Overview

overview

7

Static

static

7

0cdb380a14...18.exe

windows7-x64

7

0cdb380a14...18.exe

windows10-2004-x64

7

$PLUGINSDI...64.dll

windows7-x64

3

$PLUGINSDI...64.dll

windows10-2004-x64

3

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows7-x64

3

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

QvodCtrls/...er.dll

windows7-x64

3

QvodCtrls/...er.dll

windows10-2004-x64

3

QvodCtrls/...er.dll

windows7-x64

3

QvodCtrls/...er.dll

windows10-2004-x64

3

QvodCtrls/...rc.dll

windows7-x64

3

QvodCtrls/...rc.dll

windows10-2004-x64

3

QvodCtrls/...ok.dll

windows7-x64

3

QvodCtrls/...ok.dll

windows10-2004-x64

3

QvodCtrls/...vc.dll

windows7-x64

3

QvodCtrls/...vc.dll

windows10-2004-x64

3

QvodCtrls/...ac.dll

windows7-x64

3

QvodCtrls/...ac.dll

windows10-2004-x64

3

QvodCtrls/...rt.dll

windows7-x64

3

QvodCtrls/...rt.dll

windows10-2004-x64

3

QvodCtrls/...al.exe

windows7-x64

3

QvodCtrls/...al.exe

windows10-2004-x64

3

SkinH_EL.dll

windows7-x64

5

SkinH_EL.dll

windows10-2004-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target

    0cdb380a14c84c5bda3eb1278168083e_JaffaCakes118

  • Size

    2.4MB

  • MD5

    0cdb380a14c84c5bda3eb1278168083e

  • SHA1

    393b5c7f7447d069baab78f894a5b1ca875e4f46

  • SHA256

    a3faaea5e3c04bf3e62dc8c35b8604f3d2ae639cf4e08317dc764d655384c0b5

  • SHA512

    4ac5789dfee1fc997dcf2e517e585373ecd34f9047faf53e6f8f3613ff26e9d4b8011eaa5f5daadc231b3b8396c7f189488a236ea21bbcfb51fa3e284d58e72a

  • SSDEEP

    49152:Knqb8g4nEq2Cp46zPUjOXss6PtGnSg8fYhZsDw1kq37qx:Kn7gBMzP3Xx6lGjCAkj

Score
7/10
upxaspackv2

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • 0cdb380a14c84c5bda3eb1278168083e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/Base64.dll
    .dll windows:4 windows x86 arch:x86

    1ba6926a1ee4e4cda118768081f528d5


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/BrandingURL.dll
    .dll windows:4 windows x86 arch:x86

    711c893e4d8189fd14b6563a4e35e663


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/blowfish.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    3f1149a3053980fe6b461521d2b55a2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • QvodCtrls/Codecs/RealMediaSplitter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    092c362fafa1e9277558c0e5612fdfba


    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/Codecs/asfsplliter.ax
    .dll regsvr32 windows:4 windows x86 arch:x86

    61540ae4d5f1fe29babe6b430f77a241


    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/Codecs/atrc.dll
    .dll windows:4 windows x86 arch:x86

    5132cde9ac8899a69f40dfaacc320c4d


    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/Codecs/cook.dll
    .dll windows:4 windows x86 arch:x86

    7186ef18b8145b9efacd73914d40cee0


    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/Codecs/drvc.dll
    .dll windows:4 windows x86 arch:x86

    5d841dc9603dda4e7058b842c1dedbfc


    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/Codecs/raac.dll
    .dll windows:4 windows x86 arch:x86

    2569b16af6a5e82c06ef6aed87f5e148


    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/Default.xml
  • QvodCtrls/Qvod.cfg
  • QvodCtrls/QvodInsert.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    1ba8d8bdd20334d51d0ebd2b7690a530


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • QvodCtrls/QvodTerminal.exe
    .exe windows:4 windows x86 arch:x86

    86a5544140f92798157b7e89931725aa


    Code Sign

    Headers

    Imports

    Sections

  • SkinH_EL.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • help.txt
  • libqvod.res
    .exe windows:4 windows x86 arch:x86

    5daab6e88e960a2c25733421cfb783f0


    Code Sign

    Headers

    Imports

    Sections

  • plugin/Զ˵.txt
  • skin/Aero.she
  • skin/Classique.she
  • skin/QQ2009.she
  • skin/QQGame2009.she
  • skin/Xenes.she
  • skin/asus.she
  • skin/china.she
  • skin/compact.she
  • skin/enjoy.she
  • skin/hlong.she
  • skin/itunes.she
  • skin/longhorn.she
  • skin/office2007.she
  • skin/pixos.she
  • skin/qq2008.she
  • skin/royale.she
  • skin/skinh.she
  • skin/whitefire.she
  • skin/X.o-MSN.she
  • skin/X.o-QQӰ.she
  • skin/X.o-REAL.she
  • skin/X.o-ľ.she
  • skin/X.o-.she
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    55f3dfd13c0557d3e32bcbc604441dd3


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • ʹ˵.txt
  • ʹͼ.JPG
    .jpg
  • ûʹЭ顷.txt
  • ˵.txt
  • װɿ첥.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections