Overview

overview

7

Static

static

7

COMDLG32.dll

windows7-x64

3

COMDLG32.dll

windows10-2004-x64

3

FastVerCode.dll

windows7-x64

3

FastVerCode.dll

windows10-2004-x64

3

MSCOMCTL.dll

windows7-x64

3

MSCOMCTL.dll

windows10-2004-x64

3

Newtonsoft.Json.dll

windows7-x64

1

Newtonsoft.Json.dll

windows10-2004-x64

1

SoftAttr.dll

windows7-x64

7

SoftAttr.dll

windows10-2004-x64

7

TABCTL32.dll

windows7-x64

3

TABCTL32.dll

windows10-2004-x64

3

UUWiseHelper.dll

windows7-x64

3

UUWiseHelper.dll

windows10-2004-x64

3

UpdateLab.dll

windows7-x64

3

UpdateLab.dll

windows10-2004-x64

3

VBRouterChangeIP.dll

windows7-x64

3

VBRouterChangeIP.dll

windows10-2004-x64

3

bfbr.exe

windows7-x64

3

bfbr.exe

windows10-2004-x64

3

dm.dll

windows7-x64

7

dm.dll

windows10-2004-x64

7

lua5.1.dll

windows7-x64

3

lua5.1.dll

windows10-2004-x64

3

plug/UnRAR.exe

windows7-x64

3

plug/UnRAR.exe

windows10-2004-x64

3

save/Noname1.html

windows7-x64

3

save/Noname1.html

windows10-2004-x64

3

save/Route...te.exe

windows7-x64

3

save/Route...te.exe

windows10-2004-x64

3

softUpdate.exe

windows7-x64

3

softUpdate.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    c784b03030d2a4101be5fd60ebfb8906_JaffaCakes118

  • Size

    8.8MB

  • MD5

    c784b03030d2a4101be5fd60ebfb8906

  • SHA1

    c27611d4c10655c9c9a97bbcbf1918b9882af4dc

  • SHA256

    6f3aace79c91bd49aa7be2dff5cf4adc59e9db63c76120cbb74a2f060316bca4

  • SHA512

    88c1adea509faa9e232632ea9a9ec5a3a05adf41fdbb567eaf9c3edd7f3d3098a2b700479d6ebea96b82513b8cb33e3f0cb831f776561ee10be0e67b59daa8f0

  • SSDEEP

    196608:rYS+W49oILWz/WPJEA9OaYvOrIwsu9h5ijmQGSnLi12LA:rAWIoIL4/+EAklvOrbv5iC5Sm3

Score
7/10
vmprotectaspackv2upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

Files

  • c784b03030d2a4101be5fd60ebfb8906_JaffaCakes118
    .rar
  • 163City
  • COMDLG32.OCX
    .dll regsvr32 windows:4 windows x86 arch:x86

    988f29c1eb8054253091352741683c76


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Ctry.xml
  • FastVerCode.dll
    .dll windows:4 windows x86 arch:x86

    018dd474ecd799abb2a53bc709d521b1


    Headers

    Imports

    Exports

    Sections

  • MSCOMCTL.OCX
    .dll regsvr32 windows:4 windows x86 arch:x86

    b22bd7d6f2b83c193c4c7e9c0a2de8b2


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Repair.ini
  • Res/oem
  • Res/oem2
  • SoftAttr.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    84bdcafc7e3c7332ed8718aefb1140a2


    Headers

    Imports

    Exports

    Sections

  • TABCTL32.OCX
    .dll regsvr32 windows:4 windows x86 arch:x86

    aa8b0ec5b7d56e08d6614ae243221096


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • UUExtConfig.ini
  • UUWiseHelper.dll
    .dll windows:5 windows x86 arch:x86

    e0e9f277ce989ebccdd368f3ac3dd37c


    Headers

    Imports

    Exports

    Sections

  • UpdateLab.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • VBRouterChangeIP.dll
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • VersionConfig.cfg
  • bfbr.dll
    .exe windows:4 windows x86 arch:x86

    71825f2e838423d0bc44968f8cc0bb7f


    Headers

    Imports

    Sections

  • dm.dll
    .dll regsvr32 windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • login.cfg
  • lua5.1.dll
    .dll windows:4 windows x86 arch:x86

    df5ee731556844566bd09eb9e0c19cfb


    Headers

    Imports

    Exports

    Sections

  • pic/pageN.bmp
  • plug/UnRAR.exe
    .exe windows:4 windows x86 arch:x86

    cf6ca145896f9d37f7f4799cce56ed2f


    Headers

    Imports

    Exports

    Sections

  • plug/ver.ini
  • router.cfg
  • save/NewCity.ini
  • save/Noname1.html
    .html .js polyglot
  • save/Routers/Compatible_635574497933895731.lua
  • save/Routers/Compatible_635574497933945163.lua
  • save/Routers/Compatible_635574497933965149.lua
  • save/Routers/Compatible_635574497933985144.lua
  • save/Routers/Compatible_635574497934005149.lua
  • save/Routers/Compatible_635574497934035148.lua
  • save/Routers/Compatible_635574497934055158.lua
  • save/Routers/Compatible_635574497934085156.lua
  • save/Routers/Compatible_635574497934105157.lua
  • save/Routers/Compatible_635574497934135160.lua
  • save/Routers/Compatible_635574497934175161.lua
  • save/Routers/Compatible_635574497934205164.lua
  • save/Routers/Compatible_635574497934235186.lua
  • save/Routers/Compatible_635574497934265194.lua
  • save/Routers/Compatible_635574497934285170.lua
  • save/Routers/Compatible_635574497934305166.lua
  • save/Routers/Compatible_635574497934325166.lua
  • save/Routers/Compatible_635574497934345167.lua
  • save/Routers/Compatible_635574497934375185.lua
  • save/Routers/Compatible_635574497934395175.lua
  • save/Routers/Compatible_635574497934415176.lua
  • save/Routers/Compatible_635574497934435186.lua
  • save/Routers/Compatible_635574497934465194.lua
  • save/Routers/Compatible_635574497934485175.lua
  • save/Routers/Compatible_635574497934505180.lua
  • save/Routers/Compatible_635574497934535178.lua
  • save/Routers/Compatible_635574497934555179.lua
  • save/Routers/Compatible_635574497934575179.lua
  • save/Routers/Compatible_635574497934605182.lua
  • save/Routers/Compatible_635574497934625183.lua
  • save/Routers/Compatible_635574497934655186.lua
  • save/Routers/Compatible_635574497934675191.lua
  • save/Routers/Compatible_635574497934695192.lua
  • save/Routers/Compatible_635574497934725190.lua
  • save/Routers/Compatible_635574497934745190.lua
  • save/Routers/Compatible_635574497934775198.lua
  • save/Routers/Compatible_635574497934795194.lua
  • save/Routers/Compatible_635574497934815199.lua
  • save/Routers/Compatible_635574497934845198.lua
  • save/Routers/Compatible_635574497934865198.lua
  • save/Routers/Compatible_635574497934885203.lua
  • save/Routers/Compatible_635574497934915211.lua
  • save/Routers/Compatible_635574497934935197.lua
  • save/Routers/Compatible_635574497934965210.lua
  • save/Routers/Compatible_635574497934985206.lua
  • save/Routers/Compatible_635574497935015209.lua
  • save/Routers/Compatible_635574497935045207.lua
  • save/Routers/Compatible_635574497935075210.lua
  • save/Routers/Compatible_635574497935095215.lua
  • save/Routers/Compatible_635574497935115211.lua
  • save/Routers/Compatible_635574497935145219.lua
  • save/Routers/Compatible_635574497935175217.lua
  • save/Routers/Compatible_635574497935205220.lua
  • save/Routers/Compatible_635574497935225221.lua
  • save/Routers/Compatible_635574497935245226.lua
  • save/Routers/Compatible_635574497935275224.lua
  • save/Routers/Compatible_635574497935295225.lua
  • save/Routers/Compatible_635574497935315225.lua
  • save/Routers/Compatible_635574497935345233.lua
  • save/Routers/Compatible_635574497935365234.lua
  • save/Routers/HUAWEI EchoLife HG510a.lua
  • save/Routers/TPFastMercurySOHOV1.lua
  • save/Routers/TPFastMercurySOHOV2.lua
  • save/Routers/TPFastMercurySOHOV3.lua
  • save/Routers/TPFastMercurySOHOV4.lua
  • save/Routers/TPFastMercurySOHOV5.lua
  • save/Routers/TPFastMercurySOHOV6.lua
  • save/Routers/TPLinkEnterprise.lua
  • save/Routers/VersionConfig.cfg
  • save/Routers/mapping.map
  • save/Routers/tmp/Update.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • save/city_id.txt
  • save/country.txt
  • save/file1.ini
  • save/locationLatQQ.txt
  • save/router/ALCATEL SpeedTouch511e.ini
  • save/router/ALPHA AFW-GR55 mini.ini
  • save/router/ALPHA K3.ini
  • save/router/ALPHA V4.ini
  • save/router/ASUS WL530g.ini
  • save/router/AboveCable ACRT2010-11.ini
  • save/router/Alpha GR50.ini
  • save/router/D-Link DI-504.ini
  • save/router/D-Link DI-524.ini
  • save/router/D-Link DI-524M.ini
  • save/router/D-Link DI-604+.ini
  • save/router/D-Link DI-604.ini
  • save/router/D-Link DI-624+A.ini
  • save/router/D-Link DI-624.ini
  • save/router/D-Link DI-7001.ini
  • save/router/D-Link DI-808HV.ini
  • save/router/D-Link DIR-100.ini
  • save/router/D-Link DIR-300.ini
  • save/router/D-Link DIR-600.ini
  • save/router/FAST FR40.ini
  • save/router/FAST FR48.ini
  • save/router/HL-RT700.ini
  • save/router/Hi-Spider Hotel_V3.ini
  • save/router/HuaWei 3COM BR104.ini
  • save/router/HuaWei 3COM BR204+.ini
  • save/router/HuaWei WBR204G+.ini
  • save/router/HuaWei WBR204G.ini
  • save/router/KINGNET KN-S1060.ini
  • save/router/KINGNET KN-S1060T.ini
  • save/router/KINGNET KN-WR710H.ini
  • save/router/LINKSYS WRT54G.ini
  • save/router/LINKSYS WRT54GC.ini
  • save/router/LinkSYS BEFSR41.ini
  • save/router/LinkSYS BEFW11S4.ini
  • save/router/LinkSYS WRK54G(2).ini
  • save/router/LinkSYS WRK54G.ini
  • save/router/LinkSYS WRT150N.ini
  • save/router/Mercury MR808v2.ini
  • save/router/Mercury MW54R.ini
  • save/router/Mercury Soho MR804.ini
  • save/router/NetCore 2105+NR.ini
  • save/router/NetCore 2505+NR.ini
  • save/router/NetCore 2805NR.ini
  • save/router/NetCore 605GR.ini
  • save/router/NetCore NR+205.ini
  • save/router/NetCore NW705+.ini
  • save/router/NetCore NW705P V2.ini
  • save/router/NetCore NW705P.ini
  • save/router/NetShare R-1200.ini
  • save/router/NetShare R-1800.ini
  • save/router/Netgear JWNR2000T.ini
  • save/router/Netgear WGR614.ini
  • save/router/SMC SMC7004VBR.ini
  • save/router/TOTOLINK N300R.ini
  • save/router/TP-Link 402M.ini
  • save/router/TP-Link TD-8810.ini
  • save/router/TP-Link TD-W89741N.ini
  • save/router/TP-Link TL-MR11U.ini
  • save/router/TP-Link TL-R402.ini
  • save/router/TP-Link TL-R402M.ini
  • save/router/TP-Link TL-R406.ini
  • save/router/TP-Link TL-R410.ini
  • save/router/TP-Link TL-R460.ini
  • save/router/TP-Link TL-WR340G V5.ini
  • save/router/TP-Link TL-WR340G.ini
  • save/router/TP-Link TL-WR641G 642G.ini
  • save/router/TP-Link TL-WR740N.ini
  • save/router/TP-Link、FAST、Mercury 通用1.ini
  • save/router/TP-Link、FAST、Mercury 通用2.ini
  • save/router/TP-Link、FAST、Mercury 通用3.ini
  • save/router/TP-Link、FAST、Mercury 通用4.ini
  • save/router/Tenda NAT Router.ini
  • save/router/Tenda TEI402.ini
  • save/router/Tenda TEI402M.ini
  • save/router/Tenda TEI480T+.ini
  • save/router/Tenda TEI6606.ini
  • save/router/Tenda TEI6608.ini
  • save/router/Tenda TEI6608S 2.ini
  • save/router/Tenda TEI6608S.ini
  • save/router/Tenda TEI6611S.ini
  • save/router/Tenda W541R.ini
  • save/router/Wealnet R-2804P.ini
  • save/router/Wealnet R-2808M.ini
  • softUpdate.exe
    .exe windows:5 windows x86 arch:x86

    a8aad6ea80af5a700d81aa38a465509a


    Headers

    Imports

    Sections

  • thread/Thread.exe
    .exe windows:4 windows x86 arch:x86

    fde6b885d37438e46931b17aae9a7a7a


    Headers

    Imports

    Sections

  • zk
  • 一百分QQ综合采集软件.exe
    .exe windows:4 windows x86 arch:x86

    4cd9cf51af43eb6b0b30ad27d0b3abd6


    Headers

    Imports

    Exports

    Sections

  • 更多营销软件下载.lnk
    .lnk
  • 更多软件下载.url
    .url
  • 若软件运行出错请运行此文件.bat
  • 解压密码123456.txt
  • 高级过滤使用帮助文档.doc
    .doc windows office2003