General

  • Target

    3690bbf1a454677d5ae2cdeebe4cdc02_JaffaCakes118

  • Size

    18.4MB

  • MD5

    3690bbf1a454677d5ae2cdeebe4cdc02

  • SHA1

    d727b94aa952d4155a3540731eafd2506a8bff1a

  • SHA256

    cf8444a0674456d0ae1181cc93e72a76af5ca053d2520cdd2958b2a945d35a02

  • SHA512

    2d57408e1f3e5de0cec20e029e9536337a2bd1ddb267fb7ed00269607168e422a14db089aea3ec7291081b8f183336521e0af1bfac5710277b99d1af63057556

  • SSDEEP

    393216:3JAG9ZqkvgE5OkqTqI7Zt9WtkuqBJwrDpkmkSY0GpqRDgzgZU:5ikvNYkqW2hcTea6tSdGwtgzgZU

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs

Files

  • 3690bbf1a454677d5ae2cdeebe4cdc02_JaffaCakes118
    .rar
  • qq2007.exe
    .exe windows:4 windows x86 arch:x86

    34070d2f388106597eee704668840d03


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    417fe5089918b0a96f5ad0eb236ed845


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    97c84efb92e9e74c911abc996572ac5e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ModuleList.ini
  • $PLUGINSDIR/MyInstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    3e16e738b751cda6d3d07c6b0b61ddb6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ProcDll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/QQDoctorHelper02.dll
    .dll windows:4 windows x86 arch:x86

    894d96ad60686832ac483728c990fd6b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/QQDownHelper.dll
    .dll windows:4 windows x86 arch:x86

    9894b4b07fe65c88691e62db33e96987


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/QQUIHelper.dll
    .dll windows:4 windows x86 arch:x86

    172baca4f82c2799c74cb61d7d999e1d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SysHelper.dll
    .dll windows:4 windows x86 arch:x86

    36f96a9cf7836d297c9ad956e32e806e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SysVer.dll
    .dll windows:4 windows x86 arch:x86

    d707a64304a6f6ff846dde895b1ae6e4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/VerDll.dll
    .dll windows:4 windows x86 arch:x86

    ef884a06cb2ac4b01896bde30f9a6785


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/ioSpecialW.ini
  • $PLUGINSDIR/ioenv.ini
  • $PLUGINSDIR/iotemp.ini
  • $PLUGINSDIR/licensenew.txt
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $R0
    .dll regsvr32 windows:4 windows x86 arch:x86

    fc343f8df2cc96e204b0497a095bffdd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/msvcp60.dll
    .dll windows:4 windows x86 arch:x86

    a7a98f9c2f55921feb823b6f7e5ce74f


    Headers

    Imports

    Exports

    Sections

  • $_39_/Riched32.dll
    .dll windows:5 windows x86 arch:x86

    a7a197727231042d22b24fc8d3f916fb


    Code Sign

    Headers

    Imports

    Sections

  • $_39_/riched20.dll
    .dll windows:5 windows x86 arch:x86

    b273fadc4482676e5c978e88480e0b9e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Mfc42.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1557eebc6134cee9eb9d0583a2b40341


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QZone/Mfc42.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1557eebc6134cee9eb9d0583a2b40341


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Riched32.dll
    .dll windows:5 windows x86 arch:x86

    a7a197727231042d22b24fc8d3f916fb


    Code Sign

    Headers

    Imports

    Sections

  • Security.dll
    .dll windows:4 windows x86 arch:x86

    768cd33515ce32bf57e4e541b585b212


    Headers

    Imports

    Exports

    Sections

  • atl.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    e03cb90450eb0a29d0e4c0d30cad3943


    Headers

    Imports

    Exports

    Sections

  • riched20.dll
    .dll windows:5 windows x86 arch:x86

    b273fadc4482676e5c978e88480e0b9e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • vbscript.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fb0d686bec70e50106c5a13d0760ef32


    Code Sign

    Headers

    Imports

    Exports

    Sections