General

  • Target

    0631a824f794bd7caeedb21336a8c2f7_JaffaCakes118

  • Size

    6.0MB

  • MD5

    0631a824f794bd7caeedb21336a8c2f7

  • SHA1

    8a1cee66cbffcea6302a3b0fa057a64c33164ddd

  • SHA256

    fb8d5e653161e4ce40ac6ca6d76b77dc807380c62afab23ec9ece3d2145db038

  • SHA512

    73e83e18c2e26ded8baa902160f81f0b16d1919c3a587cff839d58fe7e9003106cd0f0081b572685d024234d5bd19ed997fd0000e25253b42d56c1fafe5d15b7

  • SSDEEP

    196608:A/qrGtg4VGN50p9Bl0uwuATO3k8NRam7jEUb:gqrGtFVc0V3k8NRR0q

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • 0631a824f794bd7caeedb21336a8c2f7_JaffaCakes118
    .rar
  • oxzhuomian/OX_3.2.0.2450_Setup_100.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Baidu-TB-ASBar.exe
    .exe windows:4 windows x86 arch:x86

    b711f65a9aff6a22fb2f57f0ac8bda33


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/ASBarBroker.exe
    .exe windows:4 windows x86 arch:x86

    8cb73f23fc4ffce04345bba981c347fe


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/AddressBar.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c6079cff13dd538f8c2b93227d9d6d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    eec7e2ce092ceb64b3617d28d0d2dc04


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
    .exe windows:4 windows x86 arch:x86

    118d99c3f6c480f98032ef338c8ef1ff


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
    .dll windows:4 windows x86 arch:x86

    d811d71710ad58776155b7a8da1fa9db


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/conf.xml
    .xml
  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/io.ini
  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • Baidu-TB-ASBar.exe
    .exe windows:4 windows x86 arch:x86

    b711f65a9aff6a22fb2f57f0ac8bda33


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/ASBarBroker.exe
    .exe windows:4 windows x86 arch:x86

    8cb73f23fc4ffce04345bba981c347fe


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/AddressBar.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    c6079cff13dd538f8c2b93227d9d6d6c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    eec7e2ce092ceb64b3617d28d0d2dc04


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
    .exe windows:4 windows x86 arch:x86

    118d99c3f6c480f98032ef338c8ef1ff


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
    .dll windows:4 windows x86 arch:x86

    d811d71710ad58776155b7a8da1fa9db


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAM_FILES/Baidu/conf.xml
    .xml
  • ChineseCode.dll
    .dll windows:5 windows x86 arch:x86

    723b7c6c83dcbe78349eaf081debf60a


    Headers

    Imports

    Exports

    Sections

  • ChineseSpell.dll
    .dll windows:5 windows x86 arch:x86

    01898490d65cd7951f2fda2b7fed97bb


    Headers

    Imports

    Exports

    Sections

  • Config/links.xml
    .xml
  • Config/oxdata.db
  • Config/runinfo.db
  • HookDll.dll
    .dll windows:5 windows x86 arch:x86

    ee827ea41b86dfb4a7ec0dee4530698f


    Headers

    Imports

    Exports

    Sections

  • OX.exe
    .exe windows:5 windows x86 arch:x86

    30b91dd5ad51f33844182638ac6425fb


    Headers

    Imports

    Exports

    Sections

  • OXImport.exe
    .exe windows:5 windows x86 arch:x86

    ebd3983a5ed8abd7dfc625a6d65917b5


    Headers

    Imports

    Exports

    Sections

  • OXUpdate.exe
    .exe windows:5 windows x86 arch:x86

    c1805c34961d37f63399edd8b7af32d7


    Headers

    Imports

    Exports

    Sections

  • OXuiLib.dll
    .dll windows:5 windows x86 arch:x86

    474a05c1fd15034996bb87d80b98b303


    Headers

    Imports

    Exports

    Sections

  • Skin/Combo_nor.bmp
  • Skin/Combo_over.bmp
  • Skin/Extra/dir.png
    .png
  • Skin/Extra/url.png
    .png
  • Skin/about.png
    .png
  • Skin/addbtn.png
    .png
  • Skin/addgroup.png
    .png
  • Skin/addrecord.png
    .png
  • Skin/addskin.bmp
  • Skin/baike.png
    .png
  • Skin/bg.png
    .png
  • Skin/btnImport_down.png
    .png
  • Skin/btnImport_hover.png
    .png
  • Skin/button_disabled.png
    .png
  • Skin/button_down.png
    .png
  • Skin/button_hot.png
    .png
  • Skin/button_normal.png
    .png
  • Skin/changeskin.png
    .png
  • Skin/check_disabled.png
    .png
  • Skin/check_hot.png
    .png
  • Skin/check_normal.png
    .png
  • Skin/check_selected.png
    .png
  • Skin/chessgame.ico
  • Skin/chessgame.png
    .png
  • Skin/city.png
    .png
  • Skin/classes/0.png
    .png
  • Skin/classes/1.png
    .png
  • Skin/classes/10.png
    .png
  • Skin/classes/11.png
    .png
  • Skin/classes/12.png
    .png
  • Skin/classes/13.png
    .png
  • Skin/classes/14.png
    .png
  • Skin/classes/15.png
    .png
  • Skin/classes/16.png
    .png
  • Skin/classes/17.png
    .png
  • Skin/classes/18.png
    .png
  • Skin/classes/19.png
    .png
  • Skin/classes/2.png
    .png
  • Skin/classes/20.png
    .png
  • Skin/classes/21.png
    .png
  • Skin/classes/22.png
    .png
  • Skin/classes/23.png
    .png
  • Skin/classes/24.png
    .png
  • Skin/classes/25.png
    .png
  • Skin/classes/26.png
    .png
  • Skin/classes/27.png
    .png
  • Skin/classes/3.png
    .png
  • Skin/classes/4.png
    .png
  • Skin/classes/5.png
    .png
  • Skin/classes/6.png
    .png
  • Skin/classes/7.png
    .png
  • Skin/classes/8.png
    .png
  • Skin/classes/9.png
    .png
  • Skin/dlgbg.png
    .png
  • Skin/duba_main.png
    .png
  • Skin/email.png
    .png
  • Skin/exp.png
    .png
  • Skin/feedback.ico
  • Skin/feedback.png
    .png
  • Skin/frame_btn_close_disable.png
    .png
  • Skin/frame_btn_close_down.png
    .png
  • Skin/frame_btn_close_hot.png
    .png
  • Skin/frame_btn_close_normal.png
    .png
  • Skin/frame_btn_max.png
    .png
  • Skin/frame_btn_min.png
    .png
  • Skin/head/1.png
    .png
  • Skin/head/10.png
    .png
  • Skin/head/11.png
    .png
  • Skin/head/12.png
    .png
  • Skin/head/13.png
    .png
  • Skin/head/14.png
    .png
  • Skin/head/15.png
    .png
  • Skin/head/16.png
    .png
  • Skin/head/17.png
    .png
  • Skin/head/18.png
    .png
  • Skin/head/19.png
    .png
  • Skin/head/2.png
    .png
  • Skin/head/20.png
    .png
  • Skin/head/21.png
    .png
  • Skin/head/22.png
    .png
  • Skin/head/23.png
    .png
  • Skin/head/24.png
    .png
  • Skin/head/25.png
    .png
  • Skin/head/26.png
    .png
  • Skin/head/27.png
    .png
  • Skin/head/28.png
    .png
  • Skin/head/29.png
    .png
  • Skin/head/3.png
    .png
  • Skin/head/30.png
    .png
  • Skin/head/31.png
    .png
  • Skin/head/32.png
    .png
  • Skin/head/33.png
    .png
  • Skin/head/34.png
    .png
  • Skin/head/35.png
    .png
  • Skin/head/36.png
    .png
  • Skin/head/37.png
    .png
  • Skin/head/38.png
    .png
  • Skin/head/39.png
    .png
  • Skin/head/4.png
    .png
  • Skin/head/40.png
    .png
  • Skin/head/41.png
    .png
  • Skin/head/42.png
    .png
  • Skin/head/43.png
    .png
  • Skin/head/44.png
    .png
  • Skin/head/45.png
    .png
  • Skin/head/46.png
    .png
  • Skin/head/47.png
    .png
  • Skin/head/48.png
    .png
  • Skin/head/49.png
    .png
  • Skin/head/5.png
    .png
  • Skin/head/50.png
    .png
  • Skin/head/51.png
    .png
  • Skin/head/52.png
    .png
  • Skin/head/53.png
    .png
  • Skin/head/54.png
    .png
  • Skin/head/55.png
    .png
  • Skin/head/56.png
    .png
  • Skin/head/6.png
    .png
  • Skin/head/7.png
    .png
  • Skin/head/8.png
    .png
  • Skin/head/9.png
    .png
  • Skin/home.png
    .png
  • Skin/imgMessage.png
    .png
  • Skin/import_desk.png
    .png
  • Skin/iox.png
    .png
  • Skin/left.png
    .png
  • Skin/left_bg.png
    .png
  • Skin/level.png
    .png
  • Skin/loading.gif
    .gif
  • Skin/loadwait.png
    .png
  • Skin/lock.png
    .png
  • Skin/loginbg.png
    .png
  • Skin/menu/about_m.png
    .png
  • Skin/menu/checkupdate_m.png
    .png
  • Skin/menu/clearicon_m.png
    .png
  • Skin/menu/exit_m.png
    .png
  • Skin/menu/help.png
    .png
  • Skin/menu/import_desk.png
    .png
  • Skin/menu/import_m.png
    .png
  • Skin/menu/logout_m.png
    .png
  • Skin/menu/onkeyrestore_m.png
    .png
  • Skin/menu/settting_m.png
    .png
  • Skin/menu/showdesktop_m.png
    .png
  • Skin/menu/showox_m.png
    .png
  • Skin/menu/switchu_m.png
    .png
  • Skin/menu/topmost_m.png
    .png
  • Skin/menu_bk.png
    .png
  • Skin/menu_hot_bk.png
    .png
  • Skin/music.ico
  • Skin/music.png
    .png
  • Skin/niubi.png
    .png
  • Skin/noneweather.png
    .png
  • Skin/ox_main.png
    .png
  • Skin/picdeal.png
    .png
  • Skin/progress.png
    .png
  • Skin/radio_disabled.png
    .png
  • Skin/radio_hot.png
    .png
  • Skin/radio_normal.png
    .png
  • Skin/radio_selected.png
    .png
  • Skin/rmd_baidu.png
    .png
  • Skin/rmd_nav.png
    .png
  • Skin/rmd_tao.png
    .png
  • Skin/screenlock.png
    .png
  • Skin/search.png
    .png
  • Skin/setting.png
    .png
  • Skin/shopping.png
    .png
  • Skin/skinbackground/1.jpg
    .jpg
  • Skin/skinbackground/10.jpg
    .jpg
  • Skin/skinbackground/11.jpg
    .jpg
  • Skin/skinbackground/12.jpg
    .jpg
  • Skin/skinbackground/2.jpg
    .jpg
  • Skin/skinbackground/3.jpg
    .jpg
  • Skin/skinbackground/4.jpg
    .jpg
  • Skin/skinbackground/5.jpg
    .jpg
  • Skin/skinbackground/6.jpg
    .jpg
  • Skin/skinbackground/7.jpg
    .jpg
  • Skin/skinbackground/8.jpg
    .jpg
  • Skin/skinbackground/9.jpg
    .jpg
  • Skin/slider.png
    .png
  • Skin/tools.png
    .png
  • Skin/unknow.png
    .png
  • Skin/view1.png
    .png
  • Skin/view1_hover.png
    .png
  • Skin/view2.png
    .png
  • Skin/view2_hover.png
    .png
  • Skin/view3.png
    .png
  • Skin/view3_hover.png
    .png
  • Skin/viewchoosebtn.png
    .png
  • Skin/virtualdrive.png
    .png
  • Skin/webnavbtn.png
    .png
  • Skin/whitebg.png
    .png
  • TaskKeyHook.dll
    .dll windows:4 windows x86 arch:x86

    cce5b01db1ef5948708485e3ca44251b


    Headers

    Imports

    Exports

    Sections

  • Tools/VirtualDriveManager.exe
    .exe windows:4 windows x86 arch:x86

    87b324a67e18fb2e1d12308b06fa8d4f


    Headers

    Imports

    Sections

  • Tools/jpgcompact.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Tools/toosls.xml
    .xml
  • dns.exe
    .exe windows:5 windows x86 arch:x86

    7f126dc6790e13ca987e17dc1f092c17


    Headers

    Imports

    Sections

  • dshow.exe
    .exe windows:4 windows x86 arch:x86

    af0a998b14709217d96a0ffa4f6ff9ae


    Headers

    Imports

    Sections

  • miniupnpc.dll
    .dll windows:5 windows x86 arch:x86

    24b9a67e2b3ea1367ab9b5bbb220fbbe


    Headers

    Imports

    Exports

    Sections

  • msvcp100.dll
    .dll windows:5 windows x86 arch:x86

    7a0d9f66efd1839f136ca6896fa52dfa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • network.dll
    .dll windows:5 windows x86 arch:x86

    c4bc25bd8dfb58e6da04d7dc9d1b8cf4


    Headers

    Imports

    Exports

    Sections

  • oxweb.exe
    .exe windows:4 windows x86 arch:x86

    95015ef42a3ef5848e622541772b3e74


    Headers

    Imports

    Sections

  • p2sp.dll
    .dll windows:5 windows x86 arch:x86

    934c98d3709d840c314b03a9e5506d08


    Headers

    Imports

    Exports

    Sections

  • sqlite3.dll
    .dll windows:4 windows x86 arch:x86

    af961c99b930b06c81c1f18b28c62ac8


    Headers

    Imports

    Exports

    Sections

  • unins000.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • upnp.exe
    .exe windows:5 windows x86 arch:x86

    fc1dfb7ad5603e632a42042158498f5d


    Headers

    Imports

    Sections

  • oxzhuomian/使用说明.htm
    .html
  • oxzhuomian/系统天堂.url
    .url
  • oxzhuomian/绿茶网址导航.url
    .url