General

  • Target

    2a6bb21c0b4f0dbd3c48431d90c05cd2_JaffaCakes118

  • Size

    1.9MB

  • MD5

    2a6bb21c0b4f0dbd3c48431d90c05cd2

  • SHA1

    b5ab2ca26e31b88c477b73333bad6f3436789773

  • SHA256

    6f45d5345b55a0519c06966a70b8163fe2a1ff1508369c7db1dcdf0c69a93258

  • SHA512

    1027b26729c1ec843e5eff158854a72cb6abf0f86f81ff0176eaaa3a5d6841945e223adb8894e325d735e866e344e2c3cc5ee8eb2c33b06623d077179caf9f2b

  • SSDEEP

    49152:WFSfwQsavHYzCo2c2scPhH9N03c6iaaLVM/BSeOnN890M:3fvHYzCReELG3cz/YB9Oa90M

Score
3/10

Malware Config

Signatures

  • Unsigned PE 19 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 2a6bb21c0b4f0dbd3c48431d90c05cd2_JaffaCakes118
    .rar
  • bdfw-v9.7.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    295fc8c35dee88b924b0f6bafc807c6c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    295fc8c35dee88b924b0f6bafc807c6c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • bdfw.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • bdfwsvc.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • bin/DSignRemove.exe
    .exe windows:4 windows x86 arch:x86

    8c22c14a4564e7ab1082b733d9a64235


    Headers

    Imports

    Sections

  • bin/efwinstall.exe
    .exe windows:5 windows x86 arch:x86

    42333f0c9a25e176038c934a8d62661e


    Headers

    Imports

    Sections

  • config/unicode.map
  • driver/2k/bdwrap2k.inf
  • driver/2k/bdwrap2k_m.inf
  • driver/2k/enetfilt2k.sys
    .sys windows:5 windows x86 arch:x86

    f45440b92c92d461d027c85373e2e6fd


    Headers

    Imports

    Sections

  • driver/xp/bdwrap.inf
  • driver/xp/bdwrap_m.inf
  • driver/xp/enetfilt.sys
    .sys windows:5 windows x86 arch:x86

    29b3591d968293a34571d1be2e6b74e9


    Headers

    Imports

    Sections

  • easydb.dll
    .dll windows:4 windows x86 arch:x86

    65238d542ed63889203e85026185205d


    Headers

    Imports

    Exports

    Sections

  • easyskin.dat
  • easyskin.dll
    .dll windows:4 windows x86 arch:x86

    aa92e17cb8d921734defd7ad71332948


    Headers

    Imports

    Exports

    Sections

  • fwconf.dat
  • lang/bdfwchs.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • libcurl.dll
    .dll windows:4 windows x86 arch:x86

    80f4d520a8db2b21744b76b5ea02b06b


    Headers

    Imports

    Exports

    Sections

  • psapi.dll
    .dll windows:4 windows x86 arch:x86

    3b5b4bad881057af15fc35648ebcf206


    Headers

    Imports

    Exports

    Sections

  • readme.txt
  • restart.bat
  • sysconf.dat
  • 新云软件.url
    .url