General

  • Target

    398d1f116bdb1e3d173ea996e9f6d6c6_JaffaCakes118

  • Size

    968KB

  • MD5

    398d1f116bdb1e3d173ea996e9f6d6c6

  • SHA1

    f61edb68de4ae331b696d7dddcab47ca3309eef4

  • SHA256

    7d8dfcabd9282c317aab1b9009a357aa933d5f5f6ec243487c553b5268c2d4fc

  • SHA512

    31110e0150c2e4bfa833612e2e61625a7d4489bcf26c5c9f7f98b595b6c1e26542de7aa173a7a8174d0b64aef1c1ded5ef58dd98e264467d71de7a7607e8d94b

  • SSDEEP

    24576:ww5DH3KQIFRqraWsJ/NnoeRV3bDj9IJpr+ZopA:ww53KvqrJW/15rDjefieA

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 398d1f116bdb1e3d173ea996e9f6d6c6_JaffaCakes118
    .rar
  • Readme-说明.htm
  • bangnitao/帮你淘.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • 如果无法运行,请先安装.NET Framework - 飓风软件下载.mht
    .eml
    • http://www.baidu.com/s?tn=jfskychina&wd=site:jfsky.com+���°�Microsoft .NET Framework

    • http://www.google.cn/search?complete=1&hl=zh-CN&q=site:jfsky.com+���°�Microsoft .NET Framework

    • http://www.jfsky.com/

    • http://www.jfsky.com/Search_Soft.asp

    • http://www.jfsky.com/SoftDown/SoftDown_42598.html

    • http://www.jfsky.com/SoftList/Catalog_10_SoftTime_Desc_1.html

    • http://www.jfsky.com/SoftList/Catalog_11_SoftTime_Desc_1.html

    • http://www.jfsky.com/SoftList/Catalog_131_SoftTime_Desc_1.html

    • http://www.jfsky.com/SoftList/Catalog_177_SoftTime_Desc_1.html

    • Show all
  • attachment-10
    .js
  • attachment-11
    .js
  • attachment-13
    .js
  • attachment-14
  • attachment-15
    .js
  • attachment-16
    .js
  • attachment-18
    .js
  • attachment-19
    .js
  • attachment-2
    .gif
  • attachment-20
    .js
  • attachment-4
    .gif
  • attachment-5
    .gif
  • attachment-6
    .gif
  • attachment-7
  • attachment-8
  • attachment-9
    .js
  • email-html-1.txt
    .html
  • 软件说明.txt