Overview

overview

8

Static

static

7

HA_MP3Shri...CZ.exe

windows7-x64

7

HA_MP3Shri...CZ.exe

windows10-2004-x64

7

$FAVORITES...��.url

windows7-x64

1

$FAVORITES...��.url

windows10-2004-x64

1

$PLUGINSDI...NS.dll

windows7-x64

3

$PLUGINSDI...NS.dll

windows10-2004-x64

3

$PLUGINSDI...NU.dll

windows7-x64

3

$PLUGINSDI...NU.dll

windows10-2004-x64

3

$TEMP/Fox-...CZ.exe

windows7-x64

7

$TEMP/Fox-...CZ.exe

windows10-2004-x64

7

$TEMP/Fox-...CZ.exe

windows7-x64

8

$TEMP/Fox-...CZ.exe

windows10-2004-x64

8

Lame.exe

windows7-x64

1

Lame.exe

windows10-2004-x64

1

LameInfo.exe

windows7-x64

1

LameInfo.exe

windows10-2004-x64

1

QQOnline.exe

windows7-x64

7

QQOnline.exe

windows10-2004-x64

7

SearchQQ.exe

windows7-x64

1

SearchQQ.exe

windows10-2004-x64

3

WinMP3Shrink.exe

windows7-x64

3

WinMP3Shrink.exe

windows10-2004-x64

3

ж�...��.exe

windows7-x64

7

ж�...��.exe

windows10-2004-x64

7

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4083d90a287fb017602c1205d9521e8d_JaffaCakes118

  • Size

    1.4MB

  • MD5

    4083d90a287fb017602c1205d9521e8d

  • SHA1

    03633e892384a9f8a89985221961943dc1b34af6

  • SHA256

    b75676d832babe0b56515b55a8a12595f6b6f98a69b3751c3c77d685041437a6

  • SHA512

    0103dfe35276602629bac8f513ee9bdf93dfe5b729697ae7c0a5b0633dbdeaacd25211714245c2dfb137e58eb8b55ac039ad1158461da686274f0d4acee69f5e

  • SSDEEP

    24576:LftU8gL7lNfFBW9Up/7ZmTHv3WSwfKk8BVQ2q9LRwX8biDsM/KEMR0FPQfVdmxau:LfIXp/7RSwfUB2ZZRBosM/K1R8QNsxIA

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • 4083d90a287fb017602c1205d9521e8d_JaffaCakes118
    .rar
  • HA_MP3Shrink-1.1S_CZ.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $FAVORITES/ãַ֮.URL
  • $PLUGINSDIR/INSTALLOPTIONS.DLL
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/STARTMENU.DLL
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $TEMP/Fox-Temp/BAIDU-CZ.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $TEMP/Fox-Temp/CNNIC-CZ.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Lame.EXE
    .exe windows:4 windows x86 arch:x86

    24afd59b0b9539d924caa909c349b2d5


    Headers

    Imports

    Sections

  • LameInfo.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • QQOnline.EXE
    .exe windows:4 windows x86 arch:x86

    3c0e70bfa5f73f1f1cef484e2bcb5bf8


    Headers

    Imports

    Sections

  • ReadMe_LordFox.TXT
  • ReadMe_SoftPedia.TXT
  • SearchQQ.EXE
    .exe windows:4 windows x86 arch:x86

    3c0e70bfa5f73f1f1cef484e2bcb5bf8


    Headers

    Imports

    Sections

  • WinMP3Shrink.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • WinMP3Shrink.TXT
  • ж.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ⷴ.URL
  • ReadMe_LordFox.TXT
  • 下载说明.htm
    .html .js polyglot