Overview

overview

7

Static

static

3

Java反编...up.exe

windows7-x64

3

Java反编...up.exe

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

$TEMP/fzhjd/1.exe

windows7-x64

7

$TEMP/fzhjd/1.exe

windows10-2004-x64

7

$TEMP/fzhjd/qqbq.exe

windows7-x64

7

$TEMP/fzhjd/qqbq.exe

windows10-2004-x64

7

Configuration.exe

windows7-x64

3

Configuration.exe

windows10-2004-x64

3

JDecompiler.exe

windows7-x64

3

JDecompiler.exe

windows10-2004-x64

3

jad.exe

windows7-x64

3

jad.exe

windows10-2004-x64

3

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

.rtf

windows7-x64

4

.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d37f18a2e2afdeb45c43d18343fc38f3_JaffaCakes118

  • Size

    531KB

  • MD5

    d37f18a2e2afdeb45c43d18343fc38f3

  • SHA1

    d8cfd054e1a2261b3c28cb589b8d9a0c1bfcd85f

  • SHA256

    5271e8ec687c71a26214ccdba7c9ab1b60569bd5a3b56bfba8a6d5f1a6940dbd

  • SHA512

    35f363edf7c1f2e0b6aa589fd5e42867b930275e590251989f655cea6667d598e034738552cad6b7ff19de7373307bf57a261ee053ea226bb90b95cffa363ab3

  • SSDEEP

    12288:j8B1JiS7h7hub0zxdjBdqJyrb+a3XIn5jkdzUImvwL:YBTWStYJK3I5jkdd4wL

Score
3/10

Malware Config

Signatures

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • d37f18a2e2afdeb45c43d18343fc38f3_JaffaCakes118
    .rar
  • Java反编译 软件/JSetup.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7d85f9c30f9e87a65fff848de2c96ac1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $TEMP/fzhjd/1.exe
    .exe windows:5 windows x86 arch:x86

    c56a25fa4336eeb10723b3537ba4876d


    Headers

    Imports

    Sections

  • $TEMP/fzhjd/qqbq.exe
    .exe windows:4 windows x86 arch:x86

    1bed3305885b0ca596d9cbba22baf78a


    Headers

    Imports

    Sections

  • Configuration.exe
    .exe windows:4 windows x86 arch:x86

    a7930a4dee29346641165b1dd4ad94de


    Headers

    Imports

    Sections

  • JDecompiler.exe
    .exe windows:4 windows x86 arch:x86

    725b2115e7cf0f6628e3a1d581c6f5f0


    Headers

    Imports

    Sections

  • JDecompiler.ico
  • jad.exe
    .exe windows:4 windows x86 arch:x86

    e95870a86f634f9d8d362002b47c4453


    Headers

    Imports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • ˵.txt
  • .url
  • .rtf
    .rtf
  • Java反编译 软件/汉化说明文档.txt