Overview

overview

7

Static

static

7

飘零网�...LL.exe

windows7-x64

1

飘零网�...LL.exe

windows10-2004-x64

1

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$SYSDIR/PE...on.dll

windows7-x64

1

$SYSDIR/PE...on.dll

windows10-2004-x64

1

$SYSDIR/PE...le.dll

windows7-x64

1

$SYSDIR/PE...le.dll

windows10-2004-x64

1

$SYSDIR/PE_Common.dll

windows7-x64

1

$SYSDIR/PE_Common.dll

windows10-2004-x64

1

$SYSDIR/PE...nt.dll

windows7-x64

1

$SYSDIR/PE...nt.dll

windows10-2004-x64

1

$SYSDIR/PE...ok.dll

windows7-x64

1

$SYSDIR/PE...ok.dll

windows10-2004-x64

1

$SYSDIR/PE_Photo.dll

windows7-x64

1

$SYSDIR/PE_Photo.dll

windows10-2004-x64

1

$SYSDIR/PE_Shop.dll

windows7-x64

1

$SYSDIR/PE_Shop.dll

windows10-2004-x64

1

$SYSDIR/PE_Soft.dll

windows7-x64

1

$SYSDIR/PE_Soft.dll

windows10-2004-x64

1

$SYSDIR/PE_Upload.dll

windows7-x64

1

$SYSDIR/PE_Upload.dll

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

飘零网�...ct.asp

windows7-x64

3

飘零网�...ct.asp

windows10-2004-x64

3

飘零网�...ce.vbs

windows7-x64

1

飘零网�...ce.vbs

windows10-2004-x64

1

飘零网�...ig.asp

windows7-x64

3

飘零网�...ig.asp

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    35a2b3d12c9a029b86c8d9b057b52cd7_JaffaCakes118

  • Size

    20.0MB

  • MD5

    35a2b3d12c9a029b86c8d9b057b52cd7

  • SHA1

    de7d53b483b1142e86ec82b678b640fe80fec4ff

  • SHA256

    9c79d854f3398e099d51945df1c3528d0fa771e1ab686007ad52d11cea3cb477

  • SHA512

    919cc679ad5b9ffb7fdf05dee27f896e1911516e003703e37143cfb51a2193161033fdcc402704cf1c78fbeb79dc09ecf57ba38f2337ce69df6f99214a5c4d97

  • SSDEEP

    393216:/wR5ARDPrih4Yfu4yZNzfI8VV8YGnunBHgTz0jCxDrRsuLkYpTHxBM:McDjih4E4fI8z8YOunxgTrp1tc

Score
7/10
aspackv2upx

Malware Config

Signatures

  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 35a2b3d12c9a029b86c8d9b057b52cd7_JaffaCakes118
    .rar
  • 飘零网络传媒 v2005x Bate1/DW标签插件/PowerEasyTag_Free.mxp
  • 飘零网络传媒 v2005x Bate1/DW标签插件/动易DW标签插件1.2.0.txt
  • 飘零网络传媒 v2005x Bate1/PE2005_DLL.exe
    .exe windows:4 windows x86 arch:x86

    1433f2e02f7db60c6c8547c52a3f8504


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    1f4c4faa2a5228733f7ee5edf40f6693


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    0a429a757fe850cda370ca04651f8539


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/PE_AdminCommon.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Article.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Common.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Equipment.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_GuestBook.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Photo.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Shop.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Soft.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $SYSDIR/PE_Upload.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    1433f2e02f7db60c6c8547c52a3f8504


    Headers

    Imports

    Sections

  • 飘零网络传媒 v2005x Bate1/下载说明.htm
    .html .js polyglot
  • 飘零网络传媒 v2005x Bate1/动易系统探针程序/PE_detect.asp
    .asp .vbs polyglot
  • 飘零网络传媒 v2005x Bate1/动易系统探针程序/使用说明.txt
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/Interface.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/inc/UPIConfig.asp
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/login.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/logout.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/lostpass.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/modifypsw.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.0/reg.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/Interface.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/inc/UPIConfig.asp
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/login.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/logout.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/lostpass.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/modifyadd.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/Dvbbs7.1/reg.asp
    .vbs
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/整合专用用户资料同步程序/UserSynchro/Style.css
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/整合专用用户资料同步程序/UserSynchro/UserSynchro.asp
    .asp .vbs polyglot
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/整合专用用户资料同步程序/UserSynchro/checkupdate.gif
    .gif
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/整合专用用户资料同步程序/UserSynchro/logo.gif
    .gif
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/整合专用用户资料同步程序/操作说明.txt
  • 飘零网络传媒 v2005x Bate1/论坛整合程序/整合说明.txt
  • 飘零网络传媒 v2005x Bate1/飘零网络传媒BATE1.EXE
    .exe windows:4 windows x86 arch:x86

    e41c25ab7824b3df73334188c40518ae


    Headers

    Imports

    Exports

    Sections