Overview

overview

7

Static

static

3

新云软件.url

windows7-x64

1

新云软件.url

windows10-2004-x64

1

易特SQL ...��.exe

windows7-x64

3

易特SQL ...��.exe

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

dbmssocn.dll

windows7-x64

1

dbmssocn.dll

windows10-2004-x64

1

dbnetlib.dll

windows7-x64

1

dbnetlib.dll

windows10-2004-x64

1

dbnmpntw.dll

windows7-x64

1

dbnmpntw.dll

windows10-2004-x64

1

libjcc.dll

windows7-x64

3

libjcc.dll

windows10-2004-x64

3

libjsybheap.dll

windows7-x64

1

libjsybheap.dll

windows10-2004-x64

1

mssqlbak.dll

windows7-x64

1

mssqlbak.dll

windows10-2004-x64

1

mssqlbak.exe

windows7-x64

1

mssqlbak.exe

windows10-2004-x64

1

ntwdblib.dll

windows7-x64

1

ntwdblib.dll

windows10-2004-x64

1

pbdwe90.dll

windows7-x64

1

pbdwe90.dll

windows10-2004-x64

1

pbmss90.dll

windows7-x64

1

pbmss90.dll

windows10-2004-x64

1

pbvm90.dll

windows7-x64

1

pbvm90.dll

windows10-2004-x64

1

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    4032f0c070cb81d27df878ebb62dcec8_JaffaCakes118

  • Size

    3.2MB

  • MD5

    4032f0c070cb81d27df878ebb62dcec8

  • SHA1

    12e4215f5090575016eea271a62c9f4e45055955

  • SHA256

    3073839043decabaf8f001754e35ccd960275e35fe11e8096d102e0b28caddec

  • SHA512

    3df738efd0bfb56bc83a52a691f746794a7b7f97e26baacb7e45532b02c807be2b05e2b54397ca872b048cb68693eea443ab8be1bd06df54c31dbb01a4cf11ea

  • SSDEEP

    98304:Tbci/YkESY6h2DumPv2+PrF29lAdI1ZHWx8R7EO:SyYTDumm+PrFOiwZHWxO

Score
3/10

Malware Config

Signatures

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 4032f0c070cb81d27df878ebb62dcec8_JaffaCakes118
    .rar
  • 使用说明.txt
  • 新云软件.url
    .url
  • 易特SQL server自动备份工具.EXE
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • dbmssocn.dll
    .dll windows:4 windows x86 arch:x86

    0308deee9f67f74385166e56fb5d1431


    Headers

    Imports

    Exports

    Sections

  • dbnetlib.dll
    .dll windows:5 windows x86 arch:x86

    ad360252cbae41f069ad9fdc23286b74


    Headers

    Imports

    Exports

    Sections

  • dbnmpntw.dll
    .dll windows:5 windows x86 arch:x86

    55dad475c99479340c2fa22b29dc46e2


    Headers

    Imports

    Exports

    Sections

  • ini/backup.ini
  • ini/backupset.ini
  • libjcc.dll
    .dll windows:4 windows x86 arch:x86

    98596f3e5d37e9c19b26b7b51d9ef9fd


    Headers

    Imports

    Exports

    Sections

  • libjsybheap.dll
    .dll windows:4 windows x86 arch:x86

    cd185ae96e493c13224d6c93f6fa483f


    Headers

    Imports

    Exports

    Sections

  • mssqlbak.dll
    .dll windows:1 windows x86 arch:x86

    a31bc3202e532dc3b6c16da7cb4382a8


    Headers

    Imports

    Exports

    Sections

  • mssqlbak.exe
    .exe windows:1 windows x86 arch:x86

    699035716eff0f4cbc45b97c4ff099a5


    Headers

    Imports

    Sections

  • mssqlbak.exe.manifest
  • ntwdblib.dll
    .dll windows:4 windows x86 arch:x86

    6844cfb6e32d89a609393587b4609cb4


    Headers

    Imports

    Exports

    Sections

  • pbdwe90.dll
    .dll windows:4 windows x86 arch:x86

    9798a64cf49f5c0685e7495494887d11


    Headers

    Imports

    Exports

    Sections

  • pbmss90.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    431a7249710495af97317169bd47d2c1


    Headers

    Imports

    Exports

    Sections

  • pbvm90.dll
    .dll windows:4 windows x86 arch:x86

    488a02bfb552cd3f3de7ad4be6b3e52c


    Headers

    Imports

    Exports

    Sections

  • pic/Apps.ico
  • pic/Cmm.ico
  • pic/Fontsd.ico
  • pic/PAGESETU.BMP
  • pic/Script.ico
  • pic/Systemd.ico
  • pic/TIME.BMP
  • pic/Thumbs.db
  • pic/email.bmp
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • xt_toolbar.dll
    .dll windows:1 windows x86 arch:x86

    ce9553555bf46f06b36a2bff16ca2437


    Headers

    Imports

    Exports

    Sections

  • yitesoft.url
  • ʹ˵.txt