General

  • Target

    d6c2f0f5069cfe7f71556dec29f4540c_JaffaCakes118

  • Size

    5.9MB

  • MD5

    d6c2f0f5069cfe7f71556dec29f4540c

  • SHA1

    f01ad99217e1f674d1d4d8a0fc8bb696eab28ead

  • SHA256

    44828659448377d871a7f8554cacfca7284cbe68a6c9b3732e6df9e059781f2b

  • SHA512

    972253355c2910ed3114e56444142aa2da3dbe61ad1e53612dfe0eab9995a978df7d7ce4071bb0a52af49475777012ed8a616b0157d641ad33a64eb08743c5fc

  • SSDEEP

    98304:8ed1Y+pFUDwZId1nFRELM/lHeXfptEM8ujLGX9UPyNWoYzf14lwCO0tfx0NtYuXZ:nd1bUDMInGM/lHeP3E2uUPmWxt4l1qjZ

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 8 IoCs

Files

  • d6c2f0f5069cfe7f71556dec29f4540c_JaffaCakes118
    .rar
  • yitesoftstorefree.exe
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • Config.ini
  • Help.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • LHT_mdibmp.dll
    .dll windows:1 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Thumbs.db
  • Update.exe
    .exe windows:4 windows x86 arch:x86

    62f205fe3d5e06c190cbad78ac9b9e4e


    Headers

    Imports

    Sections

  • app.pbd
  • basic.pbd
  • basicdw.pbd
  • buy.pbd
  • buydw.pbd
  • data/storefree.mdb
  • dbmssocn.dll
    .dll windows:4 windows x86 arch:x86

    0308deee9f67f74385166e56fb5d1431


    Headers

    Imports

    Exports

    Sections

  • dbnetlib.dll
    .dll windows:5 windows x86 arch:x86

    ad360252cbae41f069ad9fdc23286b74


    Headers

    Imports

    Exports

    Sections

  • dbnmpntw.dll
    .dll windows:5 windows x86 arch:x86

    55dad475c99479340c2fa22b29dc46e2


    Headers

    Imports

    Exports

    Sections

  • error.pbd
  • finance.pbd
  • function.pbd
  • ico/Add.ico
  • ico/Arrow-Left.ico
  • ico/Arrow-Right.ico
  • ico/Back.ico
  • ico/Close.ico
  • ico/Date.ico
  • ico/Download.ico
  • ico/Folderclose.ico
  • ico/Folderopen.ico
  • ico/Forward.ico
  • ico/ICO.psd
  • ico/Maintenance.ico
  • ico/Ok.ico
  • ico/Password.ico
  • ico/Public.ico
  • ico/Refresh.ico
  • ico/Refresh1.ico
  • ico/Safari.ico
  • ico/Stats.ico
  • ico/Thumbs.db
  • ico/Up.ico
  • ico/Updatemdb.ico
  • ico/Winamp.ico
  • ico/add1.ico
  • ico/check.ico
  • ico/customer.ico
  • ico/databak.ico
  • ico/date1.ico
  • ico/datea.ico
  • ico/db.ico
  • ico/delete.ico
  • ico/delete111.ico
  • ico/down.gif
    .gif
  • ico/down.ico
  • ico/edccit.ICO
  • ico/edit.ico
  • ico/edit1.ICO
  • ico/edit3.ico
  • ico/editaf.ICO
  • ico/end.ico
  • ico/excel.ico
  • ico/exit.ico
  • ico/exit1.ico
  • ico/exitq.ico
  • ico/find.ico
  • ico/finds.ico
  • ico/findsa.ico
  • ico/first.ico
  • ico/hand.ico
  • ico/import.ico
  • ico/in.ico
  • ico/ina.ico
  • ico/item.gif
    .gif
  • ico/kc.ico
  • ico/key.ico
  • ico/keyqqq.ico
  • ico/logo.ico
  • ico/new.ico
  • ico/new1.ico
  • ico/online.ico
  • ico/onlinea.ico
  • ico/out.ico
  • ico/print.ico
  • ico/printer.ico
  • ico/product.ico
  • ico/product1.ico
  • ico/sale.ico
  • ico/salea.ico
  • ico/save.ico
  • ico/setup.ico
  • ico/sfc.ico
  • ico/supplier.ico
  • ico/trans.ico
  • ico/up.bmp
  • ico/up.gif
    .gif
  • ico/user.gif
    .gif
  • ico/user.ico
  • ico/yj.ico
  • libjcc.dll
    .dll windows:4 windows x86 arch:x86

    98596f3e5d37e9c19b26b7b51d9ef9fd


    Headers

    Imports

    Exports

    Sections

  • libjsybheap.dll
    .dll windows:4 windows x86 arch:x86

    cd185ae96e493c13224d6c93f6fa483f


    Headers

    Imports

    Exports

    Sections

  • main.exe
    .exe windows:4 windows x86 arch:x86

    62f205fe3d5e06c190cbad78ac9b9e4e


    Headers

    Imports

    Sections

  • main.exe.manifest
  • menu_kit.dll
    .dll windows:1 windows x86 arch:x86

    d1910d572b6bc416af5e05fafac1bf15


    Headers

    Imports

    Exports

    Sections

  • menu_kit.pbd
  • myobject.pbd
  • odbcjt32.dll
    .dll windows:5 windows x86 arch:x86

    c8ae7ea11a182b6e51b186060c5136a2


    Headers

    Imports

    Exports

    Sections

  • pbdwe90.dll
    .dll windows:4 windows x86 arch:x86

    9798a64cf49f5c0685e7495494887d11


    Headers

    Imports

    Exports

    Sections

  • pbmss90.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    431a7249710495af97317169bd47d2c1


    Headers

    Imports

    Exports

    Sections

  • pbodb90.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    3fdbe0f48e44d352309e67103520410b


    Headers

    Imports

    Exports

    Sections

  • pbodb90.ini
  • pbtra90.dll
    .dll windows:4 windows x86 arch:x86

    a4643102e864b035ba999f124366793a


    Headers

    Imports

    Exports

    Sections

  • pbvm90.dll
    .dll windows:4 windows x86 arch:x86

    488a02bfb552cd3f3de7ad4be6b3e52c


    Headers

    Imports

    Exports

    Sections

  • report.pbd
  • sale.pbd
  • saledw.pbd
  • seinweb.dll
    .dll windows:4 windows x86 arch:x86

    12a21b6e423c02e7ff8f5138a8d839c1


    Headers

    Imports

    Exports

    Sections

  • store.pbd
  • storedw.pbd
  • ui.pbd
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Headers

    Imports

    Sections

  • $PLUGINSDIR/KillProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    153027ec3b10bcea606b777657dd3402


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • yitesoft.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Headers

    Imports

    Sections

  • sj128.ico
  • sj128url.exe
    .exe windows:4 windows x86 arch:x86

    1c042238f43557c055fca8642de8a074


    Headers

    Imports

    Sections

  • sj128.ico
  • yitesoft.ico
  • ˵.txt
  • Ʒϱ.xls
    .xls windows office2003
  • 新云软件.url
    .url