Overview

overview

7

Static

static

3

2936bfbbe9...18.exe

windows7-x64

7

2936bfbbe9...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$_12_/GetMusic.exe

windows7-x64

3

$_12_/GetMusic.exe

windows10-2004-x64

3

$_12_/Music.dll

windows7-x64

1

$_12_/Music.dll

windows10-2004-x64

1

$_12_/YQL_...on.dll

windows7-x64

1

$_12_/YQL_...on.dll

windows10-2004-x64

1

$_12_/Yiqi...cs.dll

windows7-x64

1

$_12_/Yiqi...cs.dll

windows10-2004-x64

1

$_12_/Yiqi...cs.exe

windows7-x64

1

$_12_/Yiqi...cs.exe

windows10-2004-x64

1

$_12_/foo_...ns.dll

windows7-x64

1

$_12_/foo_...ns.dll

windows10-2004-x64

1

$_12_/foo_...cs.dll

windows7-x64

1

$_12_/foo_...cs.dll

windows10-2004-x64

1

$_12_/gen_...cs.dll

windows7-x64

1

$_12_/gen_...cs.dll

windows10-2004-x64

1

$_12_/real...cs.dll

windows7-x64

1

$_12_/real...cs.dll

windows10-2004-x64

3

$_12_/vis_...cs.dll

windows7-x64

1

$_12_/vis_...cs.dll

windows10-2004-x64

1

$_12_/һ�...��.url

windows7-x64

1

$_12_/һ�...��.url

windows10-2004-x64

1

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    2936bfbbe9bc3f406d1c79f2d4295834_JaffaCakes118

  • Size

    762KB

  • MD5

    2936bfbbe9bc3f406d1c79f2d4295834

  • SHA1

    c1322e913ed27a74ef12f25ed66e26fc4c0a2998

  • SHA256

    58aa738a44dad8c5220ce031a83e70eed97ed683c7f8b178da1e8fa5b440d1ff

  • SHA512

    94d235554d219a0cfb35db293d460ac290d4b200034a832d9437057657aae00d7c9d2919ee4a162bfca341bdcab47dcd097b6668c248b7923f470cd8727726e1

  • SSDEEP

    12288:TK+05PDq5EjcONMsdDf6S/2Etc2445IwR6t+COXsupn+GTJoQ6T3xY/VwEHQdlig:TK+05csZfCg4gpCEvn4TQwEyiej

Score
3/10

Malware Config

Signatures

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 2936bfbbe9bc3f406d1c79f2d4295834_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/wmp.ini
  • $_12_/GetMusic.exe
    .exe windows:4 windows x86 arch:x86

    9c5253bf396a6fdbe45d3b3b4503a36e


    Headers

    Imports

    Sections

  • $_12_/Music.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1f7e64813c9f66e3c8dc3e05186c96a2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_12_/YQL_Lyrics_Common.dll
    .dll windows:4 windows x86 arch:x86

    27471073d0dd21796973623bf48db1f2


    Headers

    Imports

    Exports

    Sections

  • $_12_/YiqilaiLyrics.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6689c4961407fe0707c909fec8ed62b6


    Headers

    Imports

    Exports

    Sections

  • $_12_/YiqilaiLyrics.exe
    .exe windows:4 windows x86 arch:x86

    be0f99cb10da5e3ec32ccea2e0d1d4a3


    Headers

    Imports

    Sections

  • $_12_/foo_ui_columns.dll
    .dll windows:4 windows x86 arch:x86

    8614f6cc2293be15476eb45d2a28a343


    Headers

    Imports

    Exports

    Sections

  • $_12_/foo_ui_yqllyrics.dll
    .dll windows:4 windows x86 arch:x86

    aab970778d853ea45d574c71e0854924


    Headers

    Imports

    Exports

    Sections

  • $_12_/gen_yqllyrics.dll
    .dll windows:4 windows x86 arch:x86

    c007b95a7d951651413a204d8b52679c


    Headers

    Imports

    Exports

    Sections

  • $_12_/real_vis_yqllyrics.rpv
    .dll windows:4 windows x86 arch:x86

    a6629bc5370aa54eb94c06c6e8aaef24


    Headers

    Imports

    Exports

    Sections

  • $_12_/vis_yqllyrics.dll
    .dll windows:4 windows x86 arch:x86

    ebdeb7575ff77cafd6f6ce32f980d259


    Headers

    Imports

    Exports

    Sections

  • $_12_/һְ.url
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections