Overview

overview

7

Static

static

3

QZCloneSetup.exe

windows7-x64

7

QZCloneSetup.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows7-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

QZoneClone.dll

windows7-x64

6

QZoneClone.dll

windows10-2004-x64

6

QZoneClone.exe

windows7-x64

6

QZoneClone.exe

windows10-2004-x64

6

Uninstall.exe

windows7-x64

7

Uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...rk.dll

windows7-x64

3

$PLUGINSDI...rk.dll

windows10-2004-x64

3

新云软件.url

windows7-x64

1

新云软件.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    d2c66dbc55f818a211ef770369c071f9_JaffaCakes118

  • Size

    791KB

  • MD5

    d2c66dbc55f818a211ef770369c071f9

  • SHA1

    76ea0307d5c71b1e2d30fc1e85452d69a85fda52

  • SHA256

    62fa26a7bd1c3fce666a143f18dd4c0be2d7b4c3d06c597f6f2fe38bd4b92005

  • SHA512

    c890c10e438801c6c0ef2286d83580bd9aac7fe7307d1e349bc731d16d4652dfb39d9c90c7334edc99cdc6a4fe7ecef0188cd58766b5fcc01bff3e5aa940e6f2

  • SSDEEP

    12288:eQXrJfj+i1EZ79vKH8WZ1BFSbRh5BN93w9zQOBTkAGBTXMPnAfDiR8J0FfmUz2Mc:eKSi15R1KN9g9zQOvIXIAfDiX5N2M4B5

Score
3/10

Malware Config

Signatures

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs
    installer

Files

  • d2c66dbc55f818a211ef770369c071f9_JaffaCakes118
    .rar
  • QZCloneSetup.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/bg.bmp
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/processwork.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/tip.bmp
  • QZoneClone.dll
    .dll regsvr32 windows:5 windows x86 arch:x86

    cb4120903802e29ede0202906562a97d


    Headers

    Imports

    Exports

    Sections

  • QZoneClone.exe
    .exe windows:5 windows x86 arch:x86

    48c297445dc559be2ee175408266fd1e


    Headers

    Imports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/custom.ini
  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    5bdcdde5acd7b395f3f3d19ebbb8c6cd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/processwork.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 新云软件.url
    .url