General

  • Target

    71a2cd2da7e29c24c936ce1749be6167_JaffaCakes118

  • Size

    8.6MB

  • MD5

    71a2cd2da7e29c24c936ce1749be6167

  • SHA1

    5d3bb0f7f88188e8ebc8f5b8c148cfe4644cb699

  • SHA256

    bfdb6a3789438f7d8b4d0b50ac8a78b6e339e34cce95e39b7e6a63936416aa88

  • SHA512

    33bec9312cb4fa3126b242b3937c57a72209b736a11f0d309909b91a613bd739609dee2b6d1a0fdca6c4e2baa6def8d0572fcde78efa581bd9d34b8105e3af01

  • SSDEEP

    196608:ppV+m8Bz3oOB320V0l1LeyZGezdRHwVbvn9QsauvBEKaAAyl:ppOL20CCy0ezdtupQsauvBVAyl

Score
3/10

Malware Config

Signatures

  • Unsigned PE 26 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 8 IoCs

Files

  • 71a2cd2da7e29c24c936ce1749be6167_JaffaCakes118
    .rar
  • bobohu.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $1
    .dll regsvr32 windows:4 windows x86 arch:x86

    b901fcbbf88b13e8035a54829425f562


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • 360LeMenuPlugin.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b901fcbbf88b13e8035a54829425f562


    Headers

    Imports

    Exports

    Sections

  • AddDll/pncrt.dll
    .dll windows:4 windows x86 arch:x86

    828907b7a8ec04c9c4031e40ef2f76ec


    Headers

    Imports

    Exports

    Sections

  • AddDll/quartz.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    e60bbbfbc6b1c1b60090e8425bed75e1


    Headers

    Imports

    Exports

    Sections

  • AddDll/wmsdmod.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    fbe1ed5e25019dbf89ab727cb72c63c7


    Headers

    Imports

    Exports

    Sections

  • AutoUpdate.exe
    .exe windows:4 windows x86 arch:x86

    d778aa86b07446f3e86a95a597b7d634


    Headers

    Imports

    Sections

  • BobohuFilmNotify.exe
    .exe windows:4 windows x86 arch:x86

    ce36921a5e928626cc6f66f5018899e5


    Code Sign

    Headers

    Imports

    Sections

  • BobohuInst.exe
    .exe windows:4 windows x86 arch:x86

    9dc5b93c8af94e1fd5dfd6d03a20925c


    Code Sign

    Headers

    Imports

    Sections

  • Convert.dll
    .dll windows:4 windows x86 arch:x86

    a8767649d18e9bd1cbe197cf1edf326b


    Headers

    Imports

    Exports

    Sections

  • DelQvod.exe
    .exe windows:4 windows x86 arch:x86

    f13ff93f15196689ee90ad6237f96541


    Code Sign

    Headers

    Imports

    Sections

  • FileAss.exe
    .exe windows:4 windows x86 arch:x86

    6cf0f1775914fb27707755569174f92a


    Code Sign

    Headers

    Imports

    Sections

  • InvokeQvodUpdate.exe
    .exe windows:4 windows x86 arch:x86

    1d32c8f1dd7bf352e6725ac066d22db4


    Code Sign

    Headers

    Imports

    Sections

  • Logo.bmp
  • QvodInit.exe
    .exe windows:4 windows x86 arch:x86

    e7cea1b38659e049c1b218e82286fc90


    Headers

    Imports

    Sections

  • QvodPlayer/QvodPlayer.xml
    .xml
  • QvodPlayer/QvodUninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $TEMP/QvodInit.exe
    .exe windows:4 windows x86 arch:x86

    01f6ed59eb715c2fdc6ede31fe9a89f0


    Headers

    Imports

    Sections

  • QvodPlayer/qvodupdate.exe
    .exe windows:4 windows x86 arch:x86

    1d32c8f1dd7bf352e6725ac066d22db4


    Code Sign

    Headers

    Imports

    Sections

  • QvodPlayer/qvodupdate3.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $2/Plugins/2CaiPiao/TTPlugin.ini
  • $2/Plugins/2CaiPiao/cp.ico
  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    d23fbd09100caad5e10f17163f511668


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/QvodInit.exe
    .exe windows:4 windows x86 arch:x86

    b15aa047ced3a842c3d63e77ae9cde2d


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/qvodupdate.ini
  • $SYSDIR/pncrt.dll.new
    .dll windows:4 windows x86 arch:x86

    828907b7a8ec04c9c4031e40ef2f76ec


    Headers

    Imports

    Exports

    Sections

  • AddIn/VisLrc.dll
    .dll windows:4 windows x86 arch:x86

    405f85e6c10ba505edbac8ea83c4ca8c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Codecs/ColorFilter.ax.new
    .dll regsvr32 windows:4 windows x86 arch:x86

    d6358db2b2f2325d29c23c3433a0656f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Codecs/RealMediaSplitter.ax.new
    .dll regsvr32 windows:4 windows x86 arch:x86

    092c362fafa1e9277558c0e5612fdfba


    Headers

    Imports

    Exports

    Sections

  • Codecs/asfsplliter.ax.new
    .dll regsvr32 windows:4 windows x86 arch:x86

    61540ae4d5f1fe29babe6b430f77a241


    Headers

    Imports

    Exports

    Sections

  • Codecs/atrc.dll.new
    .dll windows:4 windows x86 arch:x86

    5132cde9ac8899a69f40dfaacc320c4d


    Headers

    Imports

    Exports

    Sections

  • Codecs/cook.dll.new
    .dll windows:4 windows x86 arch:x86

    7186ef18b8145b9efacd73914d40cee0


    Headers

    Imports

    Exports

    Sections

  • Codecs/drvc.dll.new
    .dll windows:4 windows x86 arch:x86

    5d841dc9603dda4e7058b842c1dedbfc


    Headers

    Imports

    Exports

    Sections

  • Codecs/f4v.swf.new
  • Codecs/raac.dll.new
    .dll windows:4 windows x86 arch:x86

    2569b16af6a5e82c06ef6aed87f5e148


    Headers

    Imports

    Exports

    Sections

  • Lang/en_US.dll.new
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • Lang/zh_TW.dll.new
    .dll windows:4 windows x86 arch:x86

    5c54715227e960c5019e7a45d4b9d02a


    Headers

    Imports

    Sections

  • NetAgent.dll.new
    .dll windows:4 windows x86 arch:x86

    f618d4cb4d41a461355f2eab6ae077ff


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Pic6.bmp
  • QvodBand.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    0e32a3b828b41920c248142fcbc590d3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QvodExtend.dll.new
    .dll regsvr32 windows:4 windows x86 arch:x86

    5fa4c601c60be9d7e5a41cb73948ac64


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QvodInit.exe
    .exe windows:4 windows x86 arch:x86

    b15aa047ced3a842c3d63e77ae9cde2d


    Code Sign

    Headers

    Imports

    Sections

  • QvodInsert.dll.new
    .dll regsvr32 windows:4 windows x86 arch:x86

    406e97547d07646b8f8ca87533146c5a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QvodPlayer.exe
    .exe windows:4 windows x86 arch:x86

    5ea9ccbaeabb458ce99865b2d7992c8f


    Code Sign

    Headers

    Imports

    Sections

  • QvodTerminal.exe
    .exe windows:4 windows x86 arch:x86

    86a5544140f92798157b7e89931725aa


    Code Sign

    Headers

    Imports

    Sections

  • ShareModule.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    4d31033905b7f9799eebc95dce22db30


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Skin/Default.xml
  • Skin/Default/back.bmp
  • Skin/Default/backleft.bmp
  • Skin/Default/backmid.bmp
  • Skin/Default/backright.bmp
  • Skin/Default/bgline.bmp
  • Skin/Default/bleft1.bmp
  • Skin/Default/bottom.bmp
  • Skin/Default/bottomleft.bmp
  • Skin/Default/bottomright.bmp
  • Skin/Default/bright1.bmp
  • Skin/Default/caption.bmp
  • Skin/Default/close.bmp
  • Skin/Default/full.bmp
  • Skin/Default/icon.bmp
  • Skin/Default/info.bmp
  • Skin/Default/infofull.bmp
  • Skin/Default/left.bmp
  • Skin/Default/left1.bmp
  • Skin/Default/listbutton.bmp
  • Skin/Default/listbutton2.bmp
  • Skin/Default/listsplit.bmp
  • Skin/Default/lsearchb1.bmp
  • Skin/Default/lsearchb2.bmp
  • Skin/Default/lsearchbg.bmp
  • Skin/Default/lsearchbg1.bmp
  • Skin/Default/max.bmp
  • Skin/Default/media_del.bmp
  • Skin/Default/media_files.bmp
  • Skin/Default/media_files_2.bmp
  • Skin/Default/media_fill.bmp
  • Skin/Default/media_info.bmp
  • Skin/Default/media_search.bmp
  • Skin/Default/media_sham.bmp
  • Skin/Default/media_sham_2.bmp
  • Skin/Default/mediaeditdel.bmp
  • Skin/Default/mediare.bmp
  • Skin/Default/mediatolist.bmp
  • Skin/Default/mediatree.bmp
  • Skin/Default/menu.bmp
  • Skin/Default/min.bmp
  • Skin/Default/mtk.bmp
  • Skin/Default/mute.bmp
  • Skin/Default/mute2.bmp
  • Skin/Default/next.bmp
  • Skin/Default/nowplay.bmp
  • Skin/Default/open.bmp
  • Skin/Default/pause.bmp
  • Skin/Default/play.bmp
  • Skin/Default/playlist_toolbar.bmp
  • Skin/Default/pre.bmp
  • Skin/Default/processp.bmp
  • Skin/Default/progress.bmp
  • Skin/Default/progress_point_a.bmp
  • Skin/Default/progress_point_b.bmp
  • Skin/Default/progress_thumb.bmp
  • Skin/Default/reold.bmp
  • Skin/Default/right.bmp
  • Skin/Default/right1.bmp
  • Skin/Default/scroll_back.bmp
  • Skin/Default/scroll_back_h.bmp
  • Skin/Default/scroll_down.bmp
  • Skin/Default/scroll_left.bmp
  • Skin/Default/scroll_limit.bmp
  • Skin/Default/scroll_limit_h.bmp
  • Skin/Default/scroll_right.bmp
  • Skin/Default/scroll_up.bmp
  • Skin/Default/search_botton.bmp
  • Skin/Default/search_icon.bmp
  • Skin/Default/stop.bmp
  • Skin/Default/tab.bmp
  • Skin/Default/tab1.bmp
  • Skin/Default/tabs_fill.bmp
  • Skin/Default/tabs_left.bmp
  • Skin/Default/tabs_mid.bmp
  • Skin/Default/tabs_right.bmp
  • Skin/Default/tabs_search_fill.bmp
  • Skin/Default/tabs_search_left.bmp
  • Skin/Default/top.bmp
  • Skin/Default/topleft.bmp
  • Skin/Default/topleft1.bmp
  • Skin/Default/topright.bmp
  • Skin/Default/topright1.bmp
  • Skin/Default/volume.bmp
  • Skin/Default/volumeb.bmp
  • Skin/Default/volumep.bmp
  • Skin/Logo.bmp
  • Skin/MiNi/back.bmp
  • Skin/MiNi/info.bmp
  • Skin/MiNi/mute.bmp
  • Skin/MiNi/mute2.bmp
  • Skin/MiNi/next.bmp
  • Skin/MiNi/open.bmp
  • Skin/MiNi/pause.bmp
  • Skin/MiNi/play.bmp
  • Skin/MiNi/pre.bmp
  • Skin/MiNi/processp.bmp
  • Skin/MiNi/progress.bmp
  • Skin/MiNi/progress_thumb.bmp
  • Skin/MiNi/progressd.bmp
  • Skin/MiNi/volume.bmp
  • Skin/MiNi/volumeb.bmp
  • Skin/MiNi/volumep.bmp
  • Skin/Mini.xml
  • Tip/PopMessage.xml
    .xml
  • Tip/QvodTip.exe
    .exe windows:4 windows x86 arch:x86

    3d812c4c97128ca0e08c8dab57ae38e0


    Code Sign

    Headers

    Imports

    Sections

  • Tip/QvodTips.dll
    .dll windows:4 windows x86 arch:x86

    d7778d884b245e49861f228104669703


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Tip/back.bmp
  • Tip/close.bmp
  • Tip/maintext.bmp
  • Tip/view.bmp
  • Viewdata/Ϸ.swf
  • Viewdata/Ϲ.swf
  • Viewdata/Ƶ.swf
  • QvodUninst.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $TEMP/QvodInit.exe
    .exe windows:4 windows x86 arch:x86

    046ffdec516a2069a4f2a6b53a135700


    Code Sign

    Headers

    Imports

    Sections

  • Transcoding.ini
  • VideoConvertor.exe
    .exe windows:4 windows x86 arch:x86

    9a3cc192f551abb479bb1ebfb34d6164


    Code Sign

    Headers

    Imports

    Sections

  • addon/bobohu.exe
    .exe windows:4 windows x86 arch:x86

    eccaa25ef1d40bb77bffc8c6c7e2156a


    Code Sign

    Headers

    Imports

    Sections

  • addon/down.link
  • addon/endpic.gif
    .gif
  • addon/flash_1.swf
  • addon/flash_2.swf
  • addon/flash_3.swf
  • addon/flash_4.swf
  • addon/flash_5.swf
  • addon/index_end.html
    .html .js polyglot
  • addon/index_front.html
    .html .js polyglot
  • addon/jquery.js
    .js
  • addon/loading.swf
  • addon/loading2.swf
  • addon/loading3.swf
  • addon/puke.swf
  • bobohukey.conf
  • coder.exe
    .exe windows:4 windows x86 arch:x86

    569e683b90ac4876d8b263686b81dd0b


    Headers

    Imports

    Sections

  • dll/360LeMenuPlugin.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    b901fcbbf88b13e8035a54829425f562


    Headers

    Imports

    Exports

    Sections

  • geturl1.htm
    .html .js polyglot
  • geturl2.htm
    .html .js polyglot
  • geturl3.htm
    .html .js polyglot
  • help.swf
  • key.txt
    .xml
  • msscript.ocx
    .dll regsvr32 windows:5 windows x86 arch:x86

    3793b90a92464f525c430a6b5fdf224f


    Headers

    Imports

    Exports

    Sections

  • player.ico
  • skin/blue/main/asset/admin/javascript/jquery.js
    .js
  • skin/blue/main/asset/images/loading.swf
  • skin/blue/main/asset/javascript/jquery.js
    .js
  • skin/default/main/asset/admin/javascript/jquery.js
    .js
  • skin/default/main/asset/images/loading.swf
  • skin/default/main/asset/javascript/jquery.js
    .js
  • skin/red/main/asset/admin/javascript/jquery.js
    .js
  • skin/red/main/asset/images/loading.swf
  • skin/red/main/asset/javascript/jquery.js
    .js
  • skin/redaqua/main/asset/admin/javascript/jquery.js
    .js
  • skin/redaqua/main/asset/images/loading.swf
  • skin/redaqua/main/asset/javascript/jquery.js
    .js
  • skin/white/main/asset/admin/javascript/jquery.js
    .js
  • skin/white/main/asset/images/loading.swf
  • skin/white/main/asset/javascript/jquery.js
    .js
  • update_config.x
  • video.swf
  • 新云软件.url
    .url