Overview

overview

7

Static

static

3

gnsurfcontrol.exe

windows7-x64

7

gnsurfcontrol.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

ExeHook.dll

windows7-x64

1

ExeHook.dll

windows10-2004-x64

1

JpgVSbmp.dll

windows7-x64

1

JpgVSbmp.dll

windows10-2004-x64

3

MonUrlExt.dll

windows7-x64

1

MonUrlExt.dll

windows10-2004-x64

1

NMSashok.dll

windows7-x64

1

NMSashok.dll

windows10-2004-x64

1

NMUI.exe

windows7-x64

1

NMUI.exe

windows10-2004-x64

1

NMUrlMon.dll

windows7-x64

6

NMUrlMon.dll

windows10-2004-x64

6

PopHTMLTip.dll

windows7-x64

1

PopHTMLTip.dll

windows10-2004-x64

1

ScreenLogView.exe

windows7-x64

1

ScreenLogView.exe

windows10-2004-x64

1

SoftUpdate.dll

windows7-x64

1

SoftUpdate.dll

windows10-2004-x64

1

configcenter.dll

windows7-x64

1

configcenter.dll

windows10-2004-x64

1

dib.dll

windows7-x64

1

dib.dll

windows10-2004-x64

3

ftslsp.dll

windows7-x64

1

ftslsp.dll

windows10-2004-x64

1

gnbsetupcn.exe

windows7-x64

7

gnbsetupcn.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    3ff72893ec291d5bd25ef96407c8588a_JaffaCakes118

  • Size

    1.1MB

  • MD5

    3ff72893ec291d5bd25ef96407c8588a

  • SHA1

    43893024e1af8279244b6362e14dd2d0a116d895

  • SHA256

    0e2f63c224dabf193a3cf8a437ea5820c7fd91655db8d29d2e1e74729ffb9914

  • SHA512

    bb06152ed77582460d6fcbdc46f8b4cec64c13ba14cdd45c50d03118ee44feaa9790e65dc7c2acd0a80891515553cd15e761363a7f27557ede605381cae51f08

  • SSDEEP

    24576:ASofM5OVWqOUeEHxqWlJbpRyfjQT60JfZHLid0HPX3Z:LofM5tqO7DWlJbpRyjB0xlEEp

Score
3/10

Malware Config

Signatures

  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 3ff72893ec291d5bd25ef96407c8588a_JaffaCakes118
    .rar
  • gnsurfcontrol.exe
    .exe windows:4 windows x86 arch:x86

    170729c4965736ee8f8f4d1bab77cf38


    Headers

    Imports

    Sections

  • $EXEDIR/showtaskicon.bmp
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SetPassword.ini
  • $PLUGINSDIR/SetShortCut.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/md5dll.dll
    .dll windows:4 windows x86 arch:x86

    e57536e0d3500471d52df7cea0d65a39


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • ExeHook.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9e43006c44f00e70ad08806a941bb52f


    Headers

    Imports

    Exports

    Sections

  • IntegralUnit.ini
  • JpgVSbmp.dll
    .dll windows:4 windows x86 arch:x86

    8ee1425373dbd6acff15e99152ac0ffb


    Headers

    Imports

    Exports

    Sections

  • MonUrlExt.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    5c8e75619cbfcc346fe66a97292c0e53


    Headers

    Imports

    Exports

    Sections

  • NMSashok.dll
    .dll windows:4 windows x86 arch:x86

    dd58aa8fd4fb1e4725106663565715c4


    Headers

    Imports

    Exports

    Sections

  • NMUI.exe
    .exe windows:4 windows x86 arch:x86

    9d677fb176f5d28f8003f146ba46f63c


    Headers

    Imports

    Sections

  • NMUrlMon.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    01e96491ca693fd0ac73fade4fe015f0


    Headers

    Imports

    Exports

    Sections

  • PopHTMLTip.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    03635043a9a9ed3b0ef44b64dd982dc7


    Headers

    Imports

    Exports

    Sections

  • ScreenLogView.exe
    .exe windows:4 windows x86 arch:x86

    7f03fc4b6dc6564d9c8f68efd087093b


    Headers

    Imports

    Sections

  • SoftUpdate.dll
    .dll windows:4 windows x86 arch:x86

    ae237b0a6eba2e101cffd40db7c1e636


    Headers

    Imports

    Exports

    Sections

  • configcenter.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    dd5133e02e9b866ec88d8999df490b21


    Headers

    Imports

    Exports

    Sections

  • dib.dll
    .dll windows:4 windows x86 arch:x86

    40f2dcddfddf54dc53ce2ffda36cd0a1


    Headers

    Imports

    Exports

    Sections

  • ftslsp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    ae65ad9422d094c32aeee693a12711a5


    Headers

    Imports

    Exports

    Sections

  • gnbsetupcn.exe
    .exe windows:4 windows x86 arch:x86

    170729c4965736ee8f8f4d1bab77cf38


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • filter.ini
  • gnblock.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c855890e542ff764c91171778ab2e93f


    Headers

    Imports

    Exports

    Sections

  • gnblock_tmp.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c855890e542ff764c91171778ab2e93f


    Headers

    Imports

    Exports

    Sections

  • language/simpchinese.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • language/simpchinese_tmp.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • whitelist.ini
  • misi.dat
  • pl.ini
  • report.htm
    .html .js polyglot
  • res.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • res/PopInfo.htm
    .html .js polyglot
  • res/close.gif
    .gif
  • res/close_down.gif
    .gif
  • res/main.gif
    .gif
  • res/mousemove_close.gif
    .gif
  • security.exe
    .exe windows:4 windows x86 arch:x86

    5e7243748eb848e623f0322f13569b0f


    Headers

    Imports

    Sections

  • ssi.dat
  • 新云软件.url
    .url