General

  • Target

    f28c55416eeac8c11a529f3d089bd2aa_JaffaCakes118

  • Size

    4.0MB

  • MD5

    f28c55416eeac8c11a529f3d089bd2aa

  • SHA1

    a4c85a46493422e454d3ced4c3f5cbc65a1bd260

  • SHA256

    340279cdb5fcd78fc6eb8cc57358f83b5bec9119e6f5a2d911f06c9e71bfbf1d

  • SHA512

    3b5ba8123910cc681dc02eb3f03145e33f58f03df21b088a67e954ae816d15524f761e99ab70360575632230495a3251ce50687cc7774cf1e7b6cca658468398

  • SSDEEP

    98304:F1lmglCcsvFKN5JG269tMPI6ZSAkYbUdaasFhGfQ9zhZYsZoMO:c4Cc0r269+Q60AkYbtasF0YhmspO

Score
3/10

Malware Config

Signatures

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

Files

  • f28c55416eeac8c11a529f3d089bd2aa_JaffaCakes118
    .rar
  • 上海金.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • BLOCK/BLOCK.DEF
  • BLOCK/BLOCKS.DBF
  • BLOCK/BLOCKS.cdx
  • BLOCK/BLOCKS.fpt
  • BLOCK/EAGLEDBF.DBF
  • BLOCK/EAGLEDBF.cdx
  • C4dll.dll
    .dll windows:5 windows x86 arch:x86

    1ced1d5b613da7ec35720ce62b95330d


    Headers

    Imports

    Exports

    Sections

  • SYS/CONDITION.FUT
  • SYS/CONDITION.STK
  • SYS/FIELD.DB2
  • SYS/tod.txt
  • SkyCHT.dll
    .dll windows:5 windows x86 arch:x86

    f630891c9df09c853719d9190d018fdb


    Headers

    Imports

    Exports

    Sections

  • SkyEng.dll
    .dll windows:5 windows x86 arch:x86

    cbc46f829e951c6dae1d5e664305d931


    Headers

    Imports

    Exports

    Sections

  • URL.txt
  • USERS/C.ini
  • USERS/C2.ini
  • USERS/C3.ini
  • USERS/PAGE/1303AC21.BIN
  • USERS/PAGE/1303AC21.DSP
  • USERS/PAGE/1347FF25.BIN
  • USERS/PAGE/1347FF25.DSP
  • USERS/PAGE/3AC1F068.BIN
  • USERS/PAGE/3AC1F068.DSP
  • USERS/PAGE/6072FC06.BIN
  • USERS/PAGE/6072FC06.DSP
  • USERS/PAGE/A6260F11.BIN
  • USERS/PAGE/A6260F11.DSP
  • USERS/PAGE/CE85CE52.BIN
  • USERS/PAGE/CE85CE52.DSP
  • USERS/PAGE/E1AF58F6.BIN
  • USERS/PAGE/E1AF58F6.DSP
  • USERS/PAGE/E23C56CE.BIN
  • USERS/PAGE/E23C56CE.DSP
  • USERS/PAGE/ECF6F969.BIN
  • USERS/PAGE/ECF6F969.DSP
  • USERS/PAGE/pages.ini
  • USERS/alert.WAV
  • USERS/color.dat
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    237a51742fed62d237b6f1b75452402f


    Headers

    Imports

    Sections

  • ZipArchive.dll
    .dll windows:5 windows x86 arch:x86

    5312d15a3a5bc828586e00aff9b4ca88


    Headers

    Imports

    Exports

    Sections

  • caption.txt
  • iSky.exe
    .exe windows:5 windows x86 arch:x86

    d5780fa83dc2435eacf8918f52494e6b


    Headers

    Imports

    Sections

  • iconfig.ini
  • ip.txt
  • license.txt
  • sky2000.ico
  • sky2000.jpg
    .jpg
  • skyUpdate2.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • vic32.dll
    .dll windows:4 windows x86 arch:x86

    bccc9c2414227ee28e93b13aaa9d5180


    Headers

    Imports

    Exports

    Sections

  • 新云软件.url
    .url