General

  • Target

    30aa764e3efb7e234cc694e92d9e495d_JaffaCakes118

  • Size

    1.8MB

  • MD5

    30aa764e3efb7e234cc694e92d9e495d

  • SHA1

    6563914a1b3849e0ff402b176856684ac2a5da1a

  • SHA256

    d6129731391f088c7c219e2cf69fed6d71e769514e29e65c179116feba1d3d8d

  • SHA512

    af55716fc4806902f92b801399a5d520302722d81b6974ca9e6f72f3191947273efe3f1dd841920d04cd8a26a039c49d21756de402eefd18f20ad770aedcdc48

  • SSDEEP

    49152:cW71Kf0tt8SqQsPcrlU+0OXgS2HX7z2q1:zztX6PJFw2HrCq1

Score
3/10

Malware Config

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • 30aa764e3efb7e234cc694e92d9e495d_JaffaCakes118
    .rar
  • TVK.exe
    .exe windows:4 windows x86 arch:x86

    81c812ed76d4690c8678b3a4f0737a5f


    Headers

    Imports

    Sections

  • //uninstall.exe
    .exe windows:4 windows x86 arch:x86

    81c812ed76d4690c8678b3a4f0737a5f


    Headers

    Imports

    Sections

  • /modern-header.bmp
  • /AD_bg.jpg
    .jpg
  • /Ad.htm
    .html .js polyglot
  • /Ad11.htm
    .html .js polyglot
  • /Buffering.gif
    .gif
  • /Buffering.htm
    .html
  • /Buffering.jpg
    .jpg
  • /LoginTV.htm
    .js
  • /Quick.tvk
  • /Splash.jpg
    .jpg
  • /TVDat.dat
  • /WhatsNew.htm
    .html
  • /config.dll
  • /mobilefee.htm
    .html
  • /setup.exe
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/option_big.ini
  • $PLUGINSDIR/option_cn.ini
  • $PLUGINSDIR/option_en.ini
  • $TEMP/modules/$R0
    .dll regsvr32 windows:4 windows x86 arch:x86

    e3856bb100fa908175842f70323fca45


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/modules/addr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    e3856bb100fa908175842f70323fca45


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/modules/auxr.dll
    .dll windows:4 windows x86 arch:x86

    47678825157cd635a4fcc2bed640ea66


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/modules/auxr.exe
    .exe windows:4 windows x86 arch:x86

    d6ea02ddbcfab8f0b9cc8a1fa8516135


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/modules/shell.exe
    .exe windows:4 windows x86 arch:x86

    71f75802017354127962b2eabc8254d4


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/modules/sign.dll
    .dll windows:4 windows x86 arch:x86

    42c095e840a02bdbd17c7caf849a3f19


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/unikeyword/config.dat
  • $TEMP/unikeyword/rscver.dat
  • $TEMP/unikeyword/setup.dat
  • $WINDIR/ocinfo.dat
  • KwData/Resource/default.ini
  • KwData/Resource/default/addrlist.ini
  • KwData/Resource/default/kwinfo.ini
  • KwData/Resource/default/listicon.ico
  • KwData/Resource/default/vistabmp.bmp
  • KwData/Resource/default/xpbmp.bmp
  • KwData/Resource/education.ini
  • KwData/Resource/education/addrlist.ini
  • KwData/Resource/education/kwinfo.ini
  • KwData/Resource/education/listicon.ico
  • KwData/Resource/education/vistabmp.bmp
  • KwData/Resource/education/xpbmp.bmp
  • KwData/Resource/finance.ini
  • KwData/Resource/finance/addrlist.ini
  • KwData/Resource/finance/kwinfo.ini
  • KwData/Resource/finance/listicon.ico
  • KwData/Resource/finance/vistabmp.bmp
  • KwData/Resource/finance/xpbmp.bmp
  • KwData/Resource/fun.ini
  • KwData/Resource/fun/addrlist.ini
  • KwData/Resource/fun/kwinfo.ini
  • KwData/Resource/news.ini
  • KwData/Resource/news/addrlist.ini
  • KwData/Resource/news/kwinfo.ini
  • KwData/Resource/user.ini
  • KwData/rscver.dat
  • kwhkcu_big.reg
  • kwhkcu_cn.reg
  • kwhkcu_en.reg
  • kwhklm_big.reg
  • kwhklm_cn.reg
  • kwhklm_en.reg
  • stcr.dat
  • ukwrbtn.html
    .html .js polyglot
  • url.ico
  • version.dat
  • /skins/ɫ.dll
  • /skins/XP.dll
  • /skins/δ.dll
  • /tvk.dat
  • /unicomreg.htm
    .html .js polyglot
  • /welcome.htm
    .html
  • /wmp11_bg.jpg
    .jpg
  • /ɽ$(LSTR_6014)url
    .url
  • /ɽ.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • /InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    7ca439f240520f2b3eaee86b88d31ab2


    Headers

    Imports

    Exports

    Sections

  • /ioSpecial.ini
  • /modern-header.bmp
  • /modern-wizard.bmp
  • $_4612_/PSNetwork.dll
    .dll windows:4 windows x86 arch:x86

    3be0b942a870bf0ace51981889d053d3


    Headers

    Imports

    Exports

    Sections

  • $_4612_/PowerPlayer.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f43e3dfe6894cb729a259eaa180c0c3b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $_4741_/AcIERHelper.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c34726458e2d510191df00cf8113f917


    Headers

    Imports

    Exports

    Sections

  • 新云软件.url
    .url