General

  • Target

    dc8cd696bcf0e16d1276b1a866eb68bd_JaffaCakes118

  • Size

    1.5MB

  • MD5

    dc8cd696bcf0e16d1276b1a866eb68bd

  • SHA1

    bd817b17766e6e2692b5b1e74605a2336b273788

  • SHA256

    ef9583be21d54e230491f92c740f3147768fe0d3289c107a86349805bf1c1705

  • SHA512

    7c03e0f3ecbccefffb727a2024e40ad17590dbc898ecab930aa2e840e94eb6ffcf35b4cc62c4c6f911a4c30bf3d927b283926f226b438eb11f1ffdb20ee9171e

  • SSDEEP

    24576:ZMI9lngx1hCc/HZtWVBXvk060cI0q+wQUloAl3sJ72k0Qub7OxBqCuNaYSU0gt50:eogvWXk0Nd0qNHpst2LvwMCuNXnt50

Score
7/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 11 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • dc8cd696bcf0e16d1276b1a866eb68bd_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/AES_Encrypt.dll
    .dll windows:6 windows x86 arch:x86

    89943042264f7e30a06c73db8bb973dc


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/BgWorker.dll
    .dll windows:4 windows x86 arch:x86

    db2755f409b81c4dbfc04f648cfb80b9


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/FindProcDLL.dll
    .dll windows:4 windows x86 arch:x86

    8df26927f8978d4eb40ff179c0aa961b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/GetClientID.dll
    .dll windows:6 windows x86 arch:x86

    a5fb65ba82d246695b4b1c4ab901531a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/GetMacAddress.dll
    .dll windows:6 windows x86 arch:x86

    dd6ab75d10c0aa2a62780ff7e5d0c98e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/GetWindowsInfo.dll
    .dll windows:6 windows x86 arch:x86

    a2bd27df169b70fb43b9209e5933935f


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetcex.dll
    .dll windows:6 windows x86 arch:x86

    1f2a41172077a870b2665c290be8ccfa


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDui.dll
    .dll windows:6 windows x86 arch:x86

    a8d206027ba29c55471b1830c511954e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    c8fc3b55c70f2f31f4c8639bf1efe362


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/skin.zip
    .zip
  • btn_browser.png
    .png
  • btn_check.png
    .png
  • btn_check2.png
    .png
  • btn_checked.png
    .png
  • btn_checked2.png
    .png
  • btn_close.png
    .png
  • btn_install.png
    .png
  • btn_min.png
    .png
  • btn_protocl.png
    .png
  • btn_run.png
    .png
  • install.xml
  • progress.png
    .png
  • progress_back.png
    .png
  • sfinish.png
    .png
    • http://www.livepaper.cn/mobile/app/down?channel=PC

  • sinstalling.png
    .png
  • swelcome.png
    .png
  • $PLUGINSDIR/taskpin.exe
    .exe windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections