General

  • Target

    523f002b904f6c6d584e05a25248755d_JaffaCakes118

  • Size

    12.3MB

  • MD5

    523f002b904f6c6d584e05a25248755d

  • SHA1

    5ceebbc7f6d3738921c2391281585c3d8443c719

  • SHA256

    b97d1b40a96c4316b4c474e116c17a42d82a77cbba8e92dea6925b94962b953f

  • SHA512

    3d4185245b64865ecd0993abfa95537c8cf499aee653ccc9607688051338e9b8f9e039cc03e8decf6bfcda8b76df7264531a0c41db497dd1004ab9ebdf5b2cca

  • SSDEEP

    393216:YDl9onCvcPZBs7wqxsqxFehUllRWk7lFk:e80UZBsVxsqx8mllRdXk

Score
3/10

Malware Config

Signatures

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 523f002b904f6c6d584e05a25248755d_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    9bca2c7cb3bba360100a3a7a510fe11d


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    34e265a7f45a5a54be208d4166ec2423


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    88d8a4a9c21e345682f6b1fac45c4679


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/estUrl.dll
    .dll windows:4 windows x86 arch:x86

    7acdea225f01fb3d18307d70f460e5fd


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/inetc.dll
    .dll windows:4 windows x86 arch:x86

    6088c3f2e83ca6fe82763ba32ca3c517


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsWeb2.dll
    .dll windows:4 windows x86 arch:x86

    087a388612f9e510ed2257d715d0c521


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/stext/lic.rtf
    .rtf
  • $PLUGINSDIR/workerExtension.dll
    .dll windows:4 windows x86 arch:x86

    fa008604f38f459d72fcf6aac54fd6e9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/zumlib.dll
    .dll windows:5 windows x86 arch:x86

    31ca37d1e11c83edbc3cf2c2b88851ad


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • $PROGRAMFILES/ESTsoft/ALUpdate/$R6
    .exe windows:5 windows x86 arch:x86

    5a70273a87585111c692a131493cc58c


    Code Sign

    Headers

    Imports

    Sections

  • $PROGRAMFILES/ESTsoft/Common/ezt.exe
    .exe windows:5 windows x86 arch:x86

    5a70273a87585111c692a131493cc58c


    Code Sign

    Headers

    Imports

    Sections

  • $R6
    .dll regsvr32 windows:5 windows x86 arch:x86

    f5a5a757c7c1006feb9a3b6467d76e80


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ALSong.exe
    .exe windows:5 windows x86 arch:x86

    1efe5d07592256ebd07e147b23ce04f7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ALSongCommon.dll
    .dll windows:5 windows x86 arch:x86

    336c312d906fd0f4857870d5af997d45


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ALSongResource.dll
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • AppUpdater.dll
    .dll windows:5 windows x86 arch:x86

    248428d13af2a60ed035fe6e7eb7f518


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • EULA.rtf
    .rtf
  • MFC90KOR.DLL
    .dll windows:5 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • Microsoft.VC90.CRT.manifest
    .xml
  • Microsoft.VC90.MFC.manifest
    .xml
  • Microsoft.VC90.MFCLOC.manifest
  • asLoader.dll
    .dll windows:5 windows x86 arch:x86

    0004f176686c65e5869d3304d4cd8a8d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • mfc90u.dll
    .dll windows:5 windows x86 arch:x86

    814d9e5c82b805568941908a38d8a5f5


    Code Sign

    Headers

    Imports

    Sections

  • msvcp90.dll
    .dll windows:5 windows x86 arch:x86

    c2219f463c61f3122c87331837e12c34


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr90.dll
    .dll windows:5 windows x86 arch:x86

    0fda4497453286b1daa098623dfc53ce


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ˼ ̿ ּż մϴ.emm
    .zip
  • [Content_Types].xml
    .xml
  • docProps/app.xml
    .xml
  • docProps/core.xml
    .xml
  • docProps/thumbnail.png
    .png
  • map/content/content0001.bmp
  • map/content/content0002.png
    .png
  • map/content/content0003.png
    .png
  • map/content/content0004.png
    .png
  • map/content/content0005.png
    .png
  • map/content/content0006.png
    .png
  • map/content/content0007.png
    .png
  • map/content/content0008.png
    .png
  • map/content/content0009.png
    .png
  • map/content/content000A.png
    .png
  • map/content/content000B.png
    .png
  • map/content/content000C.png
    .png
  • map/content/content000D.png
    .png
  • map/content/content000E.png
    .png
  • map/content/content000F.png
    .png
  • map/content/content0010.png
    .png
  • map/content/content0011.jpg
    .jpg
    • http://m.site.naver.com/05Udx

  • map/content/content0012.png
    .png
  • map/content/content0013.png
    .png
  • map/content/content0014.png
    .png
  • map/content/content0015.png
    .png
  • map/maps/map1.xml
    .xml
  • map/maps/mapMaster1.xml
    .xml
  • map/shape/presentShape.xml
    .xml
  • map/shape/shape.xml
    .xml