Overview

overview

7

Static

static

3

5c2d30400a...18.exe

windows7-x64

7

5c2d30400a...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$SYSDIR/pncrt.dll

windows7-x64

3

$SYSDIR/pncrt.dll

windows10-2004-x64

3

Codecs/Col...er.dll

windows7-x64

1

Codecs/Col...er.dll

windows10-2004-x64

1

Codecs/Rea...er.dll

windows7-x64

1

Codecs/Rea...er.dll

windows10-2004-x64

1

Codecs/asf...er.dll

windows7-x64

1

Codecs/asf...er.dll

windows10-2004-x64

1

Codecs/atrc.dll

windows7-x64

1

Codecs/atrc.dll

windows10-2004-x64

1

Codecs/cook.dll

windows7-x64

1

Codecs/cook.dll

windows10-2004-x64

1

Codecs/drvc.dll

windows7-x64

1

Codecs/drvc.dll

windows10-2004-x64

1

Codecs/raac.dll

windows7-x64

1

Codecs/raac.dll

windows10-2004-x64

1

Lang/en_US.dll

windows7-x64

1

Lang/en_US.dll

windows10-2004-x64

1

Lang/zh_TW.dll

windows7-x64

1

Lang/zh_TW.dll

windows10-2004-x64

1

NetAgent.dll

windows7-x64

1

NetAgent.dll

windows10-2004-x64

3

Qupdate.exe

windows7-x64

1

Qupdate.exe

windows10-2004-x64

1

QvodInit.exe

windows7-x64

1

QvodInit.exe

windows10-2004-x64

1

QvodInsert.dll

windows7-x64

1

QvodInsert.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    5c2d30400a9fa09126165bef4afadd6a_JaffaCakes118

  • Size

    1.2MB

  • MD5

    5c2d30400a9fa09126165bef4afadd6a

  • SHA1

    f3a5664bcdaf973b0bd93e11788b02b0718dbe04

  • SHA256

    964b291dd11388d85eb4d3333492074bdea1875e6472abbf218cae0906417826

  • SHA512

    34e0516e090d798841e14ccf35410eb5873fa84a4e840a2043464147449a8710a8afd74dd996c76fc8a06355f77a0ed6c0be1f1bb8bf747ba7ba4447275e4186

  • SSDEEP

    24576:QxLKb2UKNjLZyWcYztC83S3sqM4JbRtE0MU0II014A5ubK1Tu:+K2UKNguztC83SV3gJUjI014GubYC

Score
3/10

Malware Config

Signatures

  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 5c2d30400a9fa09126165bef4afadd6a_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/pncrt.dll
    .dll windows:4 windows x86 arch:x86

    828907b7a8ec04c9c4031e40ef2f76ec


    Headers

    Imports

    Exports

    Sections

  • Codecs/ColorFilter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    e9be23b97ce81d04e0228b45b9be78a6


    Headers

    Imports

    Exports

    Sections

  • Codecs/RealMediaSplitter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    092c362fafa1e9277558c0e5612fdfba


    Headers

    Imports

    Exports

    Sections

  • Codecs/asfsplliter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    61540ae4d5f1fe29babe6b430f77a241


    Headers

    Imports

    Exports

    Sections

  • Codecs/atrc.dll
    .dll windows:4 windows x86 arch:x86

    5132cde9ac8899a69f40dfaacc320c4d


    Headers

    Imports

    Exports

    Sections

  • Codecs/cook.dll
    .dll windows:4 windows x86 arch:x86

    7186ef18b8145b9efacd73914d40cee0


    Headers

    Imports

    Exports

    Sections

  • Codecs/drvc.dll
    .dll windows:4 windows x86 arch:x86

    5d841dc9603dda4e7058b842c1dedbfc


    Headers

    Imports

    Exports

    Sections

  • Codecs/raac.dll
    .dll windows:4 windows x86 arch:x86

    2569b16af6a5e82c06ef6aed87f5e148


    Headers

    Imports

    Exports

    Sections

  • Lang/en_US.dll
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • Lang/zh_TW.dll
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • NetAgent.dll
    .dll windows:4 windows x86 arch:x86

    05e994e89bca2bc1de7a95f2797bfdb7


    Headers

    Imports

    Exports

    Sections

  • Qupdate.exe
    .exe windows:4 windows x86 arch:x86

    edf10d34cd791376b10726af3294a272


    Headers

    Imports

    Sections

  • QvodInit.exe
    .exe windows:4 windows x86 arch:x86

    1820913804bb8da5739611d38ae155e0


    Headers

    Imports

    Sections

  • QvodInsert.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    fc6efb6ce95509e1088fe23f2706cc48


    Headers

    Imports

    Exports

    Sections

  • QvodPlayer.exe
    .exe windows:4 windows x86 arch:x86

    f1d7ce292d748082c2bbf8a351eab943


    Headers

    Imports

    Sections

  • QvodTerminal.exe
    .exe windows:4 windows x86 arch:x86

    4c530dd239a279e9714f83536520349b


    Headers

    Imports

    Sections

  • Skin/Default/add.bmp
  • Skin/Default/bottom.bmp
  • Skin/Default/bottomback.bmp
  • Skin/Default/caption.bmp
  • Skin/Default/close.bmp
  • Skin/Default/del.bmp
  • Skin/Default/fav.bmp
  • Skin/Default/full.bmp
  • Skin/Default/header.bmp
  • Skin/Default/kjin.bmp
  • Skin/Default/ktui.bmp
  • Skin/Default/left.bmp
  • Skin/Default/liststate.bmp
  • Skin/Default/logo.bmp
  • Skin/Default/max.bmp
  • Skin/Default/max_re.bmp
  • Skin/Default/menu.bmp
  • Skin/Default/min.bmp
  • Skin/Default/mute.bmp
  • Skin/Default/next.bmp
  • Skin/Default/nomute.bmp
  • Skin/Default/pause.bmp
  • Skin/Default/play.bmp
  • Skin/Default/player.bmp
  • Skin/Default/playerfill.bmp
  • Skin/Default/prev.bmp
  • Skin/Default/progress_fill.bmp
  • Skin/Default/progress_mask.bmp
  • Skin/Default/progress_thumb.bmp
  • Skin/Default/right.bmp
  • Skin/Default/select.bmp
  • Skin/Default/selectlist.bmp
  • Skin/Default/skin.ini
  • Skin/Default/split.bmp
  • Skin/Default/split_bottom.bmp
  • Skin/Default/stop.bmp
  • Skin/Default/tabback.bmp
  • Skin/Default/tabselect.bmp
  • Skin/Default/toolbar.bmp
  • Skin/Default/top.bmp
  • Skin/Default/toqvod.bmp
  • Skin/Default/treestate.bmp
  • Skin/Default/volume_fill.bmp
  • Skin/Default/volume_mask.bmp
  • Skin/Default/volume_thumb.bmp
  • Skin/Default/vscrolldownarrow.bmp
  • Skin/Default/vscrollspan.bmp
  • Skin/Default/vscrollthumb.bmp
  • Skin/Default/vscrolluparrow.bmp
  • Skin/Default/webback.bmp
  • Skin/Default/webmain.bmp
  • Skin/Default/webnext.bmp
  • Skin/Default/webre.bmp
  • Skin/Default/webstop.bmp
  • Skin/Default/x1.bmp
  • Skin/Default/x2.bmp
  • Skin/Default/xf.bmp
  • Skin/Default/xview.bmp
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    053c8c5da7b5f6a2513024b82859e1b0


    Headers

    Imports

    Exports

    Sections

  • ղؼ/114 ַ.url
  • ղؼ/114 ۺ.url
  • ղؼ/TOM365 ѵӰ.url
  • ղؼ/ľ - ڲͬ.url