General

  • Target

    bb446d7d4048c3a3d0024fed62170bce_JaffaCakes118

  • Size

    2.0MB

  • MD5

    bb446d7d4048c3a3d0024fed62170bce

  • SHA1

    c8d535488a93726405addabef43fbb129fd77e27

  • SHA256

    c5987d44c0bc189124f6924e3e2380f606acb42ce4834b35e7ed20cf43b50338

  • SHA512

    6432aea483a21b30a2ed029fbb0e55ea007e58f77e5c843630b3e3c91b35cd90871e75a7b87c382a3be8ff5bd13b163903194066069b7b39bd17c031ec9011bc

  • SSDEEP

    49152:aQJXsq/tgD5UQ78kfc/vdnyf3KtlEnFFNsji/qZ:rNs0tK5L8kSh4EunNsj/

Score
3/10

Malware Config

Signatures

  • Unsigned PE 29 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • bb446d7d4048c3a3d0024fed62170bce_JaffaCakes118
    .rar
  • NShutClt.exe
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • NShutClt/BaseRun.dll
    .dll windows:5 windows x86 arch:x86

    6be0bf36d1c3fc7d34a1ec50844a1298


    Headers

    Imports

    Exports

    Sections

  • NShutClt/Microsoft.VC90.CRT.manifest
    .xml
  • NShutClt/Microsoft.VC90.MFC.manifest
    .xml
  • NShutClt/MsgBlkMgr.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    1a6ee5339bdd1917c06ffcb406b19e51


    Headers

    Imports

    Exports

    Sections

  • NShutClt/NShutClt.exe
    .exe windows:5 windows x86 arch:x86

    cbd67e6d0a1b44fd056764084d4c07e4


    Headers

    Imports

    Sections

  • NShutClt/NShutProc.dll
    .dll windows:5 windows x86 arch:x86

    e2c95f63ef096f730ce52e69d786891d


    Headers

    Imports

    Exports

    Sections

  • NShutClt/NsdDrvMgr.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    29db85b9a0e01c7b76d01f5dc36354e8


    Headers

    Imports

    Exports

    Sections

  • NShutClt/SysInfoMgr.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    a0289563e49d4bedbcdbfb3fcc253996


    Headers

    Imports

    Exports

    Sections

  • NShutClt/Task.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    62012fabe55c1e6be1f50147edc496e7


    Headers

    Imports

    Exports

    Sections

  • NShutClt/YtNShtDnw.sys
    .sys windows:5 windows x86 arch:x86

    2f44fd29969ce48906b1357a420c1eac


    Headers

    Imports

    Sections

  • NShutClt/YtUpAst.exe
    .exe windows:5 windows x86 arch:x86

    4b85821eb488d7c6b6a53f76dc98b3e9


    Headers

    Imports

    Sections

  • NShutClt/fav_369.ico
  • NShutClt/fav_sdl.ico
  • NShutClt/fav_yit.ico
  • NShutClt/import/abase.dll
  • NShutClt/import/dbase.dll
  • NShutClt/mfc90.dll
    .dll windows:5 windows x86 arch:x86

    f2d8030f2fb5ae92ea26c320740a673b


    Code Sign

    Headers

    Imports

    Sections

  • NShutClt/msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NShutClt/msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NShutClt/nshuthelp.chm
    .chm
  • UninstNShutClt.exe
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • NShutSvr.exe
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • NShutSvr/BaseRun.dll
    .dll windows:5 windows x86 arch:x86

    6be0bf36d1c3fc7d34a1ec50844a1298


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/CndSkin.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    49a2cf9620d17bf5068481ec56a94984


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/CndSkinRes.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    630acc6f999b3bc6a2806bba43c531bb


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/LogMgr.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    767351fe346791e7f370d358d9d49a43


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/Microsoft.VC90.CRT.manifest
    .xml
  • NShutSvr/Microsoft.VC90.MFC.manifest
    .xml
  • NShutSvr/MsgBlkMgr.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    1a6ee5339bdd1917c06ffcb406b19e51


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/MsgTranSvr.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    af4273b9eeba64f3f23eb821f37f8079


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/NShutSvr.exe
    .exe windows:5 windows x86 arch:x86

    e362f16eeefd44d84b8a564c4eb1c40a


    Headers

    Imports

    Sections

  • NShutSvr/PreSkinRes.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    630acc6f999b3bc6a2806bba43c531bb


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/Task.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    62012fabe55c1e6be1f50147edc496e7


    Headers

    Imports

    Exports

    Sections

  • NShutSvr/YtUpAst.exe
    .exe windows:5 windows x86 arch:x86

    4b85821eb488d7c6b6a53f76dc98b3e9


    Headers

    Imports

    Sections

  • NShutSvr/fav_369.ico
  • NShutSvr/fav_sdl.ico
  • NShutSvr/fav_yit.ico
  • NShutSvr/import/abase.dll
  • NShutSvr/import/dbase.dll
  • NShutSvr/mfc90.dll
    .dll windows:5 windows x86 arch:x86

    f2d8030f2fb5ae92ea26c320740a673b


    Code Sign

    Headers

    Imports

    Sections

  • NShutSvr/msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NShutSvr/msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NShutSvr/nshuthelp.chm
    .chm
  • UninstNShutSvr.exe
    .exe windows:4 windows x86 arch:x86

    a23455b2d570c1e80b11b92360e41c00


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • 安装说明.txt
  • 新云软件.url
    .url