General

  • Target

    a0597c26fbf13fa3132174183e145082_JaffaCakes118

  • Size

    3.4MB

  • MD5

    a0597c26fbf13fa3132174183e145082

  • SHA1

    28b649e4315bc01eaa229fe1bedcc50cfc7cc362

  • SHA256

    d13bd186ea320ec72c4bd4da7b20afaec3cf3747b96ee0519d1d43c4cff43fa1

  • SHA512

    1b819330cb6645c895da56abed0915deb6404466c530ef5448d87bad824e1130d82aaaef69bf66c1e90280642c673d446106ca45cd5db756749d2e42f281189c

  • SSDEEP

    98304:QCi4P6pD8JuWzyU4HxgR7X1A0qMx0txhhMnrnSD8a:BdYuXyUQxgdFRqMmgr29

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • a0597c26fbf13fa3132174183e145082_JaffaCakes118
    .rar
  • Kanbox-v1.1.7.156.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/Daishu Network/Daishu/bin/wizard/UserDirectory.ico
  • $APPDATA/Kanbox Network/Kanbox/shellext/SyncStatOverlays/icons/errors.ico
  • $APPDATA/Kanbox Network/Kanbox/shellext/SyncStatOverlays/icons/synced.ico
  • $APPDATA/Kanbox Network/Kanbox/shellext/SyncStatOverlays/icons/syncing.ico
  • $APPDATA/Kanbox Network/Kanbox/shellext/SyncStateExt.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    27e377e08c35f71c54e38eabc5807b1b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $APPDATA/Kanbox Network/Kanbox/shellext/SyncStateExtX64.dll
    .dll regsvr32 windows:5 windows x64 arch:x64

    1900a7b4824e11e1a7f84d920d182c38


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/GetVersion.dll
    .dll windows:5 windows x86 arch:x86

    fb1aa2bbc159c94cb45792330366bd5f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/KillProc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/ProcDll.dll
    .dll windows:4 windows x86 arch:x86

    6aac02222a7107798e494b35d1b0b7d6


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/Processes.dll
    .dll windows:5 windows x86 arch:x86

    eaa5f91829171a65db414b9e64ec9548


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/update.bmp
  • $PLUGINSDIR/update.ini
  • CrashReporter.dll
    .dll windows:5 windows x86 arch:x86

    989c00ed3b1e48eafdea6aed46e332d4


    Headers

    Imports

    Exports

    Sections

  • CrashReporterSilent.exe
    .exe windows:5 windows x86 arch:x86

    084700d3b5370566356cfb3f541b5a9e


    Headers

    Imports

    Sections

  • Kanbox.exe
    .exe windows:5 windows x86 arch:x86

    7d3f6fa2a2e0febe2f42116f03adc50e


    Code Sign

    Headers

    Imports

    Sections

  • KanboxUpdate.exe
    .exe windows:5 windows x86 arch:x86

    349f982a624258df4dbe31bfe0a68d59


    Code Sign

    Headers

    Imports

    Sections

  • Locales/zh-CN.dll
    .dll windows:5 windows x86 arch:x86

    017bedb7c245d6db216a4e5e6b73062f


    Headers

    Imports

    Sections

  • Microsoft.VC90.CRT.manifest
    .xml
  • Resources/zh-CN/Images/UserDirectory.ico
  • Resources/zh-CN/Images/about.png
    .png
  • Resources/zh-CN/Images/after_login.png
    .png
  • Resources/zh-CN/Images/before_login.png
    .png
  • Resources/zh-CN/Images/introduction_1.png
    .png
  • Resources/zh-CN/Images/introduction_2.png
    .png
  • Resources/zh-CN/Images/introduction_3.png
    .png
  • Resources/zh-CN/Images/login.png
    .png
  • Resources/zh-CN/Images/package.png
    .png
  • Resources/zh-CN/Images/register.png
    .png
  • Resources/zh-CN/Images/taskbar_notify.png
    .png
  • Resources/zh-CN/Images/wizard_large.png
    .png
  • Resources/zh-CN/Images/wizard_small.png
    .png
  • auxupdate.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    17e3f8b4827f90d79911868bc672b2f5


    Headers

    Imports

    Exports

    Sections

  • cvt.exe
    .exe windows:5 windows x86 arch:x86

    e2533ba0bed684bdb9c1fa304466347a


    Code Sign

    Headers

    Imports

    Sections

  • disk_cache.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    04bb1febe8c949ab7ab28f39824d65b5


    Headers

    Imports

    Exports

    Sections

  • down_surf.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    2bc633724a61832b699f5dd1558cc029


    Headers

    Imports

    Exports

    Sections

  • framework.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    5b030b45071844985ae1e5d1364aaea3


    Headers

    Imports

    Exports

    Sections

  • job_dispatcher.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    545496655d61f54a21cea3c153581883


    Headers

    Imports

    Exports

    Sections

  • mg.dll
    .dll windows:5 windows x86 arch:x86

    ce2c8a470e455fba65eae595b78ef060


    Headers

    Imports

    Exports

    Sections

  • msvcm90.dll
    .dll windows:5 windows x86 arch:x86

    2e705c0231c4d814c2d2191566905482


    Headers

    Imports

    Exports

    Sections

  • msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • netproxy.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    0cdf0fb5000b994e71f2b0e032de659a


    Headers

    Imports

    Exports

    Sections

  • p2sp_manager.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    3b89d5bfeaf684887547dffb42cd9cb5


    Headers

    Imports

    Exports

    Sections

  • rpt.dll
    .dll windows:5 windows x86 arch:x86

    5b6f2395f8073df5e41d014e650ca9f6


    Headers

    Imports

    Exports

    Sections

  • stat.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    958b012128dbed5503b2c602a922263c


    Headers

    Imports

    Exports

    Sections

  • syncbox.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    8b9d458d415a238ae0ef67dd93300e4c


    Headers

    Imports

    Exports

    Sections

  • sys_mon.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    d5f8de020ea421c2d19a1763a5ff94e5


    Headers

    Imports

    Exports

    Sections

  • token_id.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    989e5825c1e7e5cfc8f828432fdf2e05


    Headers

    Imports

    Exports

    Sections

  • uninst.exe.nsis
  • zlib1.dll
    .dll windows:5 windows x86 arch:x86

    e8fcd924004be61375969e3c785cbe33


    Headers

    Imports

    Exports

    Sections

  • 新云软件.url
    .url