General

  • Target

    008c73611e187c04fc5666f0fd1983b9_JaffaCakes118

  • Size

    2.7MB

  • MD5

    008c73611e187c04fc5666f0fd1983b9

  • SHA1

    4554394e322d96af9402718ae26a672f55c2c46e

  • SHA256

    37a24aafbb5fea86033b27b4548784868d43f86c6b9ba6b747fbc2a394796b89

  • SHA512

    6bcccccc724e997bb5b4c8a13b88cdbd9abd1d99bf9f493678fa98b73e1f89ee599660b882fedf3942eb71c59fa5e19f1785f078cd9b688e409a84ea218771b3

  • SSDEEP

    49152:KCJFDdil0QVgz3Vyt2TRjvUgmTuary8upwu2a/dyqCw3SlcfaH3/e5bHyO7N9n6p:LFDQSdAsjvUpTtehOuNkXGfG/Orby

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

Files

  • 008c73611e187c04fc5666f0fd1983b9_JaffaCakes118
    .rar
  • PPSetup.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Mfc42.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1557eebc6134cee9eb9d0583a2b40341


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Msvcirt.dll
    .dll windows:5 windows x86 arch:x86

    e23b646356206497bf8908acf54a5366


    Headers

    Imports

    Exports

    Sections

  • ImageIO.dll
    .dll windows:4 windows x86 arch:x86

    02bdef73a4e9d663da03cb738a48817e


    Headers

    Imports

    Exports

    Sections

  • ImageTransform.dll
    .dll windows:4 windows x86 arch:x86

    e3a08d7dceef100f7d1208ba794336cf


    Headers

    Imports

    Exports

    Sections

  • License.txt
  • PhotoPro.chm
    .chm
  • PhotoPro.exe
    .exe windows:4 windows x86 arch:x86

    c52cc4050fcb9ba3912656cc3fd9a40c


    Headers

    Imports

    Exports

    Sections

  • Readme.txt
  • XuiLib20.dll
    .dll windows:4 windows x86 arch:x86

    5bdfba653fbba035884bcefdd0d434e3


    Headers

    Imports

    Exports

    Sections

  • fzh/db.dat
    .exe windows:5 windows x86 arch:x86

    c56a25fa4336eeb10723b3537ba4876d


    Headers

    Imports

    Sections

  • fzh/fzhc.dat
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • fzh/qq.dat
    .exe windows:4 windows x86 arch:x86

    1bed3305885b0ca596d9cbba22baf78a


    Headers

    Imports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • ºº»¯·´À¡.url
  • ºº»¯ËµÃ÷.txt
  • PhotoPro.jpg
    .jpg
  • 下载说明.htm
    .html .js polyglot
  • 汉化说明.txt