Overview

overview

7

Static

static

7

kureeII.exe

windows7-x64

7

kureeII.exe

windows10-2004-x64

7

$0.dll

windows7-x64

3

$0.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$R0.dll

windows7-x64

3

$R0.dll

windows10-2004-x64

3

$R2/NSIS.L...4_.exe

windows7-x64

1

$R2/NSIS.L...4_.exe

windows10-2004-x64

3

$TEMP/enjoyie_2.0.exe

windows7-x64

7

$TEMP/enjoyie_2.0.exe

windows10-2004-x64

7

data/trans.htm

windows7-x64

3

data/trans.htm

windows10-2004-x64

3

enjoyie.exe

windows7-x64

7

enjoyie.exe

windows10-2004-x64

7

help/about.htm

windows7-x64

3

help/about.htm

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$TEMP/kcheck.dll

windows7-x64

3

$TEMP/kcheck.dll

windows10-2004-x64

7

Kuree.exe

windows7-x64

3

Kuree.exe

windows10-2004-x64

3

FSControlBar.js

windows7-x64

3

FSControlBar.js

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    95253d570d56fcc048c79c7714e13237_JaffaCakes118

  • Size

    1.3MB

  • MD5

    95253d570d56fcc048c79c7714e13237

  • SHA1

    001c9b06171d378c1e235026859ae6425a954192

  • SHA256

    b1d0b27decad07ff3e741556397de8d2b235b309db79cc74727e4634b5ca0088

  • SHA512

    e6ab1969f9b0f57fb589f78451a6b2d037e5e9fb0766e2f3942031f946145a7cc198e4ff3fbb9319c4fc26f1f256fd97c488fda310bfc3573e1cc18191ec8c69

  • SSDEEP

    24576:yHI0G1lZCUJC4+dxz4Oyj4tqnshGBjdHRhszDiOYfvTwKnzH8cNfp/jczz/:yNsZzJ4WhxeDiOYjwKnL8UjSz

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • 95253d570d56fcc048c79c7714e13237_JaffaCakes118
    .rar
  • kureeII.exe
    .exe windows:4 windows x86 arch:x86

    9c523d8653da5455667e3f82274f2f88


    Headers

    Imports

    Sections

  • $0
    .dll regsvr32 windows:4 windows x86 arch:x86

    89091684a5f29614d8cd09e3ec5ed342


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/EnjoyIE.ini
  • $PLUGINSDIR/IEFunctions.dll
    .dll windows:4 windows x86 arch:x86

    d3ade25d7710cc7b0801440c6df6098c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $R0
    .dll regsvr32 windows:4 windows x86 arch:x86

    61144194c34a82253984f0dc353f8e4a


    Headers

    Imports

    Exports

    Sections

  • $R2/NSIS.Library.RegTool.v2.$_4_.exe
    .exe windows:4 windows x86 arch:x86

    27613a5a6234b2a2609ff90c91288dae


    Headers

    Imports

    Sections

  • $TEMP/EnjoyIE.bmp
  • $TEMP/enjoyie_2.0.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • data/checked.gif
    .gif
  • data/lastunclose.htm
    .html .js polyglot
  • data/link.ini
  • data/top.png
    .png
  • data/trans.htm
    .html
  • data/unchecked.gif
    .gif
  • enjoyie.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • filter.ini
  • help/about.htm
    .html
  • skin/default/bg_button.bmp
  • skin/default/bg_main.bmp
  • skin/default/bg_side.bmp
  • skin/default/bg_side_top.bmp
  • skin/default/bg_state.bmp
  • skin/default/bg_tab.bmp
  • skin/default/bg_title.bmp
  • skin/default/frame.bmp
  • skin/default/ico_addbar.bmp
  • skin/default/ico_main.bmp
  • skin/default/ico_main_gray.bmp
  • skin/default/ico_ot.bmp
  • skin/default/ico_side.bmp
  • skin/default/ico_win.bmp
  • skin/default/side_active.bmp
  • skin/default/side_unactive.bmp
  • skin/default/tab_active.bmp
  • skin/default/tab_unactive.bmp
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $TEMP/kcheck.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • Kuree.exe
    .exe windows:4 windows x86 arch:x86

    1a1eb93240ab1cd49d9e016e5d79adf7


    Headers

    Imports

    Sections

  • SKin/.zip
    .zip
  • FSControlBar.js
    .js
  • FSControlBar_left.bmp
  • FSControlBar_mid.bmp
  • FSControlBar_right.bmp
  • HideRight.bmp
  • LeftDrag_Mid.bmp
  • RightDrag_Mid.bmp
  • blue.js
    .js
  • bottomleft.bmp
  • bottomright.bmp
  • bottomstretch.bmp
  • eq.bmp
  • eq.js
    .js
  • framebottomStretch.bmp
  • frameleftStretch.bmp
  • frameleftbottom.bmp
  • framelefttop.bmp
  • framerightStretch.bmp
  • framerightbottom.bmp
  • framerighttop.bmp
  • frametopStretch.bmp
  • horibkg.bmp
  • horifrg.bmp
  • pladd.bmp
  • playmode.bmp
  • pldel.bmp
  • pltitlebk.bmp
  • progress_slider_backgnd.bmp
  • progress_slider_foregnd.bmp
  • showright.bmp
  • skin_btn_close.bmp
  • skin_btn_exitfs.bmp
  • skin_btn_fullscreen.bmp
  • skin_btn_max.bmp
  • skin_btn_min.bmp
  • skin_btn_next.bmp
  • skin_btn_openfile.bmp
  • skin_btn_pause.bmp
  • skin_btn_play.bmp
  • skin_btn_prev.bmp
  • skin_btn_printscreen.bmp
  • skin_btn_restore.bmp
  • skin_btn_restorespeed.bmp
  • skin_btn_scal.bmp
  • skin_btn_setting.bmp
  • skin_btn_slowdown.bmp
  • skin_btn_speedup.bmp
  • skin_btn_stop.bmp
  • skin_btn_voice.bmp
  • skin_slider_progress.bmp
  • skin_slider_thumb.bmp
  • skinlist.bmp
  • statusbarstretch.bmp
  • topleft.bmp
  • topright.bmp
  • topstretch.bmp
  • vertbkg.bmp
  • vertfrg.bmp
  • vertthumb.bmp
  • volume_slider_backgnd.bmp
  • volume_slider_foregnd.bmp
  • vs_down.bmp
  • vs_tb_ctr.bmp
  • vs_tb_down.bmp
  • vs_tb_up.bmp
  • vs_up.bmp
  • .kps
  • SKin/.zip
    .zip
  • BottomDrag_Mid.bmp
  • FSControlBar.js
    .js
  • FSControlBar_left.bmp
  • FSControlBar_mid.bmp
  • FSControlBar_right.bmp
  • HideBottom.bmp
  • HideRight.bmp
  • LeftDrag_Mid.bmp
  • LeftDrag_TOP.bmp
  • MiddleBottomStretch.bmp
  • MiddleLeftBottom.bmp
  • MiddleLeftStretch.bmp
  • MiddleRightBottom.bmp
  • MiddleRightStretch.bmp
  • MiddleTopRight.bmp
  • MiddleTopStretch.bmp
  • Middlelefttop.bmp
  • RightDrag_TOP.bmp
  • ShowBottom.bmp
  • TopMidMd.bmp
  • bottomleft.bmp
  • bottomright.bmp
  • bottomstretch.bmp
  • ck.bmp
  • close.bmp
  • eq.bmp
  • eq.js
    .js
  • horibkg.bmp
  • horifrg.bmp
  • pladd.bmp
  • playmode.bmp
  • pldel.bmp
  • pltitlebk.bmp
  • progress_slider_backgnd.bmp
  • progress_slider_foregnd.bmp
  • rightDrag_Mid.bmp
  • showright.bmp
  • showtitle.bmp
  • silver.js
    .js
  • skin_TopMidTop.bmp
  • skin_bottommid.bmp
  • skin_btn_close.bmp
  • skin_btn_exitfs.bmp
  • skin_btn_fullscreen.bmp
  • skin_btn_max.bmp
  • skin_btn_min.bmp
  • skin_btn_next.bmp
  • skin_btn_openfile.bmp
  • skin_btn_pause.bmp
  • skin_btn_play.bmp
  • skin_btn_prev.bmp
  • skin_btn_printscreen.bmp
  • skin_btn_restore.bmp
  • skin_btn_restorespeed.bmp
  • skin_btn_scal.bmp
  • skin_btn_setting.bmp
  • skin_btn_slowdown.bmp
  • skin_btn_speedup.bmp
  • skin_btn_stop.bmp
  • skin_btn_voice.bmp
  • skin_slider_progress.bmp
  • skin_slider_thumb.bmp
  • skinlist.bmp
  • slider_Thumb.bmp
  • topleft.bmp
  • topright.bmp
  • topstretch.bmp
  • vert_slider_backgnd.bmp
  • vert_slider_foregnd.bmp
  • vertbkg.bmp
  • vertfrg.bmp
  • vertthumb.bmp
  • volume_slider_backgnd.bmp
  • volume_slider_foregnd.bmp
  • vs_down.bmp
  • vs_tb_ctr.bmp
  • vs_tb_down.bmp
  • vs_tb_up.bmp
  • vs_up.bmp
  • .kps
  • kcore.dll
    .dll windows:4 windows x86 arch:x86

    43f04605592a22264635cf76594d5ed6


    Headers

    Imports

    Exports

    Sections

  • kexpert.dll
    .dll windows:4 windows x86 arch:x86

    e0db544ab204458ceb29612bbb211646


    Headers

    Imports

    Exports

    Sections

  • kparser.dll
    .dll windows:4 windows x86 arch:x86

    68549ac481fc36b8fb913e039d2462d9


    Headers

    Imports

    Exports

    Sections

  • kpfa.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    89091684a5f29614d8cd09e3ec5ed342


    Headers

    Imports

    Exports

    Sections

  • kprobe.dll
    .dll windows:4 windows x86 arch:x86

    424fec88ef590675988282b6d9b34358


    Headers

    Imports

    Exports

    Sections

  • kupdate.dll
    .dll windows:4 windows x86 arch:x86

    b0e7f5377acaf85df3b50b9389774b4a


    Headers

    Imports

    Exports

    Sections

  • media.cfg
  • media.dll
  • players.dll
    .dll windows:4 windows x86 arch:x86

    15ea296ac0f932443a68aedf5e7bc42d


    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    9c523d8653da5455667e3f82274f2f88


    Headers

    Imports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • 安装说明.url
    .url