Overview

overview

8

Static

static

3

HA_DosReco...CZ.exe

windows7-x64

7

HA_DosReco...CZ.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

$PLUGINSDIR/nsweb.dll

windows7-x64

3

$PLUGINSDIR/nsweb.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ce.dll

windows7-x64

3

$PLUGINSDI...ce.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

$PROGRAM_F...ta.dll

windows7-x64

7

$PROGRAM_F...ta.dll

windows10-2004-x64

7

$PROGRAM_F...ar.dll

windows7-x64

7

$PROGRAM_F...ar.dll

windows10-2004-x64

7

$PROGRAM_F...52.exe

windows7-x64

8

$PROGRAM_F...52.exe

windows10-2004-x64

8

$WINDIR/DosPlay.exe

windows7-x64

1

$WINDIR/DosPlay.exe

windows10-2004-x64

1

Convert/convert.exe

windows7-x64

1

Convert/convert.exe

windows10-2004-x64

1

File,Diz.exe

windows7-x64

6

File,Diz.exe

windows10-2004-x64

1

Java/local...e.html

windows7-x64

1

Java/local...e.html

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    0735b5417ed76eeed70ddc8de96a8a02_JaffaCakes118

  • Size

    1.5MB

  • MD5

    0735b5417ed76eeed70ddc8de96a8a02

  • SHA1

    2927edd30846044baa2487f4d83dc537c24270c4

  • SHA256

    0c781d401d0fd4de29a7bbe121b56a1462d142945cb9baa37e6628663722634c

  • SHA512

    7e60040596bb139bbf55a79815477657055c4905ff2cc45b1471f7bee28b08fc4a8776467352a95aab5eed60cc94f7d61dfa99797c0933fc3f85f171f439cf8a

  • SSDEEP

    24576:o0MbwN0/MZoHXAYD1ZQ+eaD5XP7BiTtuLyMfv/h6sVqNmxNfxRWJDC:o7bwsMQX/B5f9SursYo8Nfx8pC

Score
3/10

Malware Config

Signatures

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

Files

  • 0735b5417ed76eeed70ddc8de96a8a02_JaffaCakes118
    .rar
  • HA_DosRecorder1012_CZ.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/installoptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/killprocdll.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsweb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/startmenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/system.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/textreplace.dll
    .dll windows:4 windows x86 arch:x86

    68af796cbe4fdd2d5baf33b0af9aa583


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/time.dll
    .dll windows:4 windows x86 arch:x86

    5c9a5d5468ec62f250171c012eda3c26


    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/bar/TempData.KGB
    .dll regsvr32 windows:4 windows x86 arch:x86

    6ccb2c8e98669e1c49478ccdae8356ae


    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/bar/baidubar.dat
  • $PROGRAM_FILES/Baidu/bar/baidubar.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6ccb2c8e98669e1c49478ccdae8356ae


    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/bar/img/imglist.bmp
  • $PROGRAM_FILES/Baidu/bar/img/logo.bmp
  • $PROGRAM_FILES_COMMON/NSISLog/Lang2052.DAT
    .exe windows:4 windows x86 arch:x86

    d31173ca8ec2d5e26170e3b96a28428f


    Headers

    Imports

    Sections

  • $WINDIR/DosPlay.EXE
    .exe windows:4 windows x86 arch:x86

    646a6734a67bcbc02c7ac96cceb2287e


    Headers

    Imports

    Sections

  • Convert/convert.exe
    .exe windows:4 windows x86 arch:x86

    d6e8a308aba2b4f539ad94b5ec78789c


    Headers

    Imports

    Sections

  • Demos/SupM_ID.dm2
    .gz
  • SupM_ID.dm2
  • Demos/gibbpost.dm2
    .gz
  • gibbpost.dm2
  • Demos/readme.txt
  • File,Diz.ThX
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • GPLv2.txt
  • Java/local_example.html
    .html
  • Java/online_example.html
    .html
  • Java/player.jar
    .jar
  • Lang2052.DAT
    .exe windows:4 windows x86 arch:x86

    d31173ca8ec2d5e26170e3b96a28428f


    Headers

    Imports

    Sections

  • Player/player2.exe
    .exe windows:4 windows x86 arch:x86

    646a6734a67bcbc02c7ac96cceb2287e


    Headers

    Imports

    Sections

  • ReadMe.txt
  • Recorder.exe
    .exe windows:4 windows x86 arch:x86

    178c5d49382c063b75f3836b21d3d572


    Headers

    Imports

    Sections

  • Source/Common/Common.pas
  • Source/Common/Common2.pas
  • Source/Common/Decode0.pas
  • Source/Common/Decode1.pas
  • Source/Common/Decode2.pas
  • Source/Common/Encode0.pas
  • Source/Common/Encode2.pas
  • Source/Common/ScrUtils.pas
  • Source/Common/options.inc
  • Source/Convert/Convert_debug.pp
  • Source/Convert/comp.pp
  • Source/Convert/convert.map
  • Source/Convert/convert.pp
  • Source/Convert/decomp.map
  • Source/Convert/decomp.pp
  • Source/Java/.classpath
    .xml
  • Source/Java/.project
    .xml
  • Source/Java/Control.class
  • Source/Java/Control.java
    .java .js
  • Source/Java/Cursor.class
  • Source/Java/Cursor.java
    .java .js
  • Source/Java/ScrBuffer.class
  • Source/Java/ScrBuffer.java
  • Source/Java/Show.class
  • Source/Java/Show.java
  • Source/Java/Show1123934665556.html
    .html
  • Source/Java/TFrame.class
  • Source/Java/TFrame.java
  • Source/Java/bm8x16.class
  • Source/Java/bm8x16.java
  • Source/Java/dm2Decoder$TChunkHeader.class
  • Source/Java/dm2Decoder.class
  • Source/Java/dm2Decoder.java
    .java .js
  • Source/Java/font8x16.fnt
  • Source/Java/java.policy.applet
  • Source/Java/the_font.class
  • Source/Java/the_font.java
  • Source/Java/use4.html
    .html
  • Source/LinuxRecorder/readme.txt
  • Source/LinuxRecorder/recorder.pp
    .js
  • Source/Player/MyCrt.pp
  • Source/Player/Player_icon.res
  • Source/Player/WinCrt.pas
  • Source/Player/player1.pp
  • Source/Player/player2.bdsproj
  • Source/Player/player2.dpr
  • Source/Player/player2_ppas.bat
  • Source/Player/player2_script.res
  • Source/Player/ppas.bat
  • Source/Player/test.pas
  • Source/Player/test_d.bat
  • Source/Player/test_fp_dos.bat
  • Source/Player/test_fp_win32.bat
  • Source/Recorder/About.dfm
  • Source/Recorder/About.pas
  • Source/Recorder/Annotations.dfm
  • Source/Recorder/Annotations.pas
  • Source/Recorder/Capturers/ADOM.pas
  • Source/Recorder/Capturers/Capturers.pas
  • Source/Recorder/Capturers/NTConsole.pas
    .js
  • Source/Recorder/Capturers/NTVDM.pas
  • Source/Recorder/Main.dfm
  • Source/Recorder/Main.pas
  • Source/Recorder/Recorder.bdsproj
  • Source/Recorder/Recorder.dpr
  • Source/Recorder/Recorder.map
  • Source/Recorder/Recorder.res
  • Source/Recorder/RegConfig.pas
  • Source/Recorder/ScreenFormats.pas
  • Source/Recorder/Settings.dfm
  • Source/Recorder/Settings.pas
  • demo.bat
  • font2x4.bin
  • uninst.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/killprocdll.dll
    .dll windows:4 windows x86 arch:x86

    815c88741b87a0210c457b00b57bf9c6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PROGRAM_FILES/Baidu/bar/TempData.KGB
    .dll regsvr32 windows:4 windows x86 arch:x86

    6ccb2c8e98669e1c49478ccdae8356ae


    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/bar/baidubar.dat
  • $PROGRAM_FILES/Baidu/bar/img/imglist.bmp
  • $PROGRAM_FILES/Baidu/bar/img/logo.bmp
  • ºº»¯ËµÃ÷.txt
  • ºº»¯Ïà¹ØÎÊÌâ·´À¡.url
  • 下载说明.htm
    .html .js polyglot
  • 安装说明.txt
  • 非常世纪资源网.url
    .url