General

  • Target

    3b05b1172f05493ad09a4dea84c21911_JaffaCakes118

  • Size

    9.2MB

  • MD5

    3b05b1172f05493ad09a4dea84c21911

  • SHA1

    706fd81ddefff6d49fd52b83dae012b437296b5a

  • SHA256

    3fe1733ed1799d0ae8f53bd5c1fe48811b799b511b09f794eda00ce57bcffcd9

  • SHA512

    9e21fcb56bd8562cf4d62a2bd69f674b37eeeac7e3d3906a5d6911719e44bdfcdcd1e478f578d53b22a805577d48f6c28c0aaf6ab559c1b1295b6c031dccb400

  • SSDEEP

    196608:7je+hgPiB5sX9yrr6w/R8nSLk+zibSg3BPHDFrMiCTOgA3F8H5T5sYWX:G+hX5g9yrmS8SLk+ASg3dRr+TfTIX

Score
8/10

Malware Config

Signatures

  • Patched UPX-packed file 2 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

Files

  • 3b05b1172f05493ad09a4dea84c21911_JaffaCakes118
    .rar
  • LH3_20120419/步驟一請先進去開鑰匙/HideToolz.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/HideToolz.ini
  • LH3_20120419/步驟一請先進去開鑰匙/LH3.3.dll
    .dll windows:5 windows x86 arch:x86

    428f30d903de931635537c00409d24c0


    Headers

    Imports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/LH3.3.exe
    .exe windows:5 windows x86 arch:x86

    2579432180c56bee8e3f93ed0df3684e


    Headers

    Imports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/LH3.3.ini
  • LH3_20120419/步驟一請先進去開鑰匙/LinHelper.ini
  • LH3_20120419/步驟一請先進去開鑰匙/hidetoolz 隱蔽程式.rar
    .rar
  • HideToolz.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • HideToolz.ini
  • LH3_20120419/步驟一請先進去開鑰匙/lpk.dll
    .dll windows:5 windows x86 arch:x86

    00c5fd00087020a0645079ce30f4148b


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/使用說明.txt
  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/DSETUP.dll
    .dll windows:5 windows x86 arch:x86

    f57b219515a7304b7cca4eea391181e3


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/EGRNAPX2.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/FreeStyle.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/EGRNAP.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/EGRNAPX2.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/EHSvc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/hshield.log
  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/psapi.dll
    .dll windows:5 windows x86 arch:x86

    a06529690d58edd08ef4703a44d5e7db


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/v3pro32s.dll
    .dll windows:4 windows x86 arch:x86

    a006110bec18c9e438f3670219d4e948


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/v3warpds.v3d
  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/HackShield/v3warpns.v3d
  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/lpk.dll
    .dll windows:5 windows x86 arch:x86

    00c5fd00087020a0645079ce30f4148b


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/mss32.dll
    .dll windows:4 windows x86 arch:x86

    ba1a8517faadc41f1221a7ef65d3af14


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/此檔案勿刪除/點兩下後error切勿關閉其餘步驟一樣.exe
    .exe windows:4 windows x86 arch:x86

    66b18ad74eb7db9d498d7ab6c08faba7


    Headers

    Imports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/砲彈.dll
    .dll windows:5 windows x86 arch:x86

    428f30d903de931635537c00409d24c0


    Headers

    Imports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/砲彈.exe
    .exe windows:5 windows x86 arch:x86

    2579432180c56bee8e3f93ed0df3684e


    Headers

    Imports

    Sections

  • LH3_20120419/步驟一請先進去開鑰匙/請先執行此檔案執行後跳出的error請勿關閉其餘步驟一樣.lnk
    .lnk
  • LH3_20120419/步驟二進去開按我點兩下/LH3.dll
    .dll windows:5 windows x86 arch:x86

    41c2b8d21de8303acdf5c7d40e7443e0


    Headers

    Imports

    Sections

  • LH3_20120419/步驟二進去開按我點兩下/LH3.exe
    .exe windows:5 windows x86 arch:x86

    473807b3b930717bd72bb6f7245880b7


    Headers

    Imports

    Sections

  • LH3_20120419/步驟二進去開按我點兩下/LH3.ini
  • LH3_20120419/步驟二進去開按我點兩下/LinHelper.ini
  • LH3_20120419/步驟二進去開按我點兩下/List.spr.txt
  • LH3_20120419/步驟二進去開按我點兩下/lpk.dll
    .dll windows:5 windows x86 arch:x86

    00c5fd00087020a0645079ce30f4148b


    Headers

    Imports

    Exports

    Sections

  • LH3_20120419/步驟二進去開按我點兩下/使用說明.txt