General

  • Target

    dc476d6f9541fa41aedeb9f9c6b11acc_JaffaCakes118

  • Size

    20.1MB

  • MD5

    dc476d6f9541fa41aedeb9f9c6b11acc

  • SHA1

    c81200c6270680623c25749b3b0eee7d2e20b04b

  • SHA256

    3bfe240e82928c22c5730435dcb1adfa2022b8c9c984568dc7929d5e7c9d3ec2

  • SHA512

    fc14fd6ef66d9f2b0a924746f7a81e82ccd5caa7e5f8c957fb76d2e1f3f803173a6c29cd9be17c710b946c3b05e3dc3d3a789b4138c0ec8ea6365586c4ce2c35

  • SSDEEP

    393216:Mue1Yo0+8QtDqcT36V/Rre88pExQchEbhdieSAxM2cGe10i:Muj+8Qtv0apEx3ahfbM2cGe1x

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 33 IoCs

    Checks for missing Authenticode signature.

Files

  • dc476d6f9541fa41aedeb9f9c6b11acc_JaffaCakes118
    .exe windows:5 windows x86 arch:x86

    be41bf7b8cc010b614bd36bbca606973


    Headers

    Imports

    Sections

  • $1/kingnet/XYRestore/fwdata.db
  • $PLUGINSDIR/System.dll
    .dll windows:5 windows x86 arch:x86

    039bcbc605477e8e87ec550c2e60e748


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:5 windows x86 arch:x86

    45d25ca52c312b2254c60dbcb30342d1


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDuilib.dll
    .dll windows:5 windows x86 arch:x86

    fb1b2b34f5e04fc15b0d79890af12d1f


    Headers

    Imports

    Exports

    Sections

  • $TEMP/XYRestoreSetup/res/skin/res/font.xml
    .xml
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/bkg.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/btn_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/btn_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/btn_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/checkbox_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/checkbox_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/checkbox_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/checkbox_sel.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/close_dis.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/close_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/close_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/close_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/focus_btn_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/focus_btn_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/focus_btn_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/icon_error.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/icon_ok.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/msgbox/icon_warn.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/browse_btn_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/browse_btn_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/browse_btn_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/btn_dis.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/btn_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/btn_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/btn_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/checkbox_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/checkbox_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/checkbox_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/checkbox_sel.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/close_dis.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/close_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/close_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/close_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/focus_btn_dis.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/focus_btn_down.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/focus_btn_hot.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/focus_btn_nor.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/install_bg.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/install_bg2.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/install_logo1.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/install_logo2.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/progress_bar_bkg.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/progress_bar_pre_install.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/progress_bar_pre_uninstall.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/uninstall_bg.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/res/public/uninstall_bg2.png
    .png
  • $TEMP/XYRestoreSetup/res/skin/xmls/MainWnd.xml
  • $TEMP/XYRestoreSetup/res/skin/xmls/MsgBox.xml
    .xml
  • $TEMP/XYRestoreSetup/res/skin/xmls/UnMainWnd.xml
  • 7z.dll
    .dll windows:5 windows x86 arch:x86

    cbef9e5e84ebc7eedac2e4ab5c3d8c46


    Headers

    Imports

    Exports

    Sections

  • BugTrap.exe
    .exe windows:5 windows x86 arch:x86

    b3c905bf28c15cad45a09e7c083624f9


    Headers

    Imports

    Sections

  • CrashRpt.dll
    .dll windows:5 windows x86 arch:x86

    c89aca7cd947e1afbeb7a49c023e5b1f


    Headers

    Imports

    Exports

    Sections

  • DuiLib.dll
    .dll windows:5 windows x86 arch:x86

    febbac645424b1687353dc2cc302ef5e


    Headers

    Imports

    Exports

    Sections

  • InetFile.dll
    .dll windows:5 windows x86 arch:x86

    9cd0e156cd12ccb0a89ccefa576490d2


    Headers

    Imports

    Exports

    Sections

  • LiveUP.exe
    .exe windows:5 windows x86 arch:x86

    21b7113da1ddea4ee48a13e68eb2534c


    Headers

    Imports

    Sections

  • SkinRes.dll
    .dll windows:5 windows x86 arch:x86

    d056332cf3b8d6b9c5dfda1fdbccf8ca


    Headers

    Imports

    Sections

  • XYAssists.exe
    .exe windows:5 windows x86 arch:x86

    1433da7d42c4f74ac7085c9909d5bc71


    Headers

    Imports

    Sections

  • XYHelperSer32.exe
    .exe windows:5 windows x86 arch:x86

    498a7320bfda0e3ff7f9aec5ad554788


    Code Sign

    Headers

    Imports

    Sections

  • XYRestore.exe
    .exe windows:5 windows x86 arch:x86

    bf120efff14497fb16721f8cbe803059


    Headers

    Imports

    Exports

    Sections

  • XYSDK.dll
    .dll windows:5 windows x86 arch:x86

    7a5492e07dad1c4bf42dad76291d0267


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • XYSDKData.dll
    .dll windows:5 windows x86 arch:x86

    d056332cf3b8d6b9c5dfda1fdbccf8ca


    Headers

    Imports

    Exports

    Sections

  • ZPack.dll
    .dll windows:5 windows x86 arch:x86

    792c6be76cc5efe1b5b1449514b1c560


    Headers

    Imports

    Exports

    Sections

  • authd_x64.exe
    .exe windows:5 windows x64 arch:x64

    d68991e2fac24b6ce9b02fc63591bfaa


    Headers

    Imports

    Sections

  • authd_x86.exe
    .exe windows:5 windows x86 arch:x86

    7886a959599eee4e22a3bc20509f0eb4


    Headers

    Imports

    Sections

  • bin/psftp.exe
    .exe windows:5 windows x86 arch:x86

    643596006f1628841794016dfdf58f71


    Headers

    Imports

    Sections

  • bin/s-irecovery.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • bin/ssh.exe
    .exe windows:5 windows x86 arch:x86

    16d165a51895cc27d925ba4c7e73a18a


    Headers

    Imports

    Sections

  • download/MiniThunderPlatform.exe
    .exe windows:4 windows x86 arch:x86

    39c9c7cd2ff99952b66b87f21b223970


    Code Sign

    Headers

    Imports

    Sections

  • download/XLBugHandler.dll
    .dll windows:4 windows x86 arch:x86

    732b5d4d8fe9352080919202202a8fc1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download/XLBugReport.exe
    .exe windows:4 windows x86 arch:x86

    2d5eb3318716f6f5924e38fcde089028


    Code Sign

    Headers

    Imports

    Sections

  • download/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • download/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2827932cca8caf8a10f65e148687b7a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download/download_engine.dll
    .dll windows:4 windows x86 arch:x86

    d604bec9f17838dae5cca81eba57697a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • download/id.dat
  • download/minizip.dll
    .dll windows:4 windows x86 arch:x86

    42ec74970cf4f102712a1588d5814466


    Headers

    Imports

    Exports

    Sections

  • download/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • download/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • download/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Headers

    Imports

    Exports

    Sections

  • libeay32.dll
    .dll windows:5 windows x86 arch:x86

    373ec742e7b3f2c1240a0fc42190084b


    Headers

    Imports

    Exports

    Sections

  • libucls.dll
    .dll windows:5 windows x86 arch:x86

    fb8a4e565a42821edbc61a7a3223afe0


    Headers

    Imports

    Exports

    Sections

  • msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • restored_x86.exe
    .exe windows:5 windows x86 arch:x86

    76a57c6648989e7354f22349f314017c


    Headers

    Imports

    Sections

  • sqlite382.dll
    .dll windows:5 windows x86 arch:x86

    1c6b4cb3140529fc48fa6d3bfb01d028


    Headers

    Imports

    Exports

    Sections

  • ssleay32.dll
    .dll windows:5 windows x86 arch:x86

    5e04e12b1959640d4ab55d0c3fb4a5d7


    Headers

    Imports

    Exports

    Sections

  • uninstall.exe.nsis
  • x64/XYHelperSer64.exe
    .exe windows:5 windows x64 arch:x64

    92680f092d774c7da1c3cae11ef48730


    Headers

    Imports

    Sections

  • x64/msvcp100.dll
    .dll windows:5 windows x64 arch:x64

    9a218d1ec03f40eca74839863a511cb7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • x64/msvcr100.dll
    .dll windows:5 windows x64 arch:x64

    1208bcdc77cffee6a6813646321cfc79


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • xldl.dll
    .dll windows:4 windows x86 arch:x86

    45468f3a2269a2595f5115a57780c86a


    Headers

    Imports

    Exports

    Sections