General

  • Target

    672e442c8f7cceeffbee90b67aa1c373_JaffaCakes118

  • Size

    4.4MB

  • MD5

    672e442c8f7cceeffbee90b67aa1c373

  • SHA1

    668f9e69f5a4494bcd21ca40b1db199c2fc19a20

  • SHA256

    2c79bad3b5eaaee69ef3cf26335faae93945cfa5efa2a1bd27b6b8f6f69fedce

  • SHA512

    b2d0be9f155064d492af020e02f655f4e90c57ee5ab7990b0b7f87fdb4d06b2a6e8415273cb8945f2be5e62f6b48ad27a37e5f48d8d3852bfd7a96da92ffcb40

  • SSDEEP

    98304:SV6s6409lBgwbE7E/yStqCVj1QNc0pV389se4IV14h9/Hn:SgLLb6VCVR4c8s9LqhN

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

Files

  • 672e442c8f7cceeffbee90b67aa1c373_JaffaCakes118
    .rar
  • HotelMIS_special.exe
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • ConfigServer.exe
    .exe windows:4 windows x86 arch:x86

    1be21a53bf7d8c0bf248f19d6739d588


    Headers

    Imports

    Sections

  • GuiTk115.dll
    .dll windows:4 windows x86 arch:x86

    c9a34ffafcfa42b1c6ca281948839847


    Headers

    Imports

    Exports

    Sections

  • MFC71.dll
    .dll windows:4 windows x86 arch:x86

    7397fb8b8633dd76aa9cbc7e2e0c24bd


    Headers

    Imports

    Sections

  • data/hotelmis/db.opt
  • data/hotelmis/t_account.MYD
  • data/hotelmis/t_account.MYI
  • data/hotelmis/t_account.frm
  • data/hotelmis/t_accountdetails.MYD
  • data/hotelmis/t_accountdetails.MYI
  • data/hotelmis/t_accountdetails.frm
  • data/hotelmis/t_admin.MYD
  • data/hotelmis/t_admin.MYI
  • data/hotelmis/t_admin.frm
  • data/hotelmis/t_arrerage.MYD
  • data/hotelmis/t_arrerage.MYI
  • data/hotelmis/t_arrerage.frm
  • data/hotelmis/t_arrerage_zh.MYD
  • data/hotelmis/t_arrerage_zh.MYI
  • data/hotelmis/t_arrerage_zh.frm
  • data/hotelmis/t_beforerep.MYI
  • data/hotelmis/t_beforerep.frm
  • data/hotelmis/t_behindrep.MYI
  • data/hotelmis/t_behindrep.frm
  • data/hotelmis/t_childmenuinfo.MYI
  • data/hotelmis/t_childmenuinfo.frm
  • data/hotelmis/t_destine.MYI
  • data/hotelmis/t_destine.frm
  • data/hotelmis/t_employee.MYD
  • data/hotelmis/t_employee.MYI
  • data/hotelmis/t_employee.frm
  • data/hotelmis/t_foodkind.MYD
  • data/hotelmis/t_foodkind.MYI
  • data/hotelmis/t_foodkind.frm
  • data/hotelmis/t_hotelmsg.MYD
  • data/hotelmis/t_hotelmsg.MYI
  • data/hotelmis/t_hotelmsg.frm
  • data/hotelmis/t_inoutrep.MYI
  • data/hotelmis/t_inoutrep.frm
  • data/hotelmis/t_job_set.MYD
  • data/hotelmis/t_job_set.MYI
  • data/hotelmis/t_job_set.frm
  • data/hotelmis/t_mcz.MYD
  • data/hotelmis/t_mcz.MYI
  • data/hotelmis/t_mcz.frm
  • data/hotelmis/t_mdj.MYI
  • data/hotelmis/t_mdj.frm
  • data/hotelmis/t_member.MYD
  • data/hotelmis/t_member.MYI
  • data/hotelmis/t_member.frm
  • data/hotelmis/t_menuinfo.MYD
  • data/hotelmis/t_menuinfo.MYI
  • data/hotelmis/t_menuinfo.frm
  • data/hotelmis/t_mzz.MYI
  • data/hotelmis/t_mzz.frm
  • data/hotelmis/t_opright.MYD
  • data/hotelmis/t_opright.MYI
  • data/hotelmis/t_opright.frm
  • data/hotelmis/t_outstore.MYD
  • data/hotelmis/t_outstore.MYI
  • data/hotelmis/t_outstore.frm
  • data/hotelmis/t_pwd.MYD
  • data/hotelmis/t_pwd.MYI
  • data/hotelmis/t_pwd.frm
  • data/hotelmis/t_repast.MYD
  • data/hotelmis/t_repast.MYI
  • data/hotelmis/t_repast.frm
  • data/hotelmis/t_repdetails.MYD
  • data/hotelmis/t_repdetails.MYI
  • data/hotelmis/t_repdetails.frm
  • data/hotelmis/t_repertory.MYD
  • data/hotelmis/t_repertory.MYI
  • data/hotelmis/t_repertory.frm
  • data/hotelmis/t_repertory_total.MYD
  • data/hotelmis/t_repertory_total.MYI
  • data/hotelmis/t_repertory_total.frm
  • data/hotelmis/t_roomset.MYD
  • data/hotelmis/t_roomset.MYI
  • data/hotelmis/t_roomset.frm
  • data/hotelmis/t_tablestatus.MYD
  • data/hotelmis/t_tablestatus.MYI
  • data/hotelmis/t_tablestatus.frm
  • data/hotelmis/t_tablestatusset.MYD
  • data/hotelmis/t_tablestatusset.MYI
  • data/hotelmis/t_tablestatusset.frm
  • data/hotelmis/t_unit_set.MYD
  • data/hotelmis/t_unit_set.MYI
  • data/hotelmis/t_unit_set.frm
  • data/mysql/columns_priv.MYI
  • data/mysql/columns_priv.frm
  • data/mysql/db.MYD
  • data/mysql/db.MYI
  • data/mysql/db.frm
  • data/mysql/func.MYI
  • data/mysql/func.frm
  • data/mysql/help_category.MYD
  • data/mysql/help_category.MYI
  • data/mysql/help_category.frm
  • data/mysql/help_keyword.MYD
  • data/mysql/help_keyword.MYI
  • data/mysql/help_keyword.frm
  • data/mysql/help_relation.MYD
  • data/mysql/help_relation.MYI
  • data/mysql/help_relation.frm
  • data/mysql/help_topic.MYD
  • data/mysql/help_topic.MYI
  • data/mysql/help_topic.frm
  • data/mysql/host.MYI
  • data/mysql/host.frm
  • data/mysql/tables_priv.MYI
  • data/mysql/tables_priv.frm
  • data/mysql/time_zone.MYI
  • data/mysql/time_zone.frm
  • data/mysql/time_zone_leap_second.MYI
  • data/mysql/time_zone_leap_second.frm
  • data/mysql/time_zone_name.MYI
  • data/mysql/time_zone_name.frm
  • data/mysql/time_zone_transition.MYI
  • data/mysql/time_zone_transition.frm
  • data/mysql/time_zone_transition_type.MYI
  • data/mysql/time_zone_transition_type.frm
  • data/mysql/user.MYD
  • data/mysql/user.MYI
  • data/mysql/user.frm
  • help.doc
    .doc windows office2003
  • hotelMIS.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • libmySQL.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • license.rtf
    .rtf
  • license.txt
  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • my.ini
  • mysqld.exe
    .exe windows:4 windows x86 arch:x86

    0a06d5bea6f0ec31ca8f2a2377e47428


    Headers

    Imports

    Sections

  • res/Thumbs.db
  • res/bitmap1.bmp
  • res/bitmap2.bmp
  • res/idcwest.bmp
  • res/table.bmp
  • set.ini
  • share/charsets/Index.xml
    .xml
  • share/charsets/README
  • share/charsets/armscii8.xml
    .xml
  • share/charsets/ascii.xml
    .xml
  • share/charsets/cp1250.xml
    .xml
  • share/charsets/cp1251.xml
    .xml
  • share/charsets/cp1256.xml
    .xml
  • share/charsets/cp1257.xml
    .xml
  • share/charsets/cp850.xml
    .xml
  • share/charsets/cp852.xml
    .xml
  • share/charsets/cp866.xml
    .xml
  • share/charsets/dec8.xml
    .xml
  • share/charsets/geostd8.xml
    .xml
  • share/charsets/greek.xml
    .xml
  • share/charsets/hebrew.xml
    .xml
  • share/charsets/hp8.xml
    .xml
  • share/charsets/keybcs2.xml
    .xml
  • share/charsets/koi8r.xml
    .xml
  • share/charsets/koi8u.xml
    .xml
  • share/charsets/languages.html
    .sh linux
  • share/charsets/latin1.xml
    .xml
  • share/charsets/latin2.xml
    .xml
  • share/charsets/latin5.xml
    .xml
  • share/charsets/latin7.xml
    .xml
  • share/charsets/macce.xml
    .xml
  • share/charsets/macroman.xml
    .xml
  • share/charsets/swe7.xml
    .xml
  • share/english/errmsg.sys
  • share/english/errmsg.txt
  • share/italian/errmsg.sys
  • share/italian/errmsg.txt
  • sound/msg.wav
  • tmpl/ReportDay.xlt
    .xls .xlt windows office2003
  • tmpl/ReportSsy.xlt
    .xls .xlt windows office2003
  • tmpl/inrep.xlt
    .xls .xlt windows office2003
  • tmpl/outrep.xlt
    .xls .xlt windows office2003
  • tmpl/reportdetails.xlt
    .xls .xlt windows office2003
  • tmpl/ticket.xlt
    .xls .xlt windows office2003
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections

  • uninstall.bat
  • 新云软件.url
    .url