General

  • Target

    0b94cbb0ec8bff896db345ad0c8a7078_JaffaCakes118

  • Size

    4.1MB

  • MD5

    0b94cbb0ec8bff896db345ad0c8a7078

  • SHA1

    8984f58225e005631e94c01d592e48964c3b6e40

  • SHA256

    64cd290dac25bdb67c194248011edd0a7ac45a2cc3471f7c1c2dadb9f75187d7

  • SHA512

    368c98371aec7ec01de79e7dff81e4de5f95cfdfbbadf171a2cdbfcee8bfcd9187b2ae0b59f004df7bfa7258bb39229b5340debea96dc9105fc473231f3816e9

  • SSDEEP

    98304:ke7T6oBa2s4okp73DaQFVrfWh2wdtCIBA9VGCKnlPt4OGpNA:xta2s4okRDaorOwPICN0w5+

Score
3/10

Malware Config

Signatures

  • Unsigned PE 12 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 0b94cbb0ec8bff896db345ad0c8a7078_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    dfb06052e74b26a42b0e490bd1c07959


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/163pan.ico
  • $SYSDIR/55277.ico
  • $SYSDIR/movie.ico
  • $SYSDIR/tao.ico
  • $TEMP/YoudaoDict_zhusha_quantui_003.exe
    .exe windows:5 windows x86 arch:x86

    d733325afb1b78a1866016af1f6cd3a8


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:5 windows x86 arch:x86

    daeb419961fa3d87aec2a1a0b184db31


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-wizard.bmp
  • Acrobat2Dict.dll
    .dll windows:4 windows x86 arch:x86

    1c499a2ae903487d5f3749d99889e3be


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RunDict.exe
    .exe windows:4 windows x86 arch:x86

    00d3c0f954eb7424cf274f9fa7e449cf


    Code Sign

    Headers

    Imports

    Sections

  • TextExtractor2.dll
    .dll windows:4 windows x86 arch:x86

    acee165c74b38d7cc448cc96accd481e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • WordBook.exe
    .exe windows:4 windows x86 arch:x86

    aabdca0b44e4adc9f9bd396f07a4849a


    Code Sign

    Headers

    Imports

    Sections

  • YodaoDict.api
    .dll windows:4 windows x86 arch:x86

    ec28fc66dbc45c1019bb4d0323b57017


    Headers

    Imports

    Exports

    Sections

  • YodaoDict.exe
    .exe windows:4 windows x86 arch:x86

    2a8aa60057d1156c944364c1237c1297


    Code Sign

    Headers

    Imports

    Sections

  • YodaoOcr.exe
    .exe windows:4 windows x86 arch:x86

    37ec0e8e4ee0538ede72ed969aee6eb2


    Code Sign

    Headers

    Imports

    Sections

  • dictcn.db
  • dicten.db
  • tessdll.dll
    .dll windows:4 windows x86 arch:x86

    32719c5222339426d8e7fb8db18ab8fa


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $TEMP/sobar.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • MFC71.dll
    .dll windows:4 windows x86 arch:x86

    7397fb8b8633dd76aa9cbc7e2e0c24bd


    Headers

    Imports

    Sections

  • cfg.ini
  • msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • update.exe
    .exe windows:4 windows x86 arch:x86

    88342d99f5b12d927afb3aea96efa927


    Headers

    Imports

    Sections

  • wagabb.exe
    .exe windows:4 windows x86 arch:x86

    d3ca931154e36b7e485552764e56e9ee


    Headers

    Imports

    Sections

  • welcome.html
    .html .js polyglot