General

  • Target

    23e0072baba7b9ea62f2ed1fc1d52131_JaffaCakes118

  • Size

    22.1MB

  • MD5

    23e0072baba7b9ea62f2ed1fc1d52131

  • SHA1

    9b1e33d9e51149e59978084e2c052b618136270f

  • SHA256

    284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990

  • SHA512

    3bfe0b3b7efd1156ae78aa3454fcaadf676b09207996cbb1b8dfc221f079a1bbcdf8fe4f463a430d50467a386edf51169d0b4fa68ce7ebac043327cd1e82d07d

  • SSDEEP

    393216:cntfiT0iFP+FBTpoAICN50ousZnni/NcyTQ0hMLb/lD/gUfKX9GBq27cL:AtfmPwlprIG53ilXQTLb/1/tiX9sFQ

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • NSIS installer 4 IoCs

Files

  • 23e0072baba7b9ea62f2ed1fc1d52131_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    e3e1ba523cf61b826993834dca364e87


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/TXWiFiDriver/txwifinat.cat
  • $APPDATA/TXWiFiDriver/txwifinat.inf
  • $APPDATA/TXWiFiDriver/txwifinat.sys
    .sys windows:6 windows x86 arch:x86

    9bc1d8461f27c53a6d4358429ee741b6


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/TXWiFiDriver/txwifinat64.cat
  • $APPDATA/TXWiFiDriver/txwifinat64.inf
  • $APPDATA/TXWiFiDriver/txwifinat64.sys
    .sys windows:6 windows x64 arch:x64

    a3649674a7db7cef2246dfebe8d702a0


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/Internet.dll
    .dll windows:4 windows x86 arch:x86

    04281f88c3d826e409dc7c24629e7efc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ShadowInner.png
    .png
  • $PLUGINSDIR/ShadowOuter.png
    .png
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TXSetupPlugin.dll
    .dll windows:5 windows x86 arch:x86

    c58fa083a96165c107c65c9e6486b1ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TXUninstallPlugin.dll
    .dll windows:5 windows x86 arch:x86

    907e73a33543b22bee42e85d53cc9903


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TXWindowPlugin.dll
    .dll windows:5 windows x86 arch:x86

    7c8086fff409b5fc031ff3ee62b1aed6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WelcomeLittle.png
    .png
  • $PLUGINSDIR/WndProc.dll
    .dll windows:4 windows x86 arch:x86

    b3f659d7637a91b4fec12ff9b930080d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/banner_gift.png
    .png
  • $PLUGINSDIR/banner_movie.png
    .png
  • $PLUGINSDIR/banner_setting.png
    .png
  • $PLUGINSDIR/banner_wifi.png
    .png
  • $PLUGINSDIR/bg.png
    .png
  • $PLUGINSDIR/bg_complete.png
    .png
  • $PLUGINSDIR/bg_install.png
    .png
  • $PLUGINSDIR/bg_messagebox.png
    .png
  • $PLUGINSDIR/btn_agreement.png
    .png
  • $PLUGINSDIR/btn_autoRun.png
    .png
  • $PLUGINSDIR/btn_back.png
    .png
  • $PLUGINSDIR/btn_cancelMessagebox.png
    .png
  • $PLUGINSDIR/btn_change.png
    .png
  • $PLUGINSDIR/btn_close.png
    .png
  • $PLUGINSDIR/btn_install.png
    .png
  • $PLUGINSDIR/btn_installJuZiBrowser.png
    .png
  • $PLUGINSDIR/btn_installQQBrowser.png
    .png
  • $PLUGINSDIR/btn_installQQMg.png
    .png
  • $PLUGINSDIR/btn_installnow.png
    .png
  • $PLUGINSDIR/btn_license.png
    .png
  • $PLUGINSDIR/btn_okMessagebox.png
    .png
  • $PLUGINSDIR/btn_runNow.png
    .png
  • $PLUGINSDIR/btn_selfSetup.png
    .png
  • $PLUGINSDIR/btn_shortCut.png
    .png
  • $PLUGINSDIR/btn_unagreement.png
    .png
  • $PLUGINSDIR/btn_unautoRun.png
    .png
  • $PLUGINSDIR/btn_uninstallJuZiBrowser.png
    .png
  • $PLUGINSDIR/btn_uninstallQQBrowser.png
    .png
  • $PLUGINSDIR/btn_uninstallQQMg.png
    .png
  • $PLUGINSDIR/btn_unshortCut.png
    .png
  • $PLUGINSDIR/inetc.dll
    .dll windows:5 windows x86 arch:x86

    11e54c9c10472c590f8236478ce9f7ef


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    38e7b5c3ee58b43a91f9679e94aabd09


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    6b7d154c806f1e47db325229c300c6df


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsWindows.dll
    .dll windows:4 windows x86 arch:x86

    8baa37b4b9803e205026a5e2d38eebac


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bmbt.dll
    .dll windows:5 windows x86 arch:x86

    1692b6552bb2d66f3a7fcbf4a1eebe2a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bmcmon.dll
    .dll windows:5 windows x86 arch:x86

    2426ac89c8f936f2fdcdfb4d4c35e466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bmctr.dll
    .dll windows:5 windows x86 arch:x86

    45310442f0d61e8188dbf7010dba1add


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bmptr.exe
    .exe windows:5 windows x86 arch:x86

    03c632e5fa79ddf2352fe0608336a155


    Code Sign

    Headers

    Imports

    Sections

  • Bmupd.exe
    .exe windows:5 windows x86 arch:x86

    6a48ed12a2f100b8388e9728b4423bde


    Code Sign

    Headers

    Imports

    Sections

  • BugReport.dll
    .dll windows:5 windows x86 arch:x86

    4c7462564375160c1e61a44d04d06041


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • BugReportApp.exe
    .exe windows:5 windows x86 arch:x86

    b41b5524353a0b28ceff5e778f8afc69


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • CTKPluginFramework.dll
    .dll windows:5 windows x86 arch:x86

    0b10eef9437bff7cb549bb9f6ff3dd5c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • CrashDump.ini
  • DhcpIpCtrl.dll
    .dll windows:5 windows x86 arch:x86

    9b644cc6542286fb60f105186095c5e9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FileEnc.dll
    .dll windows:5 windows x86 arch:x86

    c566e2033e35e1d060f0c9af5ec87c62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • HWID.ini
  • QtCore4.dll
    .dll windows:5 windows x86 arch:x86

    cdb4940cf8e7ec50f86f7396ec3722f0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QtGui4.dll
    .dll windows:5 windows x86 arch:x86

    0648f7fa9b7cf485c8a33b578520c604


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QtNetwork4.dll
    .dll windows:5 windows x86 arch:x86

    cd3a0b951b7d5e6cc2fd17d8bc83a6aa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QtSql4.dll
    .dll windows:5 windows x86 arch:x86

    cf45f00a30cde19dbb67863bc31b276b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QtWebKit4.dll
    .dll windows:5 windows x86 arch:x86

    b55a1f6c1c8beacf6b60a4dc7ffd6a2f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QtXml4.dll
    .dll windows:5 windows x86 arch:x86

    fd3bdea7e60f42da632f9afe3b5b5362


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RaAPAPI.dll
    .dll windows:4 windows x86 arch:x86

    ecf017f249a34756a32941765a0152e1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SvcCtrl.dll
    .dll windows:5 windows x86 arch:x86

    2d89464e207634289546da9199032201


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TX_Httpd.exe
    .exe windows:5 windows x86 arch:x86

    c8c603fe363bcf698d157106e02a6ac5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • TxDevMgr.dll
    .dll windows:5 windows x86 arch:x86

    836e081409f6d72c355a8698b6977a4f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Wi-Fi.exe
    .exe windows:5 windows x86 arch:x86

    2c853aa39fb70f7a3f247d90e3005525


    Code Sign

    Headers

    Imports

    Sections

  • WiFiGxSvc.exe
    .exe windows:5 windows x86 arch:x86

    15e9ce78d586f2499064fd082c4adf90


    Code Sign

    Headers

    Imports

    Sections

  • bmrep.exe
    .exe windows:5 windows x86 arch:x86

    85a78fd410242375872a10f2f5342464


    Code Sign

    Headers

    Imports

    Sections

  • bmsd.dll
    .dll windows:5 windows x86 arch:x86

    17a47ec8309a4fa0da419639b3495d1d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bmupd.dll
    .dll windows:5 windows x86 arch:x86

    63f7130792cb917887ed9a394f7e5d80


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bmupd.ini
  • conf/txn.wfssclient.ini
  • fonts/msyh.ttf
  • insert.exe
    .exe windows:5 windows x86 arch:x86

    3d93eda6d0a3e89dc23397ad27ce3840


    Code Sign

    Headers

    Imports

    Sections

  • libeay32.dll
    .dll windows:5 windows x86 arch:x86

    a1148764d1a362f64de08140ce887a04


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libglog.dll
    .dll windows:5 windows x86 arch:x86

    744751818bb8c63e54c92ac24bb28052


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • libqjson.dll
    .dll windows:5 windows x86 arch:x86

    513b98d62214bf2c268f4b3da092a690


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • local/LeftBottom.html
    .html
  • local/css/help.css
  • local/css/style.css
  • local/help.html
    .html
  • local/images/1.png
    .png
  • local/images/1_03.png
    .png
    • http://weixin.qq.com/r/eUxxaW-EjDLzrSsK9xlr

  • local/images/2.png
    .png
  • local/images/2_03.jpg
    .jpg
  • local/images/3.png
    .png
  • local/images/3_03.png
    .png
  • local/images/4.png
    .png
  • local/images/5.png
    .png
  • local/images/6.png
    .png
  • local/images/banner.png
    .png
  • local/images/bottom_left.png
    .png
  • local/images/bottom_right.png
    .png
  • local/images/djjr.png
    .png
  • local/images/ewm.png
    .png
    • http://weixin.qq.com/r/eUxxaW-EjDLzrSsK9xlr

  • local/images/jinbi.png
    .png
  • local/images/kaiqiqian.png
    .png
  • local/images/qq.gif
    .gif
  • local/index.html
    .html
  • local/yingku_qian.html
    .html
  • mac.dat
  • mfc100.dll
    .dll windows:5 windows x86 arch:x86

    c45c50a45dcc5e647441103ee242c873


    Code Sign

    Headers

    Imports

    Sections

  • msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qgif4.dll
    .dll windows:5 windows x86 arch:x86

    3fba836b5b92f0f0b35b7d606410a4e8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qico4.dll
    .dll windows:5 windows x86 arch:x86

    234648628dd4c8af896510b5a1ee61eb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qjpeg4.dll
    .dll windows:5 windows x86 arch:x86

    2b8f0f1c43b6c00454c57c763517d0fe


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qmng4.dll
    .dll windows:5 windows x86 arch:x86

    140f126d14cc1800d0af3dba1a30b4ee


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qsvg4.dll
    .dll windows:5 windows x86 arch:x86

    663f73b47dc1adaa8407a1351694cf56


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qtga4.dll
    .dll windows:5 windows x86 arch:x86

    749befb2b1177c349e91aad427c3bce0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/imageformats/qtiff4.dll
    .dll windows:5 windows x86 arch:x86

    1ecd7ae6d34b6360dae93518a9c39657


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/sqldrivers/libmysql.dll
    .dll windows:5 windows x86 arch:x86

    6bde7a828ee93f782d4d311f675ff379


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/sqldrivers/qsqlite4.dll
    .dll windows:5 windows x86 arch:x86

    45dea16b33b868da2a058b4ba3e58169


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/sqldrivers/qsqlmysql4.dll
    .dll windows:5 windows x86 arch:x86

    72a85768ba01909aba912a85104081ea


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.about_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    9abc297115cd92a6e0b2eca8a57f7743


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.controller_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    720a1e866427ea9113b1a43c3a37ebf8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.log4qt_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    bea3e68039b990cb0ed608cfd68e9969


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.login_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    17570cafbbdf7daa7b801534b48b0e17


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.message_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    d8de7f48692b44326b4a0d1b30ee5d15


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.msgquit_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    1cde521513f178c68216726de020d350


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.options_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    4a2fd5bce15bfda3fe7ed7c2babed9f1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.poweroff_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    74a896228593808cd0a85efff1850b62


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.reporter_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    a093d9b540ec7d9a75d878863cc1679f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.settings_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    e633f5ec1daff2ec4604d918a288c931


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.uiloader_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    909b7fed9a7b17bb2c5d7b340d3b3ff6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/txn.wfssclient_0.1.0.dll
    .dll windows:5 windows x86 arch:x86

    f0f359244d94a744614461d3d8f7e4ac


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • skins/skin1/txn_about.rcc
  • skins/skin1/txn_message.rcc
  • skins/skin1/txn_msgquit.rcc
  • skins/skin1/txn_options.rcc
  • skins/skin1/txn_poweroff.rcc
  • skins/skin1/txn_wfssclient.rcc
  • snetcfg.exe
    .exe windows:5 windows x86 arch:x86

    573d087c7442f558d5522a68893f99d9


    Code Sign

    Headers

    Imports

    Sections

  • snetcfg64.exe
    .exe windows:5 windows x64 arch:x64

    10e08a3845950c4ce06ac9bec19c4d7b


    Code Sign

    Headers

    Imports

    Sections

  • sqlite3.dll
    .dll windows:5 windows x86 arch:x86

    204603e46cad3b05c1121092ccfc8f4b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    ec6d2b20953d0595b006c0949eb0cc34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • txassist.dll.new
    .dll regsvr32 windows:5 windows x86 arch:x86

    809e0c955fb7ee9fb898f4d521f9865b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • txassist64.dll.new
    .dll regsvr32 windows:5 windows x64 arch:x64

    9446b1d885d2b17b6341ad321080f416


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • txassistlaunch.exe
    .exe windows:5 windows x86 arch:x86

    29b09cf87ec80a006c9762968df47a99


    Code Sign

    Headers

    Imports

    Sections

  • txassistlaunch64.exe
    .exe windows:5 windows x64 arch:x64

    43dc7b71c2086c3a59f80e99582273f2


    Code Sign

    Headers

    Imports

    Sections

  • txhook.dll.new
    .dll windows:5 windows x86 arch:x86

    ea33e2f526409b057beaf938b93af3de


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • txhook64.dll.new
    .dll windows:5 windows x64 arch:x64

    36ab6ad2b8fd97194d1d00485d46dc40


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • txn_reporter_routine.exe
    .exe windows:5 windows x86 arch:x86

    d0f3fd8c3a94a2b944a74c52247d8321


    Code Sign

    Headers

    Imports

    Sections

  • ui.conf
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    e3e1ba523cf61b826993834dca364e87


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    8c8a576201f68de1a3f26fc723b9f30f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TXSetupPlugin.dll
    .dll windows:5 windows x86 arch:x86

    c58fa083a96165c107c65c9e6486b1ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/TXUninstallPlugin.dll
    .dll windows:5 windows x86 arch:x86

    907e73a33543b22bee42e85d53cc9903


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    38e7b5c3ee58b43a91f9679e94aabd09


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    6b7d154c806f1e47db325229c300c6df


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • wifishare.cfg
  • www/broadcast.html
    .js
  • www/css/global.css
  • www/images/clarity_bg.png
    .png
  • www/images/dow_but.png
    .png
  • www/images/dow_hied.png
    .png
  • www/images/foot_bg.png
    .png
  • www/images/tip_box.png
    .png
  • www/index.html
    .js
  • www/js/jquery.1.9.1.min.js
    .js
  • www/js/jquery.min.js
    .js