Overview

overview

7

Static

static

3

360AntiArp.exe

windows7-x64

7

360AntiArp.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/Dr...RP.sys

windows7-x64

1

$SYSDIR/Dr...RP.sys

windows10-2004-x64

1

$SYSDIR/Dr...rv.sys

windows7-x64

1

$SYSDIR/Dr...rv.sys

windows10-2004-x64

1

$SYSDIR/ProtoDrv.sys

windows7-x64

1

$SYSDIR/ProtoDrv.sys

windows10-2004-x64

1

AntiArp.exe

windows7-x64

1

AntiArp.exe

windows10-2004-x64

1

ProtoDrv.sys

windows7-x64

1

ProtoDrv.sys

windows10-2004-x64

1

antiarp.exe

windows7-x64

1

antiarp.exe

windows10-2004-x64

1

snetcfg.exe

windows7-x64

1

snetcfg.exe

windows10-2004-x64

1

新云软件.url

windows7-x64

1

新云软件.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2cbe4df08db76cb5465e4e40d9901af1_JaffaCakes118

  • Size

    172KB

  • MD5

    2cbe4df08db76cb5465e4e40d9901af1

  • SHA1

    635baa016b3797557bf7fd6ba726a3701dbec745

  • SHA256

    94ff3c562d33d3c39c67ee3bd9b2bfcf7e53924e84724a7849bff7981e728205

  • SHA512

    52f685458f3a0e95c9a3681e819ce883e89e537dc46fda2a057a02f188628b6a1f609569da75d82ee9571e76e89b9956340200cd1e93b246de1555cebff6babc

  • SSDEEP

    3072:yOeFT0j6aPpi+xRYxy9fByjZtuCAu+dhmKKjZsFP/D7jp81o29Scp7Jx4nPuOK:yOeijhOjZtDAu+dhmVjZsR7BYbuq

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs
    installer

Files

  • 2cbe4df08db76cb5465e4e40d9901af1_JaffaCakes118
    .rar
  • 360AntiArp.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/Drivers/360AntiARP.sys
    .sys windows:5 windows x86 arch:x86

    3805893089da7f37a8f0c93e909591cb


    Headers

    Imports

    Sections

  • $SYSDIR/Drivers/ProtoDrv.sys
    .sys windows:4 windows x86 arch:x86

    3e6c88a49d7b6ada4414329102831fd8


    Headers

    Imports

    Sections

  • $SYSDIR/ProtoDrv.sys
    .sys windows:4 windows x86 arch:x86

    3e6c88a49d7b6ada4414329102831fd8


    Headers

    Imports

    Sections

  • AntiArp.exe
    .exe windows:4 windows x86 arch:x86

    558a24127fd347f3004437d42af6f9bb


    Headers

    Imports

    Sections

  • ProtoDrv.sys
    .sys windows:4 windows x86 arch:x86

    3e6c88a49d7b6ada4414329102831fd8


    Headers

    Imports

    Sections

  • antiarp.exe.tmp
    .exe windows:4 windows x86 arch:x86

    558a24127fd347f3004437d42af6f9bb


    Headers

    Imports

    Sections

  • fixedwl.dat
  • packet.inf
  • snetcfg.exe
    .exe windows:5 windows x86 arch:x86

    a2f3b8ca9ae0d2c1e4c3bb2f0ce14718


    Headers

    Imports

    Sections

  • 新云软件.url
    .url