General

  • Target

    fb43f655bc390195f44618de60cdf04e_JaffaCakes118

  • Size

    28.9MB

  • MD5

    fb43f655bc390195f44618de60cdf04e

  • SHA1

    082cbc6a73b14d577f0817640b695b93d6f00b2c

  • SHA256

    7754a29d53053658d0201c3002f2d5a5f6fcde4047a28f2b3de0643b8d84e9eb

  • SHA512

    d4bb1dfee0c1a917b6c53854e57828bfc38a517793a6753d0d6a42e1c14d374203d84d7e24432c3b9a6adbaec74bf021c434041d96fcebafbbec04ba22500d6d

  • SSDEEP

    786432:8DkVrhIPNxxVn6Cv27kTH96+dIdB2OwJ455nR8i/kqRV:8QVrhuxV6CKO6twJ4578i/T

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 35 IoCs

    Checks for missing Authenticode signature.

Files

  • fb43f655bc390195f44618de60cdf04e_JaffaCakes118
    .exe windows:5 windows x86 arch:x86

    32f3282581436269b3a75b6675fe3e08


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/BgWorker.dll
    .dll windows:4 windows x86 arch:x86

    db2755f409b81c4dbfc04f648cfb80b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/CheckDesktop.bmp
  • $PLUGINSDIR/GetVersion.dll
    .dll windows:4 windows x86 arch:x86

    5e41893d1528e7648e03f81030aca366


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Rfshdktp.dll
    .dll windows:4 windows x86 arch:x86

    042f3c184e7c0923b6325ab1dc09aed7


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinBtn.dll
    .dll windows:4 windows x86 arch:x86

    baf2d405231cd43dae48df474a521d01


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinProgress.dll
    .dll windows:4 windows x86 arch:x86

    df38729be926f91d3390389029adf53b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WebCtrl.dll
    .dll windows:4 windows x86 arch:x86

    edf01e434638f2238a21d45d26ed9a7d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WndSubclass.dll
    .dll windows:4 windows x86 arch:x86

    2ec59a729805f86a974bca3a2fda3a40


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/agreement.bmp
  • $PLUGINSDIR/bg.bmp
  • $PLUGINSDIR/btn_Back.bmp
  • $PLUGINSDIR/btn_Cancel.bmp
  • $PLUGINSDIR/btn_Next.bmp
  • $PLUGINSDIR/btn_OK.bmp
  • $PLUGINSDIR/btn_agreement1.bmp
  • $PLUGINSDIR/btn_agreement2.bmp
  • $PLUGINSDIR/btn_change.bmp
  • $PLUGINSDIR/btn_close.bmp
  • $PLUGINSDIR/btn_close2.bmp
  • $PLUGINSDIR/btn_complete.bmp
  • $PLUGINSDIR/btn_install.bmp
  • $PLUGINSDIR/btn_min.bmp
  • $PLUGINSDIR/btn_min2.bmp
  • $PLUGINSDIR/btn_whitebg_install.bmp
  • $PLUGINSDIR/btn_xieyi.bmp
  • $PLUGINSDIR/btn_zidingyi.bmp
  • $PLUGINSDIR/checkbox1.bmp
  • $PLUGINSDIR/checkbox1_hui.bmp
  • $PLUGINSDIR/checkbox2.bmp
  • $PLUGINSDIR/checkbox2_hui.bmp
  • $PLUGINSDIR/directory.bmp
  • $PLUGINSDIR/header1.bmp
  • $PLUGINSDIR/header2.bmp
  • $PLUGINSDIR/index.htm
    .html .js polyglot
  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    3f1149a3053980fe6b461521d2b55a2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/install_protocol.htm
    .html
  • $PLUGINSDIR/installation.bmp
  • $PLUGINSDIR/jsScroll.js
    .js
  • $PLUGINSDIR/license_bg.bmp
  • $PLUGINSDIR/loading1.bmp
  • $PLUGINSDIR/loading2.bmp
  • $PLUGINSDIR/loading_pic1.bmp
  • $PLUGINSDIR/loading_pic2.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:5 windows x86 arch:x86

    9ea5bdc8c90dfcffe309465c26c89758


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:5 windows x86 arch:x86

    8700d0ebbb41c81ea52718af1ab70a93


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/quicklaunchicon.bmp
  • $PLUGINSDIR/success.bmp
  • $PLUGINSDIR/tongyi.bmp
  • $PLUGINSDIR/welcome.bmp
  • $PLUGINSDIR/xieyibg.bmp
  • $R0
    .dll regsvr32 windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • Qt5Core.dll
    .dll windows:5 windows x86 arch:x86

    3f1f3807f1c4a9bcad6121e7ff887016


    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:5 windows x86 arch:x86

    0c8749a06ee5bd2d0a46f46009ba942e


    Headers

    Imports

    Exports

    Sections

  • Qt5Sql.dll
    .dll windows:5 windows x86 arch:x86

    a7b375307ace6c847385dde44f7b71a8


    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:5 windows x86 arch:x86

    8bd8ca1ba633402bb914855dfd1828cf


    Headers

    Imports

    Exports

    Sections

  • WebServeTD.exe
    .exe windows:5 windows x86 arch:x86

    1cab3a7f5547fae5aa38ab6f1c6145ce


    Code Sign

    Headers

    Imports

    Sections

  • iTudou.exe
    .exe windows:5 windows x86 arch:x86

    a8f5a75328b1b4516beec00188e196a3


    Code Sign

    Headers

    Imports

    Sections

  • icudt52.dll
    .dll windows:4 windows x86 arch:x86

    f6a2c4c0f0781c620790a0c5c240e232


    Headers

    Imports

    Exports

    Sections

  • icuin52.dll
    .dll windows:5 windows x86 arch:x86

    dabf7b9e630dd1c8bf29ec5d6142497f


    Headers

    Imports

    Exports

    Sections

  • icuuc52.dll
    .dll windows:5 windows x86 arch:x86

    c467803ea686f0e2221beb3e40a47aab


    Headers

    Imports

    Exports

    Sections

  • ikuacc.exe
    .exe windows:5 windows x86 arch:x86

    4c910f53482ec0f6453211de158a3dd3


    Code Sign

    Headers

    Imports

    Sections

  • imageformats/qgif.dll
    .dll windows:5 windows x86 arch:x86

    609e8f728db5d98fbe9483cd0f424017


    Headers

    Imports

    Exports

    Sections

  • imageformats/qico.dll
    .dll windows:5 windows x86 arch:x86

    e0b69dc00b53bb1e3c44ed5ff08c1748


    Headers

    Imports

    Exports

    Sections

  • imageformats/qjpeg.dll
    .dll windows:5 windows x86 arch:x86

    1371e4aea8e14159b9179b0942b390da


    Headers

    Imports

    Exports

    Sections

  • itudou_dlcontroller.dll
    .dll windows:5 windows x86 arch:x86

    db16a7f5e12b8d3324664a07f2dc5f9e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • itudou_gui.dll
    .dll windows:5 windows x86 arch:x86

    7f1172acdb868bd13bdd49088404a60e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • itudou_multimedia.dll
    .dll windows:5 windows x86 arch:x86

    86ecf7cb06887e342e38b9a0d8fca6aa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • itudou_nplayer.dll
    .dll windows:5 windows x86 arch:x86

    7b7b473bf3c3975367e1e492dc895d35


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • itudou_transcode.dll
    .dll windows:5 windows x86 arch:x86

    e5ec942d24c0f2b7e95edac15f68fe84


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • itudou_upload_td.dll
    .dll windows:5 windows x86 arch:x86

    61d59cfe24b6998d4ed31b08d5cdc0cb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • itudou_user_td.dll
    .dll windows:5 windows x86 arch:x86

    b85d98a6b4528d6f93078bb9ac15c59f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • npYoukuAgent.dll
    .dll regsvr32 windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • npYoukuAgent_x64.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    c089f4009fd54dbafc7572473148bdcc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nplayer/YoukuNplayer.exe
    .exe windows:5 windows x86 arch:x86

    326e0fc54a235ec57e722c84897807af


    Code Sign

    Headers

    Imports

    Sections

  • nplayer/avcodec-56.dll
    .dll windows:4 windows x86 arch:x86

    24df109b0588458ca4f019ae48085f19


    Headers

    Imports

    Exports

    Sections

  • nplayer/avdevice-56.dll
    .dll windows:4 windows x86 arch:x86

    2295f20d8c9acc998da1b0ccbe858380


    Headers

    Imports

    Exports

    Sections

  • nplayer/avfilter-5.dll
    .dll windows:4 windows x86 arch:x86

    fbcdc1e929e32f8a583d50aa212c3f2b


    Headers

    Imports

    Exports

    Sections

  • nplayer/avformat-56.dll
    .dll windows:4 windows x86 arch:x86

    eb5887d5481bbd4d5014d59f1525a108


    Headers

    Imports

    Exports

    Sections

  • nplayer/avutil-54.dll
    .dll windows:4 windows x86 arch:x86

    3a613177ca5d33f3df431db0061fc6f9


    Headers

    Imports

    Exports

    Sections

  • nplayer/ffmpeg.exe
    .exe windows:4 windows x86 arch:x86

    8a132b8ec41571004acc993507fcfbce


    Code Sign

    Headers

    Imports

    Sections

  • nplayer/postproc-53.dll
    .dll windows:4 windows x86 arch:x86

    72bd6606236ed6c489af21e376d1a08c


    Headers

    Imports

    Exports

    Sections

  • nplayer/swresample-1.dll
    .dll windows:4 windows x86 arch:x86

    e0f1992403c79d40fef4058a374abf8a


    Headers

    Imports

    Exports

    Sections

  • nplayer/swscale-3.dll
    .dll windows:4 windows x86 arch:x86

    a52177bfb6b665875571cfdb7fb89c99


    Headers

    Imports

    Exports

    Sections

  • os_api_win.dll
    .dll windows:5 windows x86 arch:x86

    7af743fd828bd709eb30a9a94e565514


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • os_common.dll
    .dll windows:5 windows x86 arch:x86

    84a6e5441a8315e0f61ba8ed8799c9de


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • os_log.dll
    .dll windows:5 windows x86 arch:x86

    77a57708141ca171967921ef685fda91


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • os_upload.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • out.upx
    .dll windows:5 windows x86 arch:x86


    Headers

    Sections

  • platforms/qwindows.dll
    .dll windows:5 windows x86 arch:x86

    8433a855119a8a7b84c70f8ddd48452b


    Headers

    Imports

    Exports

    Sections

  • sqldrivers/qsqlite.dll
    .dll windows:5 windows x86 arch:x86

    1673c7ceb83eeeca7f83c352a6ddf4cc


    Headers

    Imports

    Exports

    Sections

  • ytget.exe
    .exe windows:5 windows x86 arch:x86

    d77da15dca29baba0379ac26495e18da


    Code Sign

    Headers

    Imports

    Sections