General

  • Target

    f95df2ea879536f15bee8817b4247698_JaffaCakes118

  • Size

    4.3MB

  • MD5

    f95df2ea879536f15bee8817b4247698

  • SHA1

    5190e8ccc0820781003ad5707d5aedf08acbc398

  • SHA256

    913ecfd11233aba6a8af3480baa08d21d4d34729891e7caf840198393fc135d9

  • SHA512

    a2e8f9b83708401ad38278a105b29ff59fc83c739e652a3d4a5bfd2a072c8c5a9786218cfefea58c184b2a1e2bc285d43c9694284e997c5af097323611c8e25d

  • SSDEEP

    49152:i0EN7ITbdiRpMkUcw8zxFaYDB7lzxmL6lZ+4UIPcRdFLg4V3H67+3pJycJxPFEyv:inRpA8zTXxpdkKonJxPFEyqn/gmq

Score
3/10

Malware Config

Signatures

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • f95df2ea879536f15bee8817b4247698_JaffaCakes118
    .rar
  • 4399box_install.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Dir.ini
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    295fc8c35dee88b924b0f6bafc807c6c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/introduce.bmp
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/meituWel.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PROGRAMFILES/Icoapp/ɫ.ico
  • Box/4399Box.exe
    .exe windows:4 windows x86 arch:x86

    a1a52b0470d31cba02f7b8905cd3bb3e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Box/4399Down.dll
    .dll windows:4 windows x86 arch:x86

    e27caee0b4bbff4650e5a95f15fb14bd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Box/4399Live.dll
    .exe windows:4 windows x86 arch:x86

    5cbf1bae3a5c6cb679d1861bea7fc5c2


    Code Sign

    Headers

    Imports

    Sections

  • Box/4399LiveUpdate.exe
    .exe windows:4 windows x86 arch:x86

    e7626713af29f5c91e8be87ea3df6564


    Code Sign

    Headers

    Imports

    Sections

  • Box/4399Panel.exe
    .exe windows:4 windows x86 arch:x86

    25e5b9c8c3e657b419ef413428e33b9a


    Code Sign

    Headers

    Imports

    Sections

  • Box/4399Update.exe
    .exe windows:4 windows x86 arch:x86

    19acf308ab9587362243b200c41b6baa


    Code Sign

    Headers

    Imports

    Sections

  • Box/7z.dll
    .dll windows:4 windows x86 arch:x86

    71fc45db7a81ce236f432a828a4e8fcd


    Headers

    Imports

    Exports

    Sections

  • Box/7zMgr.dll
    .dll windows:4 windows x86 arch:x86

    b5ac4f2d78cc76c49707c6b3ddad3d22


    Headers

    Imports

    Exports

    Sections

  • Box/BugCollector.exe
    .exe windows:4 windows x86 arch:x86

    0a0d803c7e6a0ad7234a8958a98cbf81


    Code Sign

    Headers

    Imports

    Sections

  • Box/DSGame.exe
    .exe windows:4 windows x86 arch:x86

    16215183eac29438f1a2fd4ddb2e02ef


    Headers

    Imports

    Sections

  • Box/LocalPage/catalog/allcat.xml
    .xml
  • Box/LocalPage/catalog/catalogess.html
    .html .js polyglot
  • Box/LocalPage/catalog/catalogflash.html
    .js
  • Box/LocalPage/catalog/catalogmygame.html
    .js
  • Box/LocalPage/catalog/catalogonline.html
    .html .js polyglot
  • Box/LocalPage/catalog/catalogselected.gif
    .gif
  • Box/LocalPage/catalog/catalogselected_mygame.gif
    .gif
  • Box/LocalPage/catalog/catalogwebgame.html
    .html .js polyglot
  • Box/LocalPage/catalog/ginfor_cz.gif
    .gif
  • Box/LocalPage/catalog/ginfor_gl.gif
    .gif
  • Box/LocalPage/catalog/hot.gif
    .gif
  • Box/LocalPage/catalog/jquery.query-2.1.7.js
    .js
  • Box/LocalPage/catalog/menu_arrow.gif
    .gif
  • Box/LocalPage/catalog/menu_mygame.gif
    .gif
  • Box/LocalPage/catalog/menu_scroll.gif
    .gif
  • Box/LocalPage/catalog/new.gif
    .gif
  • Box/LocalPage/catalog/playflash.html
    .js
  • Box/LocalPage/check/ad.xml
  • Box/LocalPage/check/check_img_bd.jpg
    .jpg
  • Box/LocalPage/check/index.html
    .html .js polyglot
  • Box/LocalPage/check/loading.swf
  • Box/LocalPage/check/popup.html
    .html
  • Box/LocalPage/check/popup.jpg
    .jpg
  • Box/LocalPage/check/win.html
    .html .js polyglot
  • Box/LocalPage/common/images/catalogselected.gif
    .gif
  • Box/LocalPage/common/images/check.gif
    .gif
  • Box/LocalPage/common/images/check.swf
  • Box/LocalPage/common/images/g_ico.gif
    .gif
  • Box/LocalPage/common/images/game_loading.gif
    .gif
  • Box/LocalPage/common/images/gamesearch01.gif
    .gif
  • Box/LocalPage/common/images/ginfor_cz.gif
    .gif
  • Box/LocalPage/common/images/ginfor_gl.gif
    .gif
  • Box/LocalPage/common/images/head_bg.gif
    .gif
  • Box/LocalPage/common/images/ico_check.gif
    .gif
  • Box/LocalPage/common/images/ico_chinese.gif
    .gif
  • Box/LocalPage/common/images/ico_del.gif
    .gif
  • Box/LocalPage/common/images/ico_dot.gif
    .gif
  • Box/LocalPage/common/images/ico_flash.gif
    .gif
  • Box/LocalPage/common/images/ico_online.gif
    .gif
  • Box/LocalPage/common/images/ico_prompt.gif
    .gif
  • Box/LocalPage/common/images/ico_star.gif
    .gif
  • Box/LocalPage/common/images/menu_arrow.gif
    .gif
  • Box/LocalPage/common/images/menu_scroll.gif
    .gif
  • Box/LocalPage/common/images/mygame.gif
    .gif
  • Box/LocalPage/common/images/mygame_bg.gif
    .gif
  • Box/LocalPage/common/images/nocheck.swf
  • Box/LocalPage/common/images/option_btn.gif
    .gif
  • Box/LocalPage/common/images/option_set.gif
    .gif
  • Box/LocalPage/common/images/option_txt.gif
    .gif
  • Box/LocalPage/common/images/webgame_btn.gif
    .gif
  • Box/LocalPage/common/images/win_bkg.gif
    .gif
  • Box/LocalPage/common/js/common.js
    .js
  • Box/LocalPage/common/js/jquery-1.2.6.pack.js
    .js
  • Box/LocalPage/common/js/jquery.query-2.1.7.js
    .js
  • Box/LocalPage/common/js/page.js
  • Box/LocalPage/management/localflash.html
    .html .js polyglot
  • Box/LocalPage/management/mygame.html
    .js
  • Box/LocalPage/management/network.html
    .js
  • Box/LocalPage/option/custom.html
    .js
  • Box/LocalPage/option/index.html
    .js
  • Box/SafeMode/4399Safe.exe
    .exe windows:4 windows x86 arch:x86

    a788aefd6f52aeeded2454fa55aac752


    Headers

    Imports

    Sections

  • Box/SafeMode/Install/4399sandbox.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallType.ini
  • $PLUGINSDIR/KmdUtil.exe
    .exe windows:5 windows x86 arch:x86

    312f0dc2e58fdfdb86d144b0679baa25


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Warning.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • LICENSE.TXT
  • SandboxieBITS.exe
    .exe windows:5 windows x86 arch:x86

    4a0846323fde3c7a4fcf9b9218bf0c8c


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieCrypto.exe
    .exe windows:5 windows x86 arch:x86

    4b8c9b37f6da2ffd863704179986d92f


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieDcomLaunch.exe
    .exe windows:5 windows x86 arch:x86

    d14e09a640f15cbab22fa9a80c180352


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieEventSys.exe
    .exe windows:5 windows x86 arch:x86

    4b8c9b37f6da2ffd863704179986d92f


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieRpcSs.exe
    .exe windows:5 windows x86 arch:x86

    be520d1f80f3efb9dd14c287f83e5eef


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieWUAU.exe
    .exe windows:5 windows x86 arch:x86

    8d791d3feb0c687c8d8698d0c7aac411


    Code Sign

    Headers

    Imports

    Sections

  • SbieCtrl.exe
    .exe windows:5 windows x86 arch:x86

    54c96abb3789325a7397e9bfcf30a97a


    Code Sign

    Headers

    Imports

    Sections

  • SbieDll.dll
    .dll windows:5 windows x86 arch:x86

    3af8894d3b1faeb3fb96435d79712bc0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SbieDllX.dll
    .dll windows:5 windows x86 arch:x86

    3af8894d3b1faeb3fb96435d79712bc0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SbieDrv.sys
    .sys windows:5 windows x86 arch:x86

    941583abe4e5e1c967bb33cb486b15b3


    Code Sign

    Headers

    Imports

    Sections

  • SbieMsg.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • SbieSvc.exe
    .exe windows:5 windows x86 arch:x86

    0c6b81b6daa1551cb48cbee2821bf7a2


    Code Sign

    Headers

    Imports

    Sections

  • Start.exe
    .exe windows:5 windows x86 arch:x86

    c607003a46e17e5ab247ad5b9ac6460a


    Code Sign

    Headers

    Imports

    Sections

  • Box/SafeMode/Install/4399sandbox_win7.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallType.ini
  • $PLUGINSDIR/KmdUtil.exe
    .exe windows:5 windows x86 arch:x86

    611d917a938d9ceec280707166252976


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    9b6b6a7858e17fb0b17e1c1428330343


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SbieMsg.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Warning.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • LICENSE.TXT
  • SandboxieBITS.exe
    .exe windows:5 windows x86 arch:x86

    fc5c6a259e801b01205c65961ee7657a


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieCrypto.exe
    .exe windows:5 windows x86 arch:x86

    efa0a04887011a5d8a2dee30998b3df9


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieDcomLaunch.exe
    .exe windows:5 windows x86 arch:x86

    d6b96f8a15114c1f38edc9f081763301


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieRpcSs.exe
    .exe windows:5 windows x86 arch:x86

    b0a7a7dd5407869426a7a8266044c280


    Code Sign

    Headers

    Imports

    Sections

  • SandboxieWUAU.exe
    .exe windows:5 windows x86 arch:x86

    5592dfcfc9f7d9b79b28c03dbd5f5412


    Code Sign

    Headers

    Imports

    Sections

  • SbieCtrl.exe
    .exe windows:5 windows x86 arch:x86

    ef4d19b91d885ebf5ab257f2e4098b67


    Code Sign

    Headers

    Imports

    Sections

  • SbieDll.dll
    .dll windows:5 windows x86 arch:x86

    229356de0d1de4c184c5815a36180332


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SbieDrv.sys
    .sys windows:5 windows x86 arch:x86

    ff025646436c8f969c9f4531229f5615


    Code Sign

    Headers

    Imports

    Sections

  • SbieMsg.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • SbieSvc.exe
    .exe windows:5 windows x86 arch:x86

    acdc9b52c9735bf46877c7e42a2b5a4a


    Code Sign

    Headers

    Imports

    Sections

  • Start.exe
    .exe windows:5 windows x86 arch:x86

    93da542db79851c169c2e8f3eef4bd3c


    Code Sign

    Headers

    Imports

    Sections

  • Templates.ini
  • Box/SafeMode/Reg32.dat
    .exe windows:5 windows x86 arch:x86

    c607003a46e17e5ab247ad5b9ac6460a


    Headers

    Imports

    Sections

  • Box/SafeMode/Reg32_win7.dat
    .exe windows:5 windows x86 arch:x86

    93da542db79851c169c2e8f3eef4bd3c


    Code Sign

    Headers

    Imports

    Sections

  • Box/SafeMode/Reg64.dat
    .exe windows:5 windows x64 arch:x64

    df23a9bc7e5d4481e47b214e6b4c8754


    Code Sign

    Headers

    Imports

    Sections

  • Box/brun.dll
    .dll windows:4 windows x86 arch:x86

    0291ee5250c5721e66b01304fc69a5b0


    Headers

    Imports

    Exports

    Sections

  • Box/hmgr.dll
    .dll windows:4 windows x86 arch:x86

    25fd634bb6879931af9b04aa61f5a4cd


    Headers

    Imports

    Exports

    Sections

  • Box/htask.dll
    .dll windows:4 windows x86 arch:x86

    ed9524984aa3e4e8155d368e95938e50


    Headers

    Imports

    Exports

    Sections

  • Box/netio.dll
    .dll windows:4 windows x86 arch:x86

    200f57125283dc3ec291df018013dc9f


    Headers

    Imports

    Exports

    Sections

  • Box/np4399Plugin.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4e962eaa5842d124f4bee28ebd0f38be


    Headers

    Imports

    Exports

    Sections

  • Box/skins/Default/AddMoney.png
    .png
  • Box/skins/Default/DLFinish.wav
  • Box/skins/Default/GameHome.png
    .png
  • Box/skins/Default/StatusBtnBG.png
    .png
  • Box/skins/Default/StatusIcon.png
    .png
  • Box/skins/Default/Tab.png
    .png
  • Box/skins/Default/TipBG.png
    .png
  • Box/skins/Default/TipClose.png
    .png
  • Box/skins/Default/TipLogo.png
    .png
  • Box/skins/Default/about.png
    .png
  • Box/skins/Default/ask.png
    .png
  • Box/skins/Default/askbtn.png
    .png
  • Box/skins/Default/askcheckbox.png
    .png
  • Box/skins/Default/askradio.png
    .png
  • Box/skins/Default/bicon.png
    .png
  • Box/skins/Default/button2.png
    .png
  • Box/skins/Default/caption.ico
  • Box/skins/Default/close.png
    .png
  • Box/skins/Default/download_game.png
    .png
  • Box/skins/Default/error.png
    .png
  • Box/skins/Default/favorites_game.png
    .png
  • Box/skins/Default/feedback.png
    .png
  • Box/skins/Default/flashgame_bg.png
    .png
  • Box/skins/Default/fullscreen.png
    .png
  • Box/skins/Default/line.png
    .png
  • Box/skins/Default/max.png
    .png
  • Box/skins/Default/menubtn.png
    .png
  • Box/skins/Default/menuitem.png
    .png
  • Box/skins/Default/min.png
    .png
  • Box/skins/Default/ok.png
    .png
  • Box/skins/Default/pgbg.png
    .png
  • Box/skins/Default/pgface.png
    .png
  • Box/skins/Default/refresh.png
    .png
  • Box/skins/Default/restore.png
    .png
  • Box/skins/Default/restorewindow.png
    .png
  • Box/skins/Default/sandbox.png
    .png
  • Box/skins/Default/skins.ini
  • Box/skins/Default/statusbg.png
    .png
  • Box/skins/Default/tabmyclose.png
    .png
  • Box/skins/Default/tipbackground.png
    .png
  • Box/skins/Default/tipcheck.png
    .png
  • Box/skins/Default/tipclose2.png
    .png
  • Box/skins/Default/tiplogo2.png
    .png
  • Box/skins/Default/tiprungame.png
    .png
  • Box/skins/Default/titlebg.png
    .png
  • Box/skins/Default/trayicon.png
    .png
  • Box/skins/Default/ym_button.png
    .png
  • Box/skins/Default/ym_toolbarbg.png
    .png
  • Box/uninst.exe.nsis
  • Box/zlib.dll
    .dll windows:4 windows x86 arch:x86

    e5c5650f0b0c0414d7e983aacdedc6c6


    Headers

    Imports

    Exports

    Sections

  • 新云软件.url
    .url