Overview

overview

7

Static

static

7

shua22.exe

windows7-x64

7

shua22.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

ExtMenu.dll

windows7-x64

3

ExtMenu.dll

windows10-2004-x64

3

HtmlView.dll

windows7-x64

3

HtmlView.dll

windows10-2004-x64

3

Proxy/ShowIP.exe

windows7-x64

7

Proxy/ShowIP.exe

windows10-2004-x64

7

RegEx.dll

windows7-x64

3

RegEx.dll

windows10-2004-x64

3

Res/sx.exe

windows7-x64

3

Res/sx.exe

windows10-2004-x64

3

add-ons.dll

windows7-x64

3

add-ons.dll

windows10-2004-x64

3

com.dll

windows7-x64

3

com.dll

windows10-2004-x64

3

dp1.dll

windows7-x64

3

dp1.dll

windows10-2004-x64

3

eCompress.dll

windows7-x64

3

eCompress.dll

windows10-2004-x64

3

help.chm

windows7-x64

1

help.chm

windows10-2004-x64

1

iext.dll

windows7-x64

3

iext.dll

windows10-2004-x64

3

iext2.dll

windows7-x64

3

iext2.dll

windows10-2004-x64

3

krnln.dll

windows7-x64

3

krnln.dll

windows10-2004-x64

3

qidasoft.dll

windows7-x64

3

qidasoft.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    8d14e2d9788658b08bcb3fb4b83c7387_JaffaCakes118

  • Size

    4.2MB

  • MD5

    8d14e2d9788658b08bcb3fb4b83c7387

  • SHA1

    c8bed47fd2fc342091846a86652d3148def1f128

  • SHA256

    8189b7fb84d8442a961fa26f2ff4359e7cf135b5f623835b5bb49fd34d82b62e

  • SHA512

    4eec64941efac8908ba855f1c1aa84935dd92a942e0e194bba35849a8a290199d171d7a557b18118a2bd767de0a01db1f80479bf5f052338f87f649884bf3a51

  • SSDEEP

    98304:cK/Y3DSKK3HTM5lhsrW8om0yI0TO9kc7Z:RkSKKXNom0AK9xZ

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • 8d14e2d9788658b08bcb3fb4b83c7387_JaffaCakes118
    .rar
  • shua22.exe
    .exe windows:4 windows x86 arch:x86

    9c523d8653da5455667e3f82274f2f88


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • ExtMenu.fne
    .dll windows:4 windows x86 arch:x86

    85e55ca982fd8dda15c0ccd8ff47baae


    Headers

    Imports

    Exports

    Sections

  • HtmlView.fne
    .dll windows:4 windows x86 arch:x86

    7a1f3f7ebb7f027393fa36fd3eaa9c10


    Headers

    Imports

    Exports

    Sections

  • License.TXT
  • Proxy/QQWry.DAT
  • Proxy/ShowIP.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Proxy/ieproxy.txt
  • Proxy/proxy.txt
  • Proxy/task.ini
  • Proxy/url.ini
  • Proxy/˵.txt
  • Readme.txt
  • RegEx.fne
    .dll windows:4 windows x86 arch:x86

    f41f5f0cdf77fafcb62fe9609833b07b


    Headers

    Imports

    Exports

    Sections

  • Res/dt.dat
    .jpg
  • Res/icon.dat
  • Res/ie.dat
  • Res/pop.wav
  • Res/shua.dat
    .jpg
  • Res/sx.dat
    .exe windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Sections

  • add-ons.dll
    .dll windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Exports

    Sections

  • auto.ini
  • com.run
    .dll windows:4 windows x86 arch:x86

    1e7533366a641f8159cfe207ceac1e3f


    Headers

    Imports

    Exports

    Sections

  • data/ˢʾ.ini
  • dp1.fne
    .dll windows:4 windows x86 arch:x86

    a198616942b79e67d7da4241ca14ebce


    Headers

    Imports

    Exports

    Sections

  • eCompress.fne
    .dll windows:4 windows x86 arch:x86

    d98e1e0b67bc202d9973340479b36651


    Headers

    Imports

    Sections

  • help.chm
    .chm
  • iext.fnr
    .dll windows:4 windows x86 arch:x86

    f86e54dbf86fab2a0484cdc838c093a0


    Headers

    Imports

    Exports

    Sections

  • iext2.fne
    .dll windows:4 windows x86 arch:x86

    e5a2027315b2096abd6d8673dbb3f488


    Headers

    Imports

    Exports

    Sections

  • krnln.fnr
    .dll windows:4 windows x86 arch:x86

    b14d47449b6dfcb33370c215abba26a2


    Headers

    Imports

    Exports

    Sections

  • qidasoft.dll
    .dll windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Exports

    Sections

  • shua-ie.exe
    .exe windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Sections

  • shua.dbf
  • shua.exe
    .exe windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Sections

  • shua.ini
  • shua.key
  • szqm.dat
  • task.dll
    .dll windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    9c523d8653da5455667e3f82274f2f88


    Headers

    Imports

    Sections

  • user.ini
  • 新云软件.url
    .url