General

  • Target

    ce4b3b45a7e41e2198e47ee542f498d4_JaffaCakes118

  • Size

    6.0MB

  • MD5

    ce4b3b45a7e41e2198e47ee542f498d4

  • SHA1

    7524a5a6facd268a289c582d0ecce6f53bcdfb8d

  • SHA256

    4f800575229b731069024a88ee51d5029d6d692f5cf0b12be2a58f1d2ef570c0

  • SHA512

    abea71c0d70f0c2971d8ae0dbd3fcdb6fab387038012eaaf522890699b965c66b5b45e18ef770147f1596425993a132d9a85abaea94af07c97b9deec5159379d

  • SSDEEP

    98304:ZjAt4thTNO/OtuP7tnMC+dMhv9UzjvIxyEO83wdvnvRwwey5MS0R2uhJ4ZWbYQky:ZjAt4vTNOMuZaa94vIxHO83QnpRbgR2I

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 11 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 21 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • ce4b3b45a7e41e2198e47ee542f498d4_JaffaCakes118
    .rar
  • RedVIP5Release_91502088.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    28d94e5199b88ad374b3cb2118e31a66


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • DLLCLT.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • DownLoad/attrib.exe
    .exe windows:5 windows x86 arch:x86

    3c9bab855f16ec1b1aa2b1df6aa2db97


    Headers

    Imports

    Sections

  • DownLoad/rar.exe
    .exe windows:4 windows x86 arch:x86

    9e0ab8c69b9a74a6c08b7babe53344c5


    Headers

    Imports

    Exports

    Sections

  • McuFlash/Download.exe
    .exe windows:4 windows x86 arch:x86

    e8a3144fa7e17dacc3234c6e7b759eb7


    Headers

    Imports

    Exports

    Sections

  • McuFlash/_McuFlash.txt
  • McuFlash/temp.bmp
  • PhoneRing/LisenceCN.txt
  • PhoneRing/׼.vcm
  • PhoneRing/׼.vid
  • RedVIPControls.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f4089fe30323b0998ab170aa1ab245a6


    Headers

    Imports

    Exports

    Sections

  • RedVIPControls.lic
  • Skin/Thumbs.db
  • Skin/redskin.gif
    .gif
  • Skin/redvip5std.gif
    .gif
  • VIP.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • VIPExec.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • VIPUpdate.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • VPADLL.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • VPVDLL.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • advert/Thumbs.db
  • advert/ad_mcu.gif
    .html
  • advert/ad_up.gif
    .gif
  • advert/mcu_ad1.gif
    .gif
  • advert/vip.gif
    .gif
  • divx.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • ilbc_dll.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • redmcu_c.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • regdll.bat
  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/LangDLL.dll
    .dll windows:4 windows x86 arch:x86

    2db813254ea8b4d2a92d703ecb659f39


    Headers

    Imports

    Exports

    Sections

  • vipdial/redvip.pbk
  • vipdial/redvipphone.pbk
  • vish263m.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • vish323.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 安装说明.url
    .url