General

  • Target

    54cad8d8e97c8d267f86def0b245cdde_JaffaCakes118

  • Size

    3.3MB

  • MD5

    54cad8d8e97c8d267f86def0b245cdde

  • SHA1

    0b14c3c75c235c89d09ae49d14f9785bee3dceb4

  • SHA256

    34621e581e9a49dc9061e9f1fb8da61cea87256ff0286184f828f5500b2678bb

  • SHA512

    523090632a199c85ae6fe445c430cabc3b38392fece0347d1318d05d3ae69e03e9cb30fa07211d93aa357833b637dbec8367e61245e9db37dc5a4df02de13d28

  • SSDEEP

    49152:3x+vGauF2wXa63Rn8Zk1a/XuaURkQCyo9k08i8hBZmxrZrPjhDQhUlJ/4pBxZhN9:B+5qPHCw08i8HZmxFRvJ/4lZ/nXP1

Score
3/10

Malware Config

Signatures

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

Files

  • 54cad8d8e97c8d267f86def0b245cdde_JaffaCakes118
    .rar
  • ThunderMini_1.5.3.288.exe
    .exe windows:4 windows x86 arch:x86

    099c0646ea7282d232219f8807883be0


    Code Sign

    Headers

    Imports

    Sections

  • $0/bootstrap.dat
  • $0/dhtnodes.dat
  • $0/nodes.dat
  • $0/server.met
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    1e2884056e655f2b7bc5a904e352fc80


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsDialogsEx.dll
    .dll windows:4 windows x86 arch:x86

    02ac382b0aa3d8574be02010358ce772


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/system32/atl71.dll
    .dll windows:4 windows x86 arch:x86

    a0bd0cbc6c3c1f3095dd9342b630fcb9


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/system32/msvcp71.dll
    .dll windows:4 windows x86 arch:x86

    5e2398adb60a70c7ab04e7cba75a7983


    Headers

    Imports

    Exports

    Sections

  • $WINDIR/system32/msvcr71.dll
    .dll windows:4 windows x86 arch:x86

    7acc8c379c768a1ecd81ec502ff5f33e


    Headers

    Imports

    Exports

    Sections

  • Bin/ThunderFW.exe
    .exe windows:5 windows x86 arch:x86

    7717b5d034e4ed74403172187d115c63


    Code Sign

    Headers

    Imports

    Sections

  • Bin/ThunderLiveUD.exe
    .exe windows:4 windows x86 arch:x86

    87a590bf102bdd919987d0c3f9891381


    Code Sign

    Headers

    Imports

    Sections

  • Bin/ThunderMini.exe
    .exe windows:4 windows x86 arch:x86

    d86089d40e2989ad74003867a97745d8


    Code Sign

    Headers

    Imports

    Sections

  • Bin/TorrentFile.ico
  • Bin/UnInstallClean.exe
    .exe windows:4 windows x86 arch:x86

    8f5c5e6afd585637a3c843c413b642b3


    Code Sign

    Headers

    Imports

    Sections

  • Bin/XLBugHandler.dll
    .dll windows:4 windows x86 arch:x86

    13e3b662d9bf078975904d4548399759


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/XLBugReport.exe
    .exe windows:4 windows x86 arch:x86

    f4784a28242b3dc39716d60acc416a6e


    Code Sign

    Headers

    Imports

    Sections

  • Bin/XLCrypto.dll
    .dll windows:4 windows x86 arch:x86

    4a01333d1673a520341f5d0fb358b573


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/XLLuaRuntime.dll
    .dll windows:4 windows x86 arch:x86

    ec367aafde8a22a49d46cb219ced1849


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/dl_lib.dll
    .dll windows:4 windows x86 arch:x86

    1ccf04eb16df8d369d800e5c4b4e902a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/dl_peer_id.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    2827932cca8caf8a10f65e148687b7a0


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/download-complete.wav
  • Bin/download_engine.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    6bc496db9063061b058d3a0b3009f77c


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/dphubt.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    10afb8c10eedd76a4d519be258950eac


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/libexpat.dll
    .dll windows:4 windows x86 arch:x86

    16adaa296932ee15ea6dacef0485a6a3


    Headers

    Imports

    Exports

    Sections

  • Bin/libpng13.dll
    .dll windows:4 windows x86 arch:x86

    b5556ad19388998fa1108d4fa8ae9798


    Headers

    Imports

    Exports

    Sections

  • Bin/minizip.dll
    .dll windows:4 windows x86 arch:x86

    42ec74970cf4f102712a1588d5814466


    Headers

    Imports

    Exports

    Sections

  • Bin/sqlite3.dll
    .dll windows:4 windows x86 arch:x86

    b8f8af71acd3910a05ab4bbbc8a41e00


    Headers

    Imports

    Exports

    Sections

  • Bin/xl_data.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    44b3bbdba638491b732190699ca8cf6d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Bin/zlib1.dll
    .dll windows:4 windows x86 arch:x86

    d00508bfde28cfe9a438e31820271a30


    Headers

    Imports

    Exports

    Sections

  • Skin/downloader.xml
  • Skin/downloader/DownTriangle.png
    .png
  • Skin/downloader/ExportTask2Thunder7Progress.png
    .png
  • Skin/downloader/ExportTask2Thunder7ProgressBk.png
    .png
  • Skin/downloader/MainFrame.png
    .png
  • Skin/downloader/MiniXlTab_Normal.png
    .png
  • Skin/downloader/MiniXlTab_Sel.png
    .png
  • Skin/downloader/Mini_Btn.png
    .png
  • Skin/downloader/MsgBoxIcon.png
    .png
  • Skin/downloader/MsgBoxIcon_warning.png
    .png
  • Skin/downloader/NormalFrame.png
    .png
  • Skin/downloader/SelButton.png
    .png
  • Skin/downloader/SuccessIcon.png
    .png
  • Skin/downloader/TaskActive.png
    .png
  • Skin/downloader/TaskActiveProgress.png
    .png
  • Skin/downloader/TaskDownloadNormal.png
    .png
  • Skin/downloader/TaskDownloadSelected.png
    .png
  • Skin/downloader/TaskFailed.png
    .png
  • Skin/downloader/TaskFailedActived.png
    .png
  • Skin/downloader/TaskFailedSelected.png
    .png
  • Skin/downloader/TaskNormal.png
    .png
  • Skin/downloader/TaskNormalProgress.png
    .png
  • Skin/downloader/TaskSelected.png
    .png
  • Skin/downloader/TipsFrame.png
    .png
  • Skin/downloader/Title_Btn.png
    .png
  • Skin/downloader/about_title.png
    .png
  • Skin/downloader/bitmap.griper.png
    .png
  • Skin/downloader/bitorrent_big.png
    .png
  • Skin/downloader/bitorrent_min.png
    .png
  • Skin/downloader/btn_23h_down.png
    .png
  • Skin/downloader/btn_23h_normal.png
    .png
  • Skin/downloader/btn_23h_over.png
    .png
  • Skin/downloader/btn_26h_down.png
    .png
  • Skin/downloader/btn_26h_normal.png
    .png
  • Skin/downloader/btn_26h_over.png
    .png
  • Skin/downloader/btn_sel_26h_down.png
    .png
  • Skin/downloader/btn_sel_26h_normal.png
    .png
  • Skin/downloader/btn_sel_26h_over.png
    .png
  • Skin/downloader/btn_update_down.png
    .png
  • Skin/downloader/btn_update_normal.png
    .png
  • Skin/downloader/btn_update_over.png
    .png
  • Skin/downloader/button_orange_normal.png
    .png
  • Skin/downloader/button_orange_over.png
    .png
  • Skin/downloader/check_box.png
    .png
  • Skin/downloader/check_btn_list.png
    .png
  • Skin/downloader/close_btn.png
    .png
  • Skin/downloader/close_btn_alone.png
    .png
  • Skin/downloader/default_icon.png
    .png
  • Skin/downloader/default_menu.png
    .png
  • Skin/downloader/delete_btn_list.png
    .png
  • Skin/downloader/down_triangle.png
    .png
  • Skin/downloader/downpop_icon_list.png
    .png
  • Skin/downloader/expandcollapse.png
    .png
  • Skin/downloader/icon_4in1.png
    .png
  • Skin/downloader/imagelist.checkbox.png
    .png
  • Skin/downloader/line_17h.png
    .png
  • Skin/downloader/maindlg_title.png
    .png
  • Skin/downloader/radio_btn_list.png
    .png
  • Skin/downloader/task_open_btn_down.png
    .png
  • Skin/downloader/task_open_btn_normal.png
    .png
  • Skin/downloader/task_open_btn_over.png
    .png
  • Skin/downloader/task_opendir_btn_down.png
    .png
  • Skin/downloader/task_opendir_btn_normal.png
    .png
  • Skin/downloader/task_opendir_btn_over.png
    .png
  • Skin/downloader/task_restart_btn_down.png
    .png
  • Skin/downloader/task_restart_btn_normal.png
    .png
  • Skin/downloader/task_restart_btn_over.png
    .png
  • Skin/downloader/task_start_btn_down.png
    .png
  • Skin/downloader/task_start_btn_normal.png
    .png
  • Skin/downloader/task_start_btn_over.png
    .png
  • Skin/downloader/task_state_icon_6in1.png
    .png
  • Skin/downloader/task_stop_btn_down.png
    .png
  • Skin/downloader/task_stop_btn_normal.png
    .png
  • Skin/downloader/task_stop_btn_over.png
    .png
  • Skin/downloader/taskbar_bgofnum.png
    .png
  • Skin/downloader/taskbar_unsigned.png
    .png
  • Skin/downloader/taskstate.png
    .png
  • Skin/downloader/tiny_close_btn.png
    .png
  • Skin/downloader/tool_icon_3in1.png
    .png
  • Skin/downloader/tool_icon_4in1.png
    .png
  • Skin/downloader/toolwndbk.png
    .png
  • Skin/downloader/triangle_delete.png
    .png
  • Skin/downloader/warning_texture.png
    .png
  • Skin/downloader/welcomeFrame.png
    .png
  • Skin/downloader/xlheadbar.png
    .png
  • Skin/downloader/xlheadbar_bk.png
    .png
  • Skin/downloader/xllitelogo.png
    .png
  • Uninst.exe.nsis
  • bho/BHOInstall.exe
    .exe windows:4 windows x86 arch:x86

    fb10d9e6ac625d40ab9a3c54dff22fec


    Code Sign

    Headers

    Imports

    Sections

  • bho/ThunderAgent.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9d879c00593d15373e1bad41a36b8920


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bho/XLNonIESvr.exe
    .exe windows:4 windows x86 arch:x86

    fb10d9e6ac625d40ab9a3c54dff22fec


    Code Sign

    Headers

    Imports

    Sections

  • bho/XunleiBHO.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    f8f365603c5608743d6c083f5412b418


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bho/getAllurl.htm
    .html .vbs polyglot
  • bho/geturl.htm
    .html .js polyglot
  • bho/minixlgetAllurl.htm
    .html .vbs polyglot
  • bho/minixlgeturl.htm
    .html .js polyglot
  • bho/thunder.xpi
    .zip
  • chrome.manifest
  • chrome/thunder.jar
    .zip
  • content/contents.rdf
    .xml
  • content/download.gif
    .gif
  • content/download.js
    .js
  • content/downloadall.gif
    .gif
  • content/icon.bmp
  • content/main.js
    .js
  • content/main.xul
  • content/menu.css
  • content/product.js
    .js
  • content/public.js
    .js
  • locale/en-US/contents.rdf
    .xml
  • locale/en-US/thunder.dtd
  • locale/zh-CN/contents.rdf
    .xml
  • locale/zh-CN/thunder.dtd
  • components/ThunderComponent.dll
    .dll windows:4 windows x86 arch:x86

    6e5f0f0721bf963c42dcbc455ad05401


    Headers

    Imports

    Exports

    Sections

  • install.rdf
    .xml
  • bho/xl_plugin_chrome.crx
    .zip
  • _locales/zh_CN/messages.json
  • _locales/zh_TW/messages.json
  • background.html
    .js
  • images/extension_logo.png
    .png
  • images/install_logo.png
    .png
  • images/menu_logo.png
    .png
  • js/xl.js
    .js
  • manifest.json
  • xl_chrome.dll
    .dll windows:4 windows x86 arch:x86

    502210d9df4b9c4f5727563426802a6c


    Headers

    Imports

    Exports

    Sections

  • bho/xl_plugin_chrome_5.crx
    .zip
  • _locales/zh_CN/messages.json
  • _locales/zh_TW/messages.json
  • background.html
    .js
  • images/extension_logo.png
    .png
  • images/install_logo.png
    .png
  • js/xl.js
    .js
  • manifest.json
  • xl_chrome.dll
    .dll windows:4 windows x86 arch:x86

    502210d9df4b9c4f5727563426802a6c


    Headers

    Imports

    Exports

    Sections