Overview

overview

3

Static

static

3

P2Pzzz/ARPOver.exe

windows7-x64

1

P2Pzzz/ARPOver.exe

windows10-2004-x64

3

P2Pzzz/DBdll.dll

windows7-x64

3

P2Pzzz/DBdll.dll

windows10-2004-x64

3

P2Pzzz/P2POver.chm

windows7-x64

1

P2Pzzz/P2POver.chm

windows10-2004-x64

1

P2Pzzz/P2POver.exe

windows7-x64

1

P2Pzzz/P2POver.exe

windows10-2004-x64

3

P2Pzzz/P2P...��.exe

windows7-x64

3

P2Pzzz/P2P...��.exe

windows10-2004-x64

3

P2Pzzz/Registry.exe

windows7-x64

3

P2Pzzz/Registry.exe

windows10-2004-x64

3

P2Pzzz/Update.exe

windows7-x64

3

P2Pzzz/Update.exe

windows10-2004-x64

3

P2Pzzz/Win..._1.exe

windows7-x64

3

P2Pzzz/Win..._1.exe

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/nsWeb.dll

windows7-x64

3

$PLUGINSDIR/nsWeb.dll

windows10-2004-x64

3

$PLUGINSDIR/nxs.dll

windows7-x64

3

$PLUGINSDIR/nxs.dll

windows10-2004-x64

3

$SYSDIR/Packet.dll

windows7-x64

3

$SYSDIR/Packet.dll

windows10-2004-x64

3

$SYSDIR/WanPacket.dll

windows7-x64

3

$SYSDIR/WanPacket.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    09b511800247aff0c6b4f178ee2d5564_JaffaCakes118

  • Size

    1.6MB

  • MD5

    09b511800247aff0c6b4f178ee2d5564

  • SHA1

    a3db85c2198413f91c63cbeb58d2d8ea3faab180

  • SHA256

    f4dbb23d02bc2f4482c8c99f7984e6caa4b10e5b58af567897faa68af6f86c13

  • SHA512

    ba4191155f5c889d732766238bdb22d9daf17ee2b3a3975f5e4892b1906ca5ce9bc045a6c5bb0d03ea45269219330e6201bb9422f4fa27a49ee841754f51cefb

  • SSDEEP

    49152:Bljz5aF1zVJz4KYCZxEyFCvZHU3ccsNJY7QkBLc6:BlQF5KCYDvyhhBLl

Score
3/10

Malware Config

Signatures

  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 1 IoCs
    installer

Files

  • 09b511800247aff0c6b4f178ee2d5564_JaffaCakes118
    .rar
  • P2Pzzz/ARPOver.exe
    .exe windows:4 windows x86 arch:x86

    1c7bec1acae7e2603bbe21886b253cbe


    Headers

    Imports

    Sections

  • P2Pzzz/DBdll.dll
    .dll windows:4 windows x86 arch:x86

    cdaeac65b2bf199739102889805253be


    Headers

    Imports

    Exports

    Sections

  • P2Pzzz/License.txt
  • P2Pzzz/P2POver.chm
    .chm
  • P2Pzzz/P2POver.exe
    .exe windows:4 windows x86 arch:x86

    fb5a9b7c4413efc955cb8eef3571fac3


    Headers

    Imports

    Sections

  • P2Pzzz/P2P终结者绿色破解版说明.EXE
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • P2Pzzz/Registry.exe
    .exe windows:4 windows x86 arch:x86

    9fa98a67ae064c1a95751c9d859d4818


    Headers

    Imports

    Sections

  • P2Pzzz/Update.exe
    .exe windows:4 windows x86 arch:x86

    3a18a5b53c34e210a36edd4cece0abee


    Headers

    Imports

    Sections

  • P2Pzzz/WinPcap_3_1.exe
    .exe windows:4 windows x86 arch:x86

    381e79edf6f32b225643e232be0965fa


    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecDos.dll
    .dll windows:4 windows x86 arch:x86

    1a5b47ca342113ac49d8568610b85a28


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    9d433976e02d79532f0d635ee81d0b20


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    d79c2fe1aafe446fbd9b984f61377e3e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsWeb.dll
    .dll windows:4 windows x86 arch:x86

    d12ed83df3a4aa87887f14a225ff95d4


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nxs.dll
    .dll windows:4 windows x86 arch:x86

    e18347a0d90ed806e5568c00e96f58d5


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/Packet.dll
    .dll windows:4 windows x86 arch:x86

    a8045d201fdcff39736c580dad656cef


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/WanPacket.dll
    .dll windows:4 windows x86 arch:x86

    d1365884b82c502a6b807942e541ebcd


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/drivers/npf.sys
    .sys windows:5 windows x86 arch:x86

    330366a156f1cd215a328f63c2b6208b


    Headers

    Imports

    Sections

  • $SYSDIR/pthreadVC.dll
    .dll windows:4 windows x86 arch:x86

    90ee61357770484e2d085958b94141a3


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/wpcap.dll
    .dll windows:4 windows x86 arch:x86

    06f3d2c48036103c8a5f5cfdcf3daca1


    Headers

    Imports

    Exports

    Sections

  • $TEMP/WpBann.htm
    .html
  • NetMonInstaller.exe
    .exe windows:5 windows x86 arch:x86

    94502e058da0fe00a88ebbc87703a18c


    Headers

    Imports

    Sections

  • daemon_mgm.exe
    .exe windows:4 windows x86 arch:x86

    2826a777c5b099aee5bc5037f22b32db


    Headers

    Imports

    Sections

  • npf_mgm.exe
    .exe windows:4 windows x86 arch:x86

    cca90a57f8cbd4ba808e467ec181cfd5


    Headers

    Imports

    Sections

  • rpcapd.exe
    .exe windows:4 windows x86 arch:x86

    8e2727c84cf6ac7ed96f0b04b324d2d9


    Headers

    Imports

    Sections

  • P2Pzzz/band.dat
  • P2Pzzz/chatdns.dat
  • P2Pzzz/flow.mdb
  • P2Pzzz/host.dat
  • P2Pzzz/lpk.dll
    .dll windows:5 windows x86 arch:x86

    00c5fd00087020a0645079ce30f4148b


    Headers

    Imports

    Exports

    Sections

  • P2Pzzz/p2pOver.ini
  • P2Pzzz/p2pfilter.sys
    .sys windows:4 windows x86 arch:x86

    595687010f92ae0ff547af4bee977f33


    Headers

    Imports

    Sections

  • P2Pzzz/regurl.dat
  • P2Pzzz/revision.txt
  • P2Pzzz/site.dat
  • P2Pzzz/update.idx
  • P2Pzzz/version.dat
  • P2Pzzz/中国破解联盟-木蚂蚁社区.url
    .url
  • P2Pzzz/使用说明.txt
  • P2Pzzz/注册说明.htm
    .html .js polyglot