147d616eefea9160667645b5f6b3d95a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

147d616eefea9160667645b5f6b3d95a_JaffaCakes118
Size

510KB
MD5

147d616eefea9160667645b5f6b3d95a
SHA1

66ffb4ddc812560a5e199151f1da241b93e30762
SHA256

ee49a0cc3bf3dee1957ea2313f05e80c005e5e81acb23903e4370c76a2a6636e
SHA512

494a7d0fcf3797282af6c935517baf0b11f3a183d4b0cc7fdec850fb226b13862997b7aa6cac349e572ef4427b856678c0a2cf12dbacb376c0c3a06cfca77135
SSDEEP

12288:KLZMluXfMZNF2efEtIcVGUfiTzYvnszlgJgnHWs52JR4yRb2ysI3:EGluvMPpEl0WiTUUhcI2s6KyR9sI3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/kuyiso/include/Jmail/jmail.dll

Files

147d616eefea9160667645b5f6b3d95a_JaffaCakes118
.rar
kuyiso/Admin/ADelInfo.asp
.vbs
kuyiso/Admin/APwdModifly.asp
kuyiso/Admin/APwdModiflyEnd.asp
.vbs
kuyiso/Admin/AddBigArea.asp
.vbs
kuyiso/Admin/AddBigClass.asp
.vbs
kuyiso/Admin/AddSmallArea.asp
.vbs
kuyiso/Admin/AddSmallClass.asp
.vbs
kuyiso/Admin/DelBigArea.asp
.vbs
kuyiso/Admin/DelBigClass.asp
.vbs
kuyiso/Admin/DelSmallArea.asp
.vbs
kuyiso/Admin/DelSmallClass.asp
.vbs
kuyiso/Admin/DelUser.asp
.vbs
kuyiso/Admin/InfoBest.asp
.vbs
kuyiso/Admin/InfoShenHe.asp
.vbs
kuyiso/Admin/InfoTop.asp
.vbs
kuyiso/Admin/ManageBigArea.asp
.vbs
kuyiso/Admin/ManageBigClass.asp
.vbs
kuyiso/Admin/ManageInfoP.asp
.vbs
kuyiso/Admin/ManageSmallArea.asp
.vbs
kuyiso/Admin/ManageSmallClass.asp
.vbs
kuyiso/Admin/ManageUser.asp
.vbs
kuyiso/Admin/ModiflyBigArea.asp
.vbs
kuyiso/Admin/ModiflyBigClass.asp
.vbs
kuyiso/Admin/ModiflySmallArea.asp
.vbs
kuyiso/Admin/ModiflySmallAreaEnd.asp
.vbs
kuyiso/Admin/ModiflySmallClass.asp
.vbs
kuyiso/Admin/ModiflySmallClassEnd.asp
.vbs
kuyiso/Admin/ModiflyTuiJie.asp
.vbs
kuyiso/Admin/ModiflyTuiJieEnd.asp
.vbs
kuyiso/Admin/ModiflyUser.asp
.js
kuyiso/Admin/ModiflyUserEnd.asp
.vbs
kuyiso/Admin/ModiflybigAreaEnd.asp
.vbs
kuyiso/Admin/ModiflybigClassEnd.asp
.vbs
kuyiso/Admin/Template/index.htm
.html
kuyiso/Admin/exit.asp
.html
kuyiso/Admin/function.asp
kuyiso/Admin/index.asp
kuyiso/Admin/login_end.asp
.vbs
kuyiso/Admin/main.asp
.html
kuyiso/Admin/mainleft.asp
kuyiso/Admin/make_index_page.asp
.vbs
kuyiso/Admin/makehtml.asp
.html
kuyiso/DbLib/dbconection.asp
.vbs
kuyiso/DbLib/dbconection1.asp
.vbs
kuyiso/Info/AddInfoEnd.asp
.vbs
kuyiso/Info/AddInfoGbook.asp
.vbs
kuyiso/Info/AllInfo.asp
.vbs
kuyiso/Info/InfoView.asp
.vbs
kuyiso/Info/ListInfo_c_s.asp
.vbs
kuyiso/Info/ListInfo_c_s_a.asp
.vbs
kuyiso/Info/ListInfo_c_s_a_j.asp
.vbs
kuyiso/Info/TjInfo.asp
.vbs
kuyiso/Info/UploadImages/200512282329070.jpg
.jpg
kuyiso/Info/UploadImages/200512282329240.jpg
.jpg
kuyiso/Info/UploadImages/200512282330030.jpg
.jpg
kuyiso/Info/UploadImages/200512282330280.jpg
.jpg
kuyiso/Info/UploadImages/200512282330380.jpg
.jpg
kuyiso/Info/UploadImages/200512282331510.jpg
.jpg
kuyiso/Info/UploadImages/200512282332130.jpg
.jpg
kuyiso/Info/UploadImages/200512282334210.jpg
.jpg
kuyiso/Info/UploadImages/200512282334310.jpg
.jpg
kuyiso/Info/UploadImages/200512282336230.jpg
.jpg
kuyiso/Info/UploadImages/200512282336410.jpg
.jpg
kuyiso/Info/UploadImages/200512282341500.jpg
.jpg
kuyiso/Info/UploadImages/200512282343520.jpg
.jpg
kuyiso/Info/UploadImages/200512282350370.jpg
.jpg
kuyiso/Info/UploadImages/200512282350450.jpg
.jpg
kuyiso/Info/UploadImages/200512282354310.jpg
.jpg
kuyiso/Info/pic/Search.gif
.gif
kuyiso/Info/pic/Shockwave.gif
.gif
kuyiso/Info/pic/code.gif
.gif
kuyiso/Info/pic/delete.gif
.gif
kuyiso/Info/pic/dot.gif
.gif
kuyiso/Info/pic/down.gif
.gif
kuyiso/Info/pic/em01.gif
.gif
kuyiso/Info/pic/em02.gif
.gif
kuyiso/Info/pic/em03.gif
.gif
kuyiso/Info/pic/em04.gif
.gif
kuyiso/Info/pic/em05.gif
.gif
kuyiso/Info/pic/em06.gif
.gif
kuyiso/Info/pic/em07.gif
.gif
kuyiso/Info/pic/em08.gif
.gif
kuyiso/Info/pic/em09.gif
.gif
kuyiso/Info/pic/em10.gif
.gif
kuyiso/Info/pic/em11.gif
.gif
kuyiso/Info/pic/em12.gif
.gif
kuyiso/Info/pic/em13.gif
.gif
kuyiso/Info/pic/em14.gif
.gif
kuyiso/Info/pic/em15.gif
.gif
kuyiso/Info/pic/em16.gif
.gif
kuyiso/Info/pic/em17.gif
.gif
kuyiso/Info/pic/em18.gif
.gif
kuyiso/Info/pic/em19.gif
.gif
kuyiso/Info/pic/em20.gif
.gif
kuyiso/Info/pic/em21.gif
.gif
kuyiso/Info/pic/em22.gif
.gif
kuyiso/Info/pic/em23.gif
.gif
kuyiso/Info/pic/em24.gif
.gif
kuyiso/Info/pic/em25.gif
.gif
kuyiso/Info/pic/em26.gif
.gif
kuyiso/Info/pic/em27.gif
.gif
kuyiso/Info/pic/em28.gif
.gif
kuyiso/Info/pic/email.gif
.gif
kuyiso/Info/pic/fav.gif
.gif
kuyiso/Info/pic/find.gif
.gif
kuyiso/Info/pic/fly.gif
.gif
kuyiso/Info/pic/folder.gif
.gif
kuyiso/Info/pic/glow.gif
.gif
kuyiso/Info/pic/go.gif
.gif
kuyiso/Info/pic/gotop.gif
.gif
kuyiso/Info/pic/hotfolder.gif
.gif
kuyiso/Info/pic/icon_editor_bold.gif
.gif
kuyiso/Info/pic/icon_editor_center.gif
.gif
kuyiso/Info/pic/icon_editor_code.gif
.gif
kuyiso/Info/pic/icon_editor_email.gif
.gif
kuyiso/Info/pic/icon_editor_image.gif
.gif
kuyiso/Info/pic/icon_editor_italicize.gif
.gif
kuyiso/Info/pic/icon_editor_list.gif
.gif
kuyiso/Info/pic/icon_editor_quote.gif
.gif
kuyiso/Info/pic/icon_editor_underline.gif
.gif
kuyiso/Info/pic/icon_editor_url.gif
.gif
kuyiso/Info/pic/ifolder.gif
.gif
kuyiso/Info/pic/inboxnonew.gif
.gif
kuyiso/Info/pic/ip.gif
.gif
kuyiso/Info/pic/isbest.gif
.gif
kuyiso/Info/pic/istop.gif
.gif
kuyiso/Info/pic/isvote.gif
.gif
kuyiso/Info/pic/jing.gif
.gif
kuyiso/Info/pic/lastpost.gif
.gif
kuyiso/Info/pic/main.gif
.gif
kuyiso/Info/pic/middle.gif
.gif
kuyiso/Info/pic/move.gif
.gif
kuyiso/Info/pic/mp.gif
.gif
kuyiso/Info/pic/newreply.gif
.gif
kuyiso/Info/pic/newtopic.gif
.gif
kuyiso/Info/pic/post.gif
.gif
kuyiso/Info/pic/profile.gif
.gif
kuyiso/Info/pic/qt.gif
.gif
kuyiso/Info/pic/reply_a.gif
.gif
kuyiso/Info/pic/rm.gif
.gif
kuyiso/Info/pic/shadow.gif
.gif
kuyiso/Info/pic/shareforum.gif
.gif
kuyiso/Info/pic/swf.gif
.gif
kuyiso/Info/pic/team2.gif
.gif
kuyiso/Info/pic/top1.gif
.gif
kuyiso/Info/pic/userlist1.gif
.gif
kuyiso/Info/postad.asp
.vbs
kuyiso/Info/postad2.asp
.vbs
kuyiso/Info/postad3.asp
.vbs
kuyiso/Info/postad4.asp
.js
kuyiso/Info/preview.asp
kuyiso/Info/search.asp
.vbs
kuyiso/Info/upfile.asp
.vbs
kuyiso/Info/upload_pic.asp
.html
kuyiso/User/DelInfo.asp
.vbs
kuyiso/User/Login.asp
.js
kuyiso/User/LoginEnd.asp
.vbs
kuyiso/User/ModiflyInfo.asp
.js
kuyiso/User/ModiflyInfoEnd.asp
.vbs
kuyiso/User/ModiflyUser.asp
.vbs
kuyiso/User/ModiflyUserEnd.asp
.vbs
kuyiso/User/MyInfo.asp
kuyiso/User/MyInfoList.asp
.vbs
kuyiso/User/RePubInfo.asp
.vbs
kuyiso/User/RegisterEnd.asp
.vbs
kuyiso/User/exit.asp
kuyiso/User/getpass.asp
.vbs
kuyiso/User/getpass.htm
.html .js polyglot
kuyiso/User/reg.htm
.html .js polyglot
kuyiso/data/businessdatav3.asp
kuyiso/help/cp.htm
.html
kuyiso/help/help.htm
.html
kuyiso/help/hg.htm
.html
kuyiso/help/index.htm
.html
kuyiso/help/jm.htm
.html
kuyiso/help/lx.htm
.html
kuyiso/help/tk.htm
.html
kuyiso/help/ys.htm
.html
kuyiso/images/dot24.gif
.gif
kuyiso/images/idpw_line.gif
.gif
kuyiso/images/logo.bmp
.gif
kuyiso/images/logo.gif
.gif
kuyiso/images/logo.jpg
.gif
kuyiso/images/ms_er.gif
.gif
kuyiso/images/qq_er.gif
.gif
kuyiso/images/tel_er.gif
.gif
kuyiso/include/CHAR.asp
.vbs
kuyiso/include/CODE.asp
.html .js polyglot
kuyiso/include/CopyRight.inc
kuyiso/include/HTML.INC
.vbs
kuyiso/include/IncAdminLogin.asp
kuyiso/include/IncLogin.asp
kuyiso/include/Jmail/jmail.dll
.dll regsvr32 windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
__JafModInfo

Sections

CODE
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 185B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
kuyiso/include/Jmail/setup.bat
kuyiso/include/getubb.asp
kuyiso/include/licky_fsql.asp
.vbs
kuyiso/include/md5.asp
.vbs
kuyiso/include/ubbcode.asp
.vbs
kuyiso/include/ubbcode.js
.js
kuyiso/include/upload_5xsoft.inc
.html .vbs polyglot
kuyiso/include/validate.js
.js
kuyiso/index.htm
.html
kuyiso/public/foot.htm
.html
kuyiso/public/head.htm
.html
kuyiso/public/style.css
kuyiso/新云软件.url
.url
kuyiso/说明.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 221KB - Virtual size: 221KB

DATA Size: 2KB - Virtual size: 2KB

BSS Size: - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.edata Size: 512B - Virtual size: 185B

.reloc Size: 15KB - Virtual size: 15KB

.rsrc Size: 52KB - Virtual size: 52KB

CODE
Size: 221KB - Virtual size: 221KB

DATA
Size: 2KB - Virtual size: 2KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 185B

.reloc
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 52KB - Virtual size: 52KB