Overview

overview

3

Static

static

3

35v2.0/AC/datas.asp

windows7-x64

3

35v2.0/AC/datas.asp

windows10-2004-x64

3

35v2.0/adm...add.js

windows7-x64

3

35v2.0/adm...add.js

windows10-2004-x64

3

35v2.0/adm...ds.vbs

windows7-x64

1

35v2.0/adm...ds.vbs

windows10-2004-x64

1

35v2.0/adm...ig.vbs

windows7-x64

1

35v2.0/adm...ig.vbs

windows10-2004-x64

1

35v2.0/adm...g1.vbs

windows7-x64

1

35v2.0/adm...g1.vbs

windows10-2004-x64

1

35v2.0/adm...ex.vbs

windows7-x64

1

35v2.0/adm...ex.vbs

windows10-2004-x64

1

35v2.0/adm...nk.vbs

windows7-x64

1

35v2.0/adm...nk.vbs

windows10-2004-x64

1

35v2.0/adm...st.vbs

windows7-x64

1

35v2.0/adm...st.vbs

windows10-2004-x64

1

35v2.0/adm...mb.vbs

windows7-x64

1

35v2.0/adm...mb.vbs

windows10-2004-x64

1

35v2.0/adm..._p.vbs

windows7-x64

1

35v2.0/adm..._p.vbs

windows10-2004-x64

1

35v2.0/adm...pl.vbs

windows7-x64

1

35v2.0/adm...pl.vbs

windows10-2004-x64

1

35v2.0/adm...re.vbs

windows7-x64

1

35v2.0/adm...re.vbs

windows10-2004-x64

1

35v2.0/adm...ch.vbs

windows7-x64

1

35v2.0/adm...ch.vbs

windows10-2004-x64

1

35v2.0/adm...pe.vbs

windows7-x64

1

35v2.0/adm...pe.vbs

windows10-2004-x64

1

35v2.0/adm...er.vbs

windows7-x64

1

35v2.0/adm...er.vbs

windows10-2004-x64

1

35v2.0/admin/agan.vbs

windows7-x64

1

35v2.0/admin/agan.vbs

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    35f1382df652f88b069eef8bb37a7553_JaffaCakes118

  • Size

    1.8MB

  • MD5

    35f1382df652f88b069eef8bb37a7553

  • SHA1

    6b297baee88b07b4aacdcbf34b3fa45d00e2a316

  • SHA256

    1171c61edd61bd5c0a1fbdee0d2797c2f72f25c5fa23bd497490a2dac8959fcf

  • SHA512

    eda6e69cf1be9541a4f71bf06b1af3a52986d61743629ada6daf8d3db8c621e1eba3cb5723690f846a2fffcd4afd197cdc4880afefd76262121504a453f27177

  • SSDEEP

    49152:QOBkoJ2uia7/aViVeWvhID9jcsqLDUoBIjNnKZJCKki:vyPuia7/aViA9l7qLTdZJCC

Score
3/10

Malware Config

Signatures

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 35f1382df652f88b069eef8bb37a7553_JaffaCakes118
    .rar
  • 35v2.0/AC/datas.asp
  • 35v2.0/admin/admin.css
  • 35v2.0/admin/admin_add.asp
    .js
  • 35v2.0/admin/admin_ads.asp
    .vbs
  • 35v2.0/admin/admin_config.asp
    .vbs
  • 35v2.0/admin/admin_config1.asp
    .vbs
  • 35v2.0/admin/admin_index.asp
    .vbs
  • 35v2.0/admin/admin_link.asp
    .vbs
  • 35v2.0/admin/admin_list.asp
    .vbs
  • 35v2.0/admin/admin_mb.asp
    .vbs
  • 35v2.0/admin/admin_p.asp
    .vbs
  • 35v2.0/admin/admin_pl.asp
    .vbs
  • 35v2.0/admin/admin_re.asp
    .vbs
  • 35v2.0/admin/admin_search.asp
    .vbs
  • 35v2.0/admin/admin_type.asp
    .vbs
  • 35v2.0/admin/admin_webmaster.asp
    .vbs
  • 35v2.0/admin/agan.asp
    .vbs
  • 35v2.0/admin/check.asp
    .vbs
  • 35v2.0/admin/conn.asp
  • 35v2.0/admin/deleoff.ASP
  • 35v2.0/admin/edit.htm
    .html .js polyglot
  • 35v2.0/admin/eoff.ASP
    .vbs
  • 35v2.0/admin/images/Thumbs.db
  • 35v2.0/admin/images/bb_alipay.gif
    .gif
  • 35v2.0/admin/images/bb_bold.gif
    .gif
  • 35v2.0/admin/images/bb_center.gif
    .gif
  • 35v2.0/admin/images/bb_clear.gif
    .gif
  • 35v2.0/admin/images/bb_code.gif
    .gif
  • 35v2.0/admin/images/bb_color.gif
    .gif
  • 35v2.0/admin/images/bb_contract.gif
    .gif
  • 35v2.0/admin/images/bb_email.gif
    .gif
  • 35v2.0/admin/images/bb_expand.gif
    .gif
  • 35v2.0/admin/images/bb_flash.gif
    .gif
  • 35v2.0/admin/images/bb_image.gif
    .gif
  • 35v2.0/admin/images/bb_indent.gif
    .gif
  • 35v2.0/admin/images/bb_italic.gif
    .gif
  • 35v2.0/admin/images/bb_left.gif
    .gif
  • 35v2.0/admin/images/bb_look.gif
    .gif
  • 35v2.0/admin/images/bb_menupop.gif
    .gif
  • 35v2.0/admin/images/bb_orderedlist.gif
    .gif
  • 35v2.0/admin/images/bb_outdent.gif
    .gif
  • 35v2.0/admin/images/bb_qq.gif
    .gif
  • 35v2.0/admin/images/bb_quote.gif
    .gif
  • 35v2.0/admin/images/bb_redo.gif
    .gif
  • 35v2.0/admin/images/bb_removeformat.gif
    .gif
  • 35v2.0/admin/images/bb_right.gif
    .gif
  • 35v2.0/admin/images/bb_rm.gif
    .gif
  • 35v2.0/admin/images/bb_separator.gif
    .gif
  • 35v2.0/admin/images/bb_table.gif
    .gif
  • 35v2.0/admin/images/bb_underline.gif
    .gif
  • 35v2.0/admin/images/bb_undo.gif
    .gif
  • 35v2.0/admin/images/bb_unlink.gif
    .gif
  • 35v2.0/admin/images/bb_unorderedlist.gif
    .gif
  • 35v2.0/admin/images/bb_url.gif
    .gif
  • 35v2.0/admin/images/bb_wmv.gif
    .gif
  • 35v2.0/admin/images/bbcode.js
    .js
  • 35v2.0/admin/images/common.Js
    .js
  • 35v2.0/admin/images/credits.gif
    .gif
  • 35v2.0/admin/images/editor.js
    .js
  • 35v2.0/admin/images/manage/1.gif
    .gif
  • 35v2.0/admin/images/manage/2.gif
    .gif
  • 35v2.0/admin/images/manage/EMAIL.GIF
    .gif
  • 35v2.0/admin/images/manage/GOTO.GIF
    .gif
  • 35v2.0/admin/images/manage/HOMEPAGE.GIF
    .gif
  • 35v2.0/admin/images/manage/Thumbs.db
  • 35v2.0/admin/images/manage/admin_bg.gif
    .gif
  • 35v2.0/admin/images/manage/admin_bg_1.gif
    .gif
  • 35v2.0/admin/images/manage/admin_left_1.gif
    .gif
  • 35v2.0/admin/images/manage/admin_left_2.gif
    .gif
  • 35v2.0/admin/images/manage/admin_title.gif
    .gif
  • 35v2.0/admin/images/manage/bar.gif
    .gif
  • 35v2.0/admin/images/manage/bar9.gif
    .gif
  • 35v2.0/admin/images/manage/bbk.gif
    .gif
  • 35v2.0/admin/images/manage/bbk_main.gif
    .gif
  • 35v2.0/admin/images/manage/bullet.gif
    .gif
  • 35v2.0/admin/images/manage/close.gif
  • 35v2.0/admin/images/manage/color.js
    .js
  • 35v2.0/admin/images/manage/html_no.gif
    .gif
  • 35v2.0/admin/images/manage/html_ok.gif
    .gif
  • 35v2.0/admin/images/manage/key.gif
    .gif
  • 35v2.0/admin/images/manage/minus.gif
    .gif
  • 35v2.0/admin/images/manage/name.gif
    .gif
  • 35v2.0/admin/images/manage/plus.gif
    .gif
  • 35v2.0/admin/images/manage/title_bg_hide.gif
    .gif
  • 35v2.0/admin/images/manage/title_bg_quit.gif
    .gif
  • 35v2.0/admin/images/manage/title_bg_show.gif
    .gif
  • 35v2.0/admin/images/menu.js
    .js
  • 35v2.0/admin/images/ubb.css
  • 35v2.0/admin/index.asp
  • 35v2.0/admin/login.asp
    .vbs
  • 35v2.0/admin/make.asp
    .vbs
  • 35v2.0/admin/make_index.asp
    .vbs
  • 35v2.0/admin/make_map.asp
    .vbs
  • 35v2.0/admin/make_play.asp
    .vbs
  • 35v2.0/admin/make_type.asp
    .vbs
  • 35v2.0/admin/make_view.asp
    .vbs
  • 35v2.0/admin/make_view_play.asp
    .vbs
  • 35v2.0/admin/md5.asp
    .vbs
  • 35v2.0/admin/mysql.asp
    .vbs
  • 35v2.0/admin/serverinfo.asp
    .asp .vbs polyglot
  • 35v2.0/admin/tool_resources.asp
    .vbs
  • 35v2.0/admin/tool_ztpic.asp
    .vbs
  • 35v2.0/admin/ubb.asp
  • 35v2.0/admin/up/upload.asp
    .asp .vbs polyglot
  • 35v2.0/admin/up/upload.htm
  • 35v2.0/admin/up/upsave.inc
    .vbs
  • 35v2.0/allmovie.asp
  • 35v2.0/comment.asp
    .vbs
  • 35v2.0/foot.asp
  • 35v2.0/gb.asp
    .js
  • 35v2.0/head.asp
  • 35v2.0/images/Thumbs.db
  • 35v2.0/images/bg.gif
    .gif
  • 35v2.0/images/bg2.gif
    .gif
  • 35v2.0/images/bul.gif
    .gif
  • 35v2.0/images/exe.gif
    .gif
  • 35v2.0/images/faces/1.gif
    .gif
  • 35v2.0/images/faces/10.gif
    .gif
  • 35v2.0/images/faces/11.gif
    .gif
  • 35v2.0/images/faces/12.gif
    .gif
  • 35v2.0/images/faces/13.gif
    .gif
  • 35v2.0/images/faces/14.gif
    .gif
  • 35v2.0/images/faces/15.gif
    .gif
  • 35v2.0/images/faces/16.gif
    .gif
  • 35v2.0/images/faces/17.gif
    .gif
  • 35v2.0/images/faces/2.gif
    .gif
  • 35v2.0/images/faces/3.gif
    .gif
  • 35v2.0/images/faces/4.gif
    .gif
  • 35v2.0/images/faces/5.gif
    .gif
  • 35v2.0/images/faces/6.gif
    .gif
  • 35v2.0/images/faces/7.gif
    .gif
  • 35v2.0/images/faces/8.gif
    .gif
  • 35v2.0/images/faces/9.gif
    .gif
  • 35v2.0/images/faces/Thumbs.db
  • 35v2.0/images/hot.gif
    .gif
  • 35v2.0/images/hot/0.jpg
    .jpg
  • 35v2.0/images/hot/1.jpg
    .jpg
  • 35v2.0/images/hot/2.jpg
    .jpg
  • 35v2.0/images/hot/3.jpg
    .jpg
  • 35v2.0/images/hot/4.jpg
    .jpg
  • 35v2.0/images/hot/Thumbs.db
  • 35v2.0/images/hot/js.js
    .js
  • 35v2.0/images/hot/pic.swf
  • 35v2.0/images/hot/pic.xml
    .xml
  • 35v2.0/images/ico.gif
    .gif
  • 35v2.0/images/img_xx.gif
    .gif
  • 35v2.0/images/img_xxx.gif
    .gif
  • 35v2.0/images/index_bg.gif
    .gif
  • 35v2.0/images/index_tagleft.gif
    .gif
  • 35v2.0/images/index_tagright.gif
    .gif
  • 35v2.0/images/inputso.gif
    .gif
  • 35v2.0/images/layer.gif
    .gif
  • 35v2.0/images/loading.gif
    .gif
  • 35v2.0/images/loading2.gif
    .gif
  • 35v2.0/images/logo.gif
    .gif
  • 35v2.0/images/logo.psd
  • 35v2.0/images/memua.gif
    .gif
  • 35v2.0/images/memubg.gif
    .gif
  • 35v2.0/images/nav-bg.gif
    .gif
  • 35v2.0/images/new.gif
    .gif
  • 35v2.0/images/nopic.gif
    .gif
  • 35v2.0/images/nopic.jpg
    .jpg
  • 35v2.0/images/remen.gif
    .gif
  • 35v2.0/images/style.css
  • 35v2.0/images/uploadimg/Thumbs.db
  • 35v2.0/inc/Conn.asp
  • 35v2.0/inc/config.asp
  • 35v2.0/inc/db.asp
    .vbs
  • 35v2.0/inc/fso.asp
    .vbs
  • 35v2.0/inc/gb_data.mdb
  • 35v2.0/inc/gbook.asp
    .asp .vbs polyglot
  • 35v2.0/inc/hits.asp
  • 35v2.0/inc/sqlin.asp
    .vbs
  • 35v2.0/inc/sub.asp
    .vbs
  • 35v2.0/inc/topic.asp
    .vbs
  • 35v2.0/index.asp
  • 35v2.0/js/AD.gif
    .gif
  • 35v2.0/js/ajax.js
    .js
  • 35v2.0/js/foot.js
    .js
  • 35v2.0/js/index1.js
    .js
  • 35v2.0/js/index2.js
    .js
  • 35v2.0/js/item1.js
    .js
  • 35v2.0/js/item2.js
    .js
  • 35v2.0/js/loading.gif
    .gif
  • 35v2.0/js/loading.html
    .html
  • 35v2.0/js/play1.js
    .js
  • 35v2.0/js/playad1.gif
    .gif
  • 35v2.0/js/top.js
    .js
  • 35v2.0/js/view1.js
    .js
  • 35v2.0/js/view2.js
    .js
  • 35v2.0/js/view3.js
    .js
  • 35v2.0/js/view4.js
    .js
  • 35v2.0/play.asp
    .vbs
  • 35v2.0/search.asp
  • 35v2.0/sendeoff.asp
    .vbs
  • 35v2.0/template/item.html
    .html
  • 35v2.0/template/link.txt
  • 35v2.0/template/play.html
    .html .js polyglot
  • 35v2.0/template/play/56.htm
    .html
  • 35v2.0/template/play/56.js
  • 35v2.0/template/play/6rooms.htm
    .html
  • 35v2.0/template/play/6rooms.js
    .js
  • 35v2.0/template/play/bobo.htm
    .html
  • 35v2.0/template/play/bobo.js
    .js
  • 35v2.0/template/play/iask.htm
    .html
  • 35v2.0/template/play/iask.js
    .js
  • 35v2.0/template/play/media.htm
    .html
  • 35v2.0/template/play/media.js
  • 35v2.0/template/play/neo.htm
    .html
  • 35v2.0/template/play/neo.js
    .js
  • 35v2.0/template/play/ouou.htm
    .html
  • 35v2.0/template/play/ouou.js
    .js
  • 35v2.0/template/play/play.htm
    .html
  • 35v2.0/template/play/play.js
    .js
  • 35v2.0/template/play/play_play.htm
    .html
  • 35v2.0/template/play/play_play.js
    .js
  • 35v2.0/template/play/qvod.htm
    .html
  • 35v2.0/template/play/qvod.js
    .js
  • 35v2.0/template/play/real.htm
    .html
  • 35v2.0/template/play/real.js
    .js
  • 35v2.0/template/play/tudou.htm
    .html .js polyglot
  • 35v2.0/template/play/tudou.js
    .js
  • 35v2.0/template/play/tudou1.htm
    .html .js polyglot
  • 35v2.0/template/play/tvix.htm
    .html .js polyglot
  • 35v2.0/template/play/tvix.js
    .js
  • 35v2.0/template/play/tvix1.htm
    .html .js polyglot
  • 35v2.0/template/play/vcastr21.swf
  • 35v2.0/template/play/xunlei.htm
    .js
  • 35v2.0/template/play/xunlei2.htm
    .html
  • 35v2.0/template/play/youku.htm
    .html
  • 35v2.0/template/play/youku.js
    .js
  • 35v2.0/template/view.html
    .html
  • 35v2.0/xml.asp
    .vbs
  • 35v2.0/临时服务器小助手/Aws.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • 35v2.0/临时服务器小助手/说明.txt
  • 35v2.0/函数调用.txt
  • 35v2.0/外部调用测试页.htm
    .html
  • 35v2.0/手动采集说明.txt
  • 35v2.0/文件结构及模板标签.txt
  • 35v2.0/新云软件.url
    .url
  • 35v2.0/说明.txt