Overview

overview

7

Static

static

3

155绿色�...��.url

windows7-x64

1

155绿色�...��.url

windows10-2004-x64

1

QSI_20110420.exe

windows7-x64

7

QSI_20110420.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

KillSN.exe

windows7-x64

4

KillSN.exe

windows10-2004-x64

4

QvodManager.exe

windows7-x64

1

QvodManager.exe

windows10-2004-x64

1

QvodServer.exe

windows7-x64

1

QvodServer.exe

windows10-2004-x64

1

QvodWatche...er.exe

windows7-x64

1

QvodWatche...er.exe

windows10-2004-x64

1

QvodWatche...ll.bat

windows7-x64

1

QvodWatche...ll.bat

windows10-2004-x64

1

QvodWatcher/run.bat

windows7-x64

1

QvodWatcher/run.bat

windows10-2004-x64

1

QvodWatcher/stop.bat

windows7-x64

1

QvodWatcher/stop.bat

windows10-2004-x64

1

QvodWatche...ll.bat

windows7-x64

1

QvodWatche...ll.bat

windows10-2004-x64

1

Qvodhelp.chm

windows7-x64

1

Qvodhelp.chm

windows10-2004-x64

1

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

UpdateServ...ce.exe

windows7-x64

1

UpdateServ...ce.exe

windows10-2004-x64

1

UpdateServ...ll.bat

windows7-x64

1

UpdateServ...ll.bat

windows10-2004-x64

1

UpdateService/run.bat

windows7-x64

1

UpdateService/run.bat

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    4b0b8590304ed834eeb5370d50c8c5e5_JaffaCakes118

  • Size

    2.9MB

  • MD5

    4b0b8590304ed834eeb5370d50c8c5e5

  • SHA1

    32f69353629f856a74a6cd8b057be6d4ccef1a51

  • SHA256

    6ec6e5d815604c3f606de24304a533a12245a4f1f2d5171b07e1efd3c941f6ae

  • SHA512

    b00a328aeb75549dbe0ba3ace8c0e93a356ea0ebcccf053dd11b90ea0550da9369c5d6db26b6792b131a1c04c7eb2745f0703bd59a55cef2b3a97cefb4e2ceb2

  • SSDEEP

    49152:3RIX8jNiCgRCMFcGpM+HCo3NamnDBqla55aJVc4ft4p3M46HhPvGIa2/rbA/d:BIX8jNXfwcGpM+Hn34mnDwlan4VH142s

Score
3/10

Malware Config

Signatures

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 4b0b8590304ed834eeb5370d50c8c5e5_JaffaCakes118
    .rar
  • 155绿色软件站.url
    .url
  • QSI_20110420.exe
    .exe windows:4 windows x86 arch:x86

    1bed3305885b0ca596d9cbba22baf78a


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    9d433976e02d79532f0d635ee81d0b20


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • KillSN.exe
    .exe windows:4 windows x86 arch:x86

    83a38f0d431b2c6c4671f8026b76a40d


    Headers

    Imports

    Sections

  • QAVI.ICO
  • QvodManager.exe
    .exe windows:4 windows x86 arch:x86

    f56977d17ac5cf85d50f3e5287902fc4


    Headers

    Imports

    Sections

  • QvodServer.exe
    .exe windows:4 windows x86 arch:x86

    a892d2809944d3a7a1aa2a0800dd20b8


    Headers

    Imports

    Sections

  • QvodWatcher/Daemon.ini
  • QvodWatcher/QvodWatcher.exe
    .exe windows:4 windows x86 arch:x86

    579781062f50508d0659bb0f13b6b701


    Headers

    Imports

    Sections

  • QvodWatcher/install.bat
  • QvodWatcher/run.bat
  • QvodWatcher/stop.bat
  • QvodWatcher/uninstall.bat
  • Qvodhelp.chm
    .chm
  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    1bed3305885b0ca596d9cbba22baf78a


    Headers

    Imports

    Sections

  • UpdateService/UpdateService.exe
    .exe windows:4 windows x86 arch:x86

    a00d3588e4baac4234794a8c41a52a67


    Headers

    Imports

    Sections

  • UpdateService/install.bat
  • UpdateService/run.bat
  • UpdateService/stop.bat
  • UpdateService/uninstall.bat
  • Web/Image/1.gif
    .gif
  • Web/Image/2.gif
    .gif
  • Web/Image/3.gif
    .gif
  • Web/Image/4.gif
    .gif
  • Web/Image/5.gif
    .gif
  • Web/Image/6.gif
    .gif
  • Web/Image/7.gif
    .gif
  • Web/Image/8.gif
    .gif
  • Web/Image/d.gif
    .gif
  • Web/Image/dl.gif
    .gif
  • Web/Image/f.gif
    .gif
  • Web/Image/g.gif
    .gif
  • Web/Image/q.gif
    .gif
  • Web/Image/qddc.gif
    .gif
  • Web/Image/t.gif
    .gif
  • Web/Image/tc.gif
    .gif
  • Web/allinfo.htm
    .html
  • Web/alllink.htm
    .html
  • Web/alllink.txt
  • Web/date.js
    .js
  • Web/ftpfiles.htm
    .html .js polyglot
  • Web/getlink.htm
    .html .js polyglot
  • Web/getpaths.htm
    .html .js polyglot
  • Web/index.htm
    .html
  • Web/left.htm
    .html .js polyglot
  • Web/main.htm
    .html
  • Web/top.htm
    .html
  • user.ini