Overview

overview

7

Static

static

7

PP2008/CMUpnp.dll

windows7-x64

1

PP2008/CMUpnp.dll

windows10-2004-x64

1

PP2008/CoreDll.dll

windows7-x64

1

PP2008/CoreDll.dll

windows10-2004-x64

1

PP2008/FtpGoper.exe

windows7-x64

1

PP2008/FtpGoper.exe

windows10-2004-x64

1

PP2008/Local.dll

windows7-x64

1

PP2008/Local.dll

windows10-2004-x64

1

PP2008/PP2008.exe

windows7-x64

3

PP2008/PP2008.exe

windows10-2004-x64

3

PP2008/SkinRes.dll

windows7-x64

1

PP2008/SkinRes.dll

windows10-2004-x64

1

PP2008/Updater.exe

windows7-x64

1

PP2008/Updater.exe

windows10-2004-x64

1

PP2008/UsrLogin.dll

windows7-x64

3

PP2008/UsrLogin.dll

windows10-2004-x64

3

PP2008/funcmod/Bt.dll

windows7-x64

3

PP2008/funcmod/Bt.dll

windows10-2004-x64

3

PP2008/funcmod/Cs.dll

windows7-x64

3

PP2008/funcmod/Cs.dll

windows10-2004-x64

3

PP2008/fun...PT.dll

windows7-x64

3

PP2008/fun...PT.dll

windows10-2004-x64

3

PP2008/fun...2k.dll

windows7-x64

5

PP2008/fun...2k.dll

windows10-2004-x64

5

PP2008/localver.dll

windows7-x64

1

PP2008/localver.dll

windows10-2004-x64

1

PP2008/plu...nt.dll

windows7-x64

1

PP2008/plu...nt.dll

windows10-2004-x64

1

PP2008/plu...py.dll

windows7-x64

6

PP2008/plu...py.dll

windows10-2004-x64

6

PP2008/pndx5016.dll

windows7-x64

1

PP2008/pndx5016.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    002dc324480f36090c970df4c49febfa_JaffaCakes118

  • Size

    1.9MB

  • MD5

    002dc324480f36090c970df4c49febfa

  • SHA1

    7078d5722d71cafbd28ac04180d5f40e91bf7d28

  • SHA256

    a67841ce6c21b1e48913310654d1501e691052a92369dfcefa1f24690e834ed4

  • SHA512

    f93466390e3567d6325cf6dc08d77f259ce06434b755cb0f54bd874736ca41c0377f5f717a410810fac10b22a6ab2ba6b6f13c5aeec873283b54b4ab130f1f01

  • SSDEEP

    49152:+IFOzvc+UBRS2ctBhYy/LCAJTZTJMQ9E9thxYQr7bTUA7:+IFkSRKBhYy/mAJh3EthxdrfwA7

Score
7/10
aspackv2

Malware Config

Signatures

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • 002dc324480f36090c970df4c49febfa_JaffaCakes118
    .rar
  • PP2008/CMUpnp.dll
    .dll windows:4 windows x86 arch:x86

    5b5723e4d1117418b0a640a42ed57e9b


    Headers

    Imports

    Exports

    Sections

  • PP2008/Configs/MainMenuIcons/MainMenu.xml
    .xml
  • PP2008/Configs/MainMenuIcons/help.ico
  • PP2008/Configs/MainMenuIcons/service.ico
  • PP2008/Configs/scrftype.dat
  • PP2008/Configs/sfilter.dat
  • PP2008/Configs/sharenot.dat
  • PP2008/Configs/unsafefile.dat
  • PP2008/CoreDll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PP2008/FtpGoper.exe
    .exe windows:4 windows x86 arch:x86

    086a8aba4f8a2f1c4a866c87eed0d852


    Headers

    Imports

    Sections

  • PP2008/Local.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PP2008/PP2008.exe
    .exe windows:4 windows x86 arch:x86

    e099de47ff9570468c8bc057d1c59ae2


    Headers

    Imports

    Exports

    Sections

  • PP2008/SkinRes.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • PP2008/Thumbs.db
  • PP2008/Updater.exe
    .exe windows:4 windows x86 arch:x86

    e7a6a53cb3999c17c908b7b47ad17326


    Headers

    Imports

    Sections

  • PP2008/UsrLogin.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • PP2008/config/core.ed2k.svr
  • PP2008/config/ed2k.kad.nodes
  • PP2008/config/lang/en_us.lang
  • PP2008/config/lang/zh_cn.lang
  • PP2008/config/upnp.xml
    .xml
  • PP2008/funcmod/Bt.mod
    .dll windows:4 windows x86 arch:x86

    b77190f3868a34f4b69d58dec254daf2


    Headers

    Imports

    Exports

    Sections

  • PP2008/funcmod/Cs.mod
    .dll windows:4 windows x86 arch:x86

    56d83c6dff9008ad0c546960ad5a9de2


    Headers

    Imports

    Exports

    Sections

  • PP2008/funcmod/PPPT.mod
    .dll windows:4 windows x86 arch:x86

    37ead6a52678be4f1acd78f5e5729583


    Headers

    Imports

    Exports

    Sections

  • PP2008/funcmod/xed2k.mod
    .dll windows:4 windows x86 arch:x86

    d359f1dabf29334ddaab667b621ade30


    Headers

    Imports

    Exports

    Sections

  • PP2008/localver.dll
  • PP2008/plugins/DownAgent.dll
    .dll .vbs regsvr32 windows:4 windows x86 arch:x86 polyglot

    58e911c65dd131e0f7e37617558e99d3


    Headers

    Imports

    Exports

    Sections

  • PP2008/plugins/DownSpy.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ad0994fa276bfdf7f128a1b5b74ac7b2


    Headers

    Imports

    Exports

    Sections

  • PP2008/pndx5016.dll
  • PP2008/pndx5032.dll
    .dll windows:4 windows x86 arch:x86

    3dff24d172f5031d837d000fcf3a81f8


    Headers

    Imports

    Exports

    Sections

  • PP2008/ppn.dll
    .dll windows:4 windows x86 arch:x86

    7469d826b6dbac81bad1fff0a2e29548


    Headers

    Imports

    Exports

    Sections

  • PP2008/rmoc3260.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    856609e709a6cabc2acd456e10aed0e4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PP2008/新云软件.url
    .url