General

  • Target

    37da22efd52f25a8614bb12b293f5596_JaffaCakes118

  • Size

    7.0MB

  • MD5

    37da22efd52f25a8614bb12b293f5596

  • SHA1

    2e2e952ac7cd66e4a872dc460ee8213eb1593d71

  • SHA256

    e93f4b6a30263cdd605c4d7ecb1b7415191289ed10070902a94c3d74bea6cf77

  • SHA512

    7bb8df1edff9eb685dca19a419859dc258e383066fc268c52e26de712c7571fa6a32a632cf25408c4b2c5d9e966b315e3669dee28a29c41e72e44c169360158d

  • SSDEEP

    196608:e5bjKgGefTwONp0JUS6u9QrfIt7hFpy9vK5rS2eSK:iGgGe7wmchQMtfgK5ruSK

Score
3/10

Malware Config

Signatures

  • Unsigned PE 40 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 37da22efd52f25a8614bb12b293f5596_JaffaCakes118
    .rar
  • DfvsX_2005.exe
    .exe windows:4 windows x86 arch:x86

    b711f65a9aff6a22fb2f57f0ac8bda33


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    9d433976e02d79532f0d635ee81d0b20


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/assist4.exe
    .exe windows:4 windows x86 arch:x86

    b711f65a9aff6a22fb2f57f0ac8bda33


    Headers

    Imports

    Sections

  • $R0
    .dll regsvr32 windows:4 windows x86 arch:x86

    3e01e5e72f4a727eb05e25847cae4d97


    Headers

    Imports

    Exports

    Sections

  • Assist/$R0
    .dll regsvr32 windows:4 windows x86 arch:x86

    e9559ac95b98ff4786d6b8f305be59c0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/io3721.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/ui.ini
  • AhnCtlKD.dll
    .dll windows:4 windows x86 arch:x86

    0fb408bf0a33f7cc7e92029a23311b3f


    Headers

    Imports

    Exports

    Sections

  • DFGE_AHN.dll
    .dll windows:4 windows x86 arch:x86

    a75423d6f16292e87b878e945fc02077


    Headers

    Imports

    Exports

    Sections

  • DFVSBK.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSFB.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSFR.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSIF.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSMB.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSMR.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSSET.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSSF.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSSL.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSSR.ocx
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DFVSX.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • DFVSZIP.DLL
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • FM_RO.dll
    .dll windows:4 windows x86 arch:x86

    e261e1a03c7cb9c5c09d2f8d0cf2545e


    Headers

    Imports

    Exports

    Sections

  • LEAKLIB.INI
  • NAMEMAP.dll
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Exports

    Sections

  • Net/libwsc.dll
    .dll windows:4 windows x86 arch:x86

    feacd17e2e59d93ffa08a995870d8992


    Headers

    Imports

    Exports

    Sections

  • REGLIB.INI
  • SCANFILE.dll
    .dll windows:4 windows x86 arch:x86

    3bae039c08846379dcf05ac97616c423


    Headers

    Imports

    Exports

    Sections

  • UNRAR.dll
    .dll windows:4 windows x86 arch:x86

    77c3319357948fd2ae09342f71002423


    Headers

    Imports

    Exports

    Sections

  • Update.INI
  • Update.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • V3Flt.dll
    .dll windows:4 windows x86 arch:x86

    15cb0d5fbd07f7f315e23d56d56e89dc


    Headers

    Imports

    Exports

    Sections

  • V3flt2k.sys
    .sys windows:5 windows x86 arch:x86

    b512882ac90adbc7c115ef3a0434c2d9


    Headers

    Imports

    Sections

  • V3fltNt.sys
    .sys windows:4 windows x86 arch:x86

    65a49127c68fe6f12f43f96fd3c7c116


    Headers

    Imports

    Sections

  • XR0DLL.dll
    .dll windows:4 windows x86 arch:x86

    69f6df1373ed14eec155b2419af5a7c3


    Headers

    Imports

    Exports

    Sections

  • barsetup.exe
    .exe windows:4 windows x86 arch:x86

    9632e80596371cfa7f563f680f3c4498


    Headers

    Imports

    Sections

  • dfvsfb.ini
  • dfvsfm.dll
    .dll windows:4 windows x86 arch:x86

    95cbd2f66348956b6296c36c0e5be790


    Headers

    Imports

    Exports

    Sections

  • dfvsmenu.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    08eba8c644e187bc594c250db0104924


    Headers

    Imports

    Exports

    Sections

  • dfvsx.chm
    .chm
  • inet70.bpl
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • info.ini
  • language/dfvsx.sil
  • libwsc.dll
    .dll windows:4 windows x86 arch:x86

    feacd17e2e59d93ffa08a995870d8992


    Headers

    Imports

    Exports

    Sections

  • rtl70.bpl
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • skin/default/backupfile.htm
  • skin/default/backupfilemenu.htm
    .js
  • skin/default/backupmail.htm
  • skin/default/backupmailmenu.htm
    .js
  • skin/default/bar.gif
    .gif
  • skin/default/brfile.htm
  • skin/default/brmail.htm
  • skin/default/css/form.css
  • skin/default/firewall.htm
    .html .js polyglot
  • skin/default/images/btn_bg_down.gif
    .gif
  • skin/default/images/btn_bg_normal.gif
    .gif
  • skin/default/images/btn_bg_over.gif
    .gif
  • skin/default/images/btn_left_down.gif
    .gif
  • skin/default/images/btn_left_normal.gif
    .gif
  • skin/default/images/btn_left_over.gif
    .gif
  • skin/default/images/btn_right_down.gif
    .gif
  • skin/default/images/btn_right_normal.gif
    .gif
  • skin/default/images/btn_right_over.gif
    .gif
  • skin/default/images/ghost.gif
    .gif
  • skin/default/img/arrow_down.gif
    .gif
  • skin/default/img/arrow_right.gif
    .gif
  • skin/default/img/banner_bg.jpg
    .jpg
  • skin/default/img/border_left.jpg
    .jpg
  • skin/default/img/border_right.jpg
    .jpg
  • skin/default/img/bottom_bg.jpg
    .jpg
  • skin/default/img/bottom_left.jpg
    .jpg
  • skin/default/img/bottom_right.jpg
    .jpg
  • skin/default/img/btn_update.jpg
    .jpg
  • skin/default/img/btn_update_down.jpg
    .jpg
  • skin/default/img/btn_update_gray.jpg
    .jpg
  • skin/default/img/corner_pattern.jpg
    .jpg
  • skin/default/img/logo_back.jpg
    .jpg
  • skin/default/img/mainbg.jpg
    .jpg
  • skin/default/img/menu_item1_title.jpg
    .jpg
  • skin/default/img/menu_item1_title_gray.jpg
    .jpg
  • skin/default/img/menu_item2_title.jpg
    .jpg
  • skin/default/img/menu_item2_title_gray.jpg
    .jpg
  • skin/default/img/menu_item3_title.jpg
    .jpg
  • skin/default/img/menu_item3_title_gray.jpg
    .jpg
  • skin/default/img/menu_item4_title.jpg
    .jpg
  • skin/default/img/menu_item4_title_gray.jpg
    .jpg
  • skin/default/img/menu_item5_title.jpg
    .jpg
  • skin/default/img/menu_item5_title_gray.jpg
    .jpg
  • skin/default/img/menu_item_selected.jpg
    .jpg
  • skin/default/img/no_point_line.jpg
    .jpg
  • skin/default/img/page_backup_title.jpg
    .jpg
  • skin/default/img/page_config_title.jpg
    .jpg
  • skin/default/img/page_monitor_title.jpg
    .jpg
  • skin/default/img/page_other_title.jpg
    .jpg
  • skin/default/img/page_scanleak_title.jpg
    .jpg
  • skin/default/img/page_scanreg_title.jpg
    .jpg
  • skin/default/img/page_scanvirus_title.jpg
    .jpg
  • skin/default/img/page_welcome_title.jpg
    .jpg
  • skin/default/img/panel1_bg.jpg
    .jpg
  • skin/default/img/panel1_bottom.jpg
    .jpg
  • skin/default/img/panel1_top.jpg
    .jpg
  • skin/default/img/panel2_bg.jpg
    .jpg
  • skin/default/img/panel2_bottom.jpg
    .jpg
  • skin/default/img/panel2_top.jpg
    .jpg
  • skin/default/img/point.jpg
    .jpg
  • skin/default/img/point_line.jpg
    .jpg
  • skin/default/img/scanask.gif
    .gif
  • skin/default/img/top_bg.jpg
    .jpg
  • skin/default/img/top_title.jpg
    .jpg
  • skin/default/img/top_winctrl.jpg
    .jpg
  • skin/default/img/top_winctrl_close.jpg
    .jpg
  • skin/default/img/top_winctrl_min.jpg
    .jpg
  • skin/default/insulation.htm
  • skin/default/insulationmenu.htm
    .js
  • skin/default/js/button.js
  • skin/default/js/handleerror.js
  • skin/default/logframe.htm
  • skin/default/logtmp.htm
    .html
  • skin/default/mainframe.htm
    .html .js polyglot
  • skin/default/mask.gif
    .gif
  • skin/default/menu.htm
    .html .js polyglot
  • skin/default/menu2.htm
    .html .js polyglot
  • skin/default/menu3.htm
    .html .js polyglot
  • skin/default/minfrm.bmp
  • skin/default/restorefile.htm
  • skin/default/restorefilemenu.htm
    .js
  • skin/default/restoremail.htm
  • skin/default/restoremailmenu.htm
    .js
  • skin/default/scanask.htm
    .js
  • skin/default/scanfile.htm
    .js
  • skin/default/scanfilemenu.htm
  • skin/default/scanleak.htm
  • skin/default/scanleakmenu.htm
  • skin/default/scanreg.htm
  • skin/default/scanregmenu.htm
  • skin/default/setting0.htm
  • skin/default/setting1.htm
  • skin/default/setting2.htm
  • skin/default/setting3.htm
  • skin/default/skin.ini
  • skin/default/slreport.htm
    .html
  • skin/default/status.htm
    .html
  • skin/default/treesta.gif
    .gif
  • skin/default/updatelogtemp.htm
    .html
  • updatelogtmp.htm
    .html
  • v3back32.dll
    .dll windows:4 windows x86 arch:x86

    369734b41ae4775462577d441135179c


    Headers

    Imports

    Exports

    Sections

  • v3pro32e.dll
    .dll windows:4 windows x86 arch:x86

    ae4b8746951141d8a2f03022fbb077b6


    Headers

    Imports

    Exports

    Sections

  • vcl70.bpl
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • vclie70.bpl
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • vclx70.bpl
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 下载说明.htm
    .html .js polyglot