottomOver.png
    .png 4KB
  • $TEMP/XL7InstallUI/Photos/baiduUpOver.png
    .png 23KB
  • $TEMP/XL7InstallUI/Photos/bottomBackOver.png
    .png 1KB
  • $TEMP/XL7InstallUI/Photos/bottomOver.png
    .png 1KB
  • $TEMP/XL7InstallUI/Photos/button.png
    .png 2KB
  • $TEMP/XL7InstallUI/Photos/finishMiddleOver.png
    .png 4KB
  • $TEMP/XL7InstallUI/Photos/finishUpOver.png
    .png 30KB
  • $TEMP/XL7InstallUI/Photos/font.png
    .png 5KB
  • $TEMP/XL7InstallUI/Photos/frame.png
    .png 23KB
  • $TEMP/XL7InstallUI/Photos/icon.png
    .png 1KB
  • $TEMP/XL7InstallUI/Photos/icon2.png
    .png 3KB
  • $TEMP/XL7InstallUI/Photos/middleOver.png
    .png 3KB
  • $TEMP/XL7InstallUI/Photos/select.png
    .png 1KB
  • $TEMP/XL7InstallUI/Photos/setup.ico
    14KB
  • $TEMP/XL7InstallUI/Photos/title.ico
    23KB
  • $TEMP/XL7InstallUI/Photos/tooltip.png
    .png 670B
  • $TEMP/XL7InstallUI/Photos/upOver.png
    .png 26KB
  • $TEMP/XL7InstallUI/XL7InstallUI.dll
    .dll 182KB
  • $TEMP/XL7InstallUI/XL7InstallUIPlugin.dll
    .dll 53KB
  • $TEMP/XL7InstallUI/XLFSIO.dll
    .dll 197KB
  • $TEMP/XL7InstallUI/XLGraphic.dll
    .dll 697KB
  • $TEMP/XL7InstallUI/atl71.dll
    .dll 88KB
  • $TEMP/XL7InstallUI/libpng13.dll
    .dll 224KB
  • $TEMP/XL7InstallUI/minizip.dll
    .dll 19KB
  • $TEMP/XL7InstallUI/msvcp71.dll
    .dll 492KB
  • $TEMP/XL7InstallUI/msvcr71.dll
    .dll 340KB
  • $TEMP/XL7InstallUI/zlib1.dll
    .dll 76KB
  • Program/XLFSIO.dll
    .dll 197KB
  • Program/XLGraphic.dll
    .dll 697KB
  • Program/atl71.dll
    .dll 88KB
  • Program/libpng13.dll
    .dll 224KB
  • Program/minizip.dll
    .dll 19KB
  • Program/msvcp71.dll
    .dll 492KB
  • Program/msvcr71.dll
    .dll 340KB
  • Program/zlib1.dll
    .dll 76KB

JaffaCakes118_40b8e98df567505d12e5b5c8eb3c41c9

  • IMPHASH 099c0646ea7282d232219f8807883be0
  • SHA256 b4d38ca8d15ea651ac5e1a5de5d81c4e2edc54845d6ae7a7beb03a243c3965f6
  • MD5 SHA1 SHA512 SSDEEP
  • Unsigned PE

    Checks for missing Authenticode signature.

  • NSIS installer

Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths