Overview

overview

7

Static

static

3

shouxingba...�_.exe

windows7-x64

3

shouxingba...�_.exe

windows10-2004-x64

3

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ps.dll

windows7-x64

3

$PLUGINSDI...ps.dll

windows10-2004-x64

3

bbs.htm

windows7-x64

1

bbs.htm

windows10-2004-x64

1

datum.htm

windows7-x64

1

datum.htm

windows10-2004-x64

1

home.htm

windows7-x64

1

home.htm

windows10-2004-x64

1

trade.htm

windows7-x64

1

trade.htm

windows10-2004-x64

1

tyro.htm

windows7-x64

1

tyro.htm

windows10-2004-x64

1

 bbs.htm

windows7-x64

1

 bbs.htm

windows10-2004-x64

1

tvro6.exe

windows7-x64

3

tvro6.exe

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

shouxingba...��.url

windows7-x64

1

shouxingba...��.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    00a57459f2211efba103128dfd92cdb4_JaffaCakes118

  • Size

    964KB

  • MD5

    00a57459f2211efba103128dfd92cdb4

  • SHA1

    b1b57f9b82018ec6596299c8514b5b2fece9de98

  • SHA256

    167e4faf535d4e8c345be362d3db7287660776eb9dc3a5633e0d5701e8d40d9c

  • SHA512

    dfab258333e9d55cff74f39ddedff3cda59e001c6d80def33f31d8858705b49043219e25cfeb79cfc8d09eb984b5e363cbeccfd13b94a69c4c59bdf3b37543c5

  • SSDEEP

    12288:PuGgY/wuhZ6t2guHOco/2f2ENDx1VJEwxB2JN0KMjQlb0XYAhdYCvhlGmMFjYLny:LrIcZho/w2CDtm0YbgFvDGmcjYTxQ

Score
3/10

Malware Config

Signatures

  • Unsigned PE 9 IoCs

    Checks for missing Authenticode signature.

Files

  • 00a57459f2211efba103128dfd92cdb4_JaffaCakes118
    .zip
  • shouxingbao_setup/东坡下载说明.txt
  • shouxingbao_setup/收星宝_.exe
    .exe windows:4 windows x86 arch:x86

    dd1742eadfc6df18ded3c26ae64ad610


    Headers

    Imports

    Sections

  • $PLUGINSDIR/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    711c893e4d8189fd14b6563a4e35e663


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    946eb0a1e85c9ade4acaf634eb5a64f1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ToolTips.dll
    .dll windows:4 windows x86 arch:x86

    04338c58e26f4ac6ae89608ac6276429


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • satdata.sta
    .zip
  • a1.gif
    .gif
  • bbs.htm
    .html
  • datum.htm
    .html
  • home.htm
    .html
  • nch.str
  • news.htm
    .html .js polyglot
  • satdata.str
  • sng.str
  • strap2.GIF
    .gif
  • trade.htm
    .html
  • tyro.htm
    .html
  •  bbs.htm
    .html
  • tvro6.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    dd1742eadfc6df18ded3c26ae64ad610


    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    c480ee4d2a64d4a16edee43fdfe35079


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • shouxingbao_setup/更多软件下载.url