General

  • Target

    476eb85659f75b6b2de0a907db885c3b_JaffaCakes118

  • Size

    2.9MB

  • MD5

    476eb85659f75b6b2de0a907db885c3b

  • SHA1

    ed949866c851be2548a5d3801630eddb0fa6e89f

  • SHA256

    61d518cd6d3ac1a7a702651e3df473a14d4b8df8c8e656193d92847f14a3eb1c

  • SHA512

    e8890686a790830a8e08ca979bdba24db89e5923d890448f15ae7410876c2fa40965629382ba48d77502109b734a614b56fd0cdee75a58f102322126088e7acb

  • SSDEEP

    49152:R6VX33+3K4KujHzazo8rYnSZFG0Um0yw19frTiQdSX0uwzet9TnMkXFb4xtgWUKT:MV3wljTnWjt69TduJwzet9TnM4p4fvT

Score
3/10

Malware Config

Signatures

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 476eb85659f75b6b2de0a907db885c3b_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    b76363e9cb88bf9390860da8e50999d2


    Headers

    Imports

    Sections

  • $PLUGINSDIR/BgWorker.dll
    .dll windows:4 windows x86 arch:x86

    db2755f409b81c4dbfc04f648cfb80b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    8df26927f8978d4eb40ff179c0aa961b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinBtn.dll
    .dll windows:4 windows x86 arch:x86

    baf2d405231cd43dae48df474a521d01


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinProgress.dll
    .dll windows:4 windows x86 arch:x86

    df38729be926f91d3390389029adf53b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    f2ac1ab587d5531d5f1bf76c094aef4c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WebCtrl.dll
    .dll windows:4 windows x86 arch:x86

    edf01e434638f2238a21d45d26ed9a7d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WndProc.dll
    .dll windows:4 windows x86 arch:x86

    b3f659d7637a91b4fec12ff9b930080d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bg.bmp
  • $PLUGINSDIR/btn_agreement1.bmp
  • $PLUGINSDIR/btn_agreement2.bmp
  • $PLUGINSDIR/btn_cancel.bmp
  • $PLUGINSDIR/btn_change.bmp
  • $PLUGINSDIR/btn_close.bmp
  • $PLUGINSDIR/btn_complete.bmp
  • $PLUGINSDIR/btn_install.bmp
  • $PLUGINSDIR/btn_next.bmp
  • $PLUGINSDIR/btn_quit.bmp
  • $PLUGINSDIR/checkbox1.bmp
  • $PLUGINSDIR/checkbox2.bmp
  • $PLUGINSDIR/index.htm
    .html .js polyglot
  • $PLUGINSDIR/installation.bmp
  • $PLUGINSDIR/license.rtf
    .rtf
  • $PLUGINSDIR/loading1.bmp
  • $PLUGINSDIR/loading2.bmp
  • $PLUGINSDIR/loading_pic1.bmp
  • $PLUGINSDIR/loading_pic2.bmp
  • $PLUGINSDIR/loading_pic3.bmp
  • $PLUGINSDIR/loading_pic4.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    f03b2bab186574d8892d3d73fa9fd3fd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsWindows$_49_.dll
    .dll windows:4 windows x86 arch:x86

    8baa37b4b9803e205026a5e2d38eebac


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/quit.bmp
  • $PLUGINSDIR/select.bmp
  • $PLUGINSDIR/success.bmp
  • $PLUGINSDIR/welcome.bmp
  • MSVCP71.DLL
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • data/app/default-kefubao-template.xls
    .xls windows office2003
  • data/app/fliter_rules.txt
  • data/app/resource.pak
  • ieshims.dll
    .dll windows:6 windows x86 arch:x86

    44acb5a229b060be26fbcc2f2f1e7e1a


    Headers

    Imports

    Exports

    Sections

  • kefubao.exe
    .exe windows:5 windows x86 arch:x86

    a47f358180c9552af010fc66f054714a


    Headers

    Imports

    Exports

    Sections

  • kefubao.ico
  • libapr-1.dll
    .dll windows:5 windows x86 arch:x86

    decadcb2162f1f8873cb878ba823d5a6


    Headers

    Imports

    Exports

    Sections

  • libaprutil-1.dll
    .dll windows:5 windows x86 arch:x86

    7299d86db3f7afd988871f4ddbe1d9c0


    Headers

    Imports

    Exports

    Sections

  • libcurl.dll
    .dll windows:4 windows x86 arch:x86

    5061359dff03e86ad4d6ee5bb84fc622


    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:4 windows x86 arch:x86

    7fc6c6cf705f8da2f5417e5f94380b41


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • licenses/crypto-License.txt
  • licenses/directui-license.txt
  • licenses/duilib-license.txt
  • licenses/glog-COPYING
  • licenses/rapidjson-license.txt
  • licenses/rapidxml-license.txt
  • msvcp120.dll
    .dll windows:6 windows x86 arch:x86

    6ccda270a497a2c5a36a7f385cc9910d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr120.dll
    .dll windows:6 windows x86 arch:x86

    aa8d086deb6960b10f8791df466a5610


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • mxml1.dll
    .dll windows:5 windows x86 arch:x86

    8bf1879665c6218662d2f66691966bc3


    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:4 windows x86 arch:x86

    e8c2f2dbf851aaaf4400092b26bd5a96


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    b76363e9cb88bf9390860da8e50999d2


    Headers

    Imports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    8df26927f8978d4eb40ff179c0aa961b


    Headers

    Imports

    Exports

    Sections

  • uninst.ico
  • zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ͷҳ.url
    .url