Overview

overview

7

Static

static

5

561d93353e...18.exe

windows7-x64

7

561d93353e...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...ib.dll

windows7-x64

3

$PLUGINSDI...ib.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/SogouPY.dll

windows7-x64

3

$SYSDIR/SogouPY.dll

windows10-2004-x64

3

$SYSDIR/SogouPy.dll

windows7-x64

3

$SYSDIR/SogouPy.dll

windows10-2004-x64

3

$TEMP/FC_Puncture.exe

windows7-x64

3

$TEMP/FC_Puncture.exe

windows10-2004-x64

3

$TEMP/Install.exe

windows7-x64

3

$TEMP/Install.exe

windows10-2004-x64

3

$TEMP/check.exe

windows7-x64

1

$TEMP/check.exe

windows10-2004-x64

3

ConfigMover30b2.exe

windows7-x64

1

ConfigMover30b2.exe

windows10-2004-x64

3

HWSignature.dll

windows7-x64

6

HWSignature.dll

windows10-2004-x64

6

InstTemp/C...b2.exe

windows7-x64

1

InstTemp/C...b2.exe

windows10-2004-x64

3

InstTemp/H...re.dll

windows7-x64

6

InstTemp/H...re.dll

windows10-2004-x64

6

InstTemp/PinyinUp.exe

windows7-x64

6

InstTemp/PinyinUp.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    561d93353e3dc94e30d2a4138d7cb1c3_JaffaCakes118

  • Size

    10.0MB

  • MD5

    561d93353e3dc94e30d2a4138d7cb1c3

  • SHA1

    a2db3ab8a3a484ba16fc187fb2843f8f448e0075

  • SHA256

    2c29f7443f2334ba0830a60190ed25f8e48a40c60a608d8906a53245b453fc01

  • SHA512

    f98b24ae40267844e9faf7413f38d416b202252aa5c483dc840e1cfe29a789d91371ee2ffc6de826070f32fa5e95e9c39994621deebe7a10414280e52b706caa

  • SSDEEP

    196608:vO5SkAR7SHnS3i70JhHefk9xEozTnl8bdrsqMg9npt+o0bK3K1JsEFKulJ6zoiTu:Us2Sy7C+ezDl8bdrsjgpt30Me7FREz9C

Score
5/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 561d93353e3dc94e30d2a4138d7cb1c3_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSISdl.dll
    .dll windows:4 windows x86 arch:x86

    9cce555dd3ff1b6c7dc92d64c794c51a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SetupLib.dll
    .dll windows:4 windows x86 arch:x86

    277527a2d53f2e5d7a108da500f31b2b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    7868cd55f358bfb360f9eb8ce1512ca0


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    4ec328f99bdd944fc98d8a5cf11f7a62


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $SYSDIR/SogouPY.ime~
    .dll windows:4 windows x86 arch:x86

    bd1b513211ee801e8ad4a2764e19a733


    Headers

    Imports

    Exports

    Sections

  • $SYSDIR/SogouPy.ime
    .dll windows:4 windows x86 arch:x86

    bd1b513211ee801e8ad4a2764e19a733


    Headers

    Imports

    Exports

    Sections

  • $TEMP/FC_Puncture.exe
    .exe windows:4 windows x86 arch:x86

    bdc7e0ac178acec87d8f24fb080cb21e


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/Install.exe
    .exe windows:4 windows x86 arch:x86

    ecd614d365036c60cca8416288449c89


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/check.exe
    .exe windows:4 windows x86 arch:x86

    a700d2b44e57167a082b1ea05b531095


    Code Sign

    Headers

    Imports

    Sections

  • AllSkin/tmp/ţг.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuangpin1.bmp
  • shuangpin2.bmp
  • shuangpin3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/tmp/.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuangpin1.bmp
  • shuangpin2.bmp
  • shuangpin3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/tmp/ɫ.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuang1.bmp
  • shuang2.bmp
  • shuang3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin2.bmp
  • AllSkin/tmp/ɫռ.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuangpin1.bmp
  • shuangpin2.bmp
  • shuangpin3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/tmp/ɫռȫť.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuangpin1.bmp
  • shuangpin2.bmp
  • shuangpin3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/tmp/״̬ĬƤ.ssf
    .zip
  • 1.bmp
  • 10.bmp
  • 11.bmp
  • 12.bmp
  • 13.bmp
  • 14.bmp
  • 15.bmp
  • 16.bmp
  • 17.bmp
  • 18.bmp
  • 19.bmp
  • 2.bmp
  • 20.bmp
  • 21.bmp
  • 22.bmp
  • 23.bmp
  • 24.bmp
  • 25.bmp
  • 26.bmp
  • 27.bmp
  • 28.bmp
  • 29.bmp
  • 3.bmp
  • 30.bmp
  • 31.bmp
  • 32.bmp
  • 33.bmp
  • 34.bmp
  • 35.bmp
  • 36.bmp
  • 37.bmp
  • 38.bmp
  • 39.bmp
  • 4.bmp
  • 40.bmp
  • 41.bmp
  • 42.bmp
  • 5.bmp
  • 6.bmp
  • 7.bmp
  • 8.bmp
  • 9.bmp
  • bar.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/tmp/ѹ.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuangpin1.bmp
  • shuangpin2.bmp
  • shuangpin3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/tmp/ѹȫť.ssf
    .zip
  • a1.bmp
  • a2.bmp
  • a3.bmp
  • banjiao1.bmp
  • banjiao2.bmp
  • banjiao3.bmp
  • bar.bmp
  • cn1.bmp
  • cn2.bmp
  • cn3.bmp
  • cn_biaodian1.bmp
  • cn_biaodian2.bmp
  • cn_biaodian3.bmp
  • en1.bmp
  • en2.bmp
  • en3.bmp
  • en_biaodian1.bmp
  • en_biaodian2.bmp
  • en_biaodian3.bmp
  • fan1.bmp
  • fan2.bmp
  • fan3.bmp
  • ie1.bmp
  • ie2.bmp
  • ie3.bmp
  • jian1.bmp
  • jian2.bmp
  • jian3.bmp
  • key1.bmp
  • key2.bmp
  • key3.bmp
  • menu1.bmp
  • menu2.bmp
  • menu3.bmp
  • quanjiao1.bmp
  • quanjiao2.bmp
  • quanjiao3.bmp
  • quanpin1.bmp
  • quanpin2.bmp
  • quanpin3.bmp
  • shuangpin1.bmp
  • shuangpin2.bmp
  • shuangpin3.bmp
  • skin.ini
  • skin1.bmp
  • skin1_1.bmp
  • skin1_2.bmp
  • skin2.bmp
  • skin2_1.bmp
  • skin2_2.bmp
  • AllSkin/ţг.ssf
    .zip
  • AllSkin/.ssf
    .zip
  • AllSkin/ɫ.ssf
    .zip
  • AllSkin/ɫռ.ssf
    .zip
  • AllSkin/ɫռȫť.ssf
    .zip
  • AllSkin/״̬ĬƤ.ssf
    .zip
  • AllSkin/ѹ.ssf
    .zip
  • AllSkin/ѹȫť.ssf
    .zip
  • ConfigMover30b2.exe
    .exe windows:4 windows x86 arch:x86

    23c66f324e0bfa41a56200360ba3ef41


    Code Sign

    Headers

    Imports

    Sections

  • Correction.ini
  • HWSignature.dll
    .dll windows:4 windows x86 arch:x86

    3805775f1dde052333909932d791dd7f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • InstTemp/ConfigMover30b2.exe
    .exe windows:4 windows x86 arch:x86

    23c66f324e0bfa41a56200360ba3ef41


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/HWSignature.dll
    .dll windows:4 windows x86 arch:x86

    3805775f1dde052333909932d791dd7f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • InstTemp/PinyinUp.exe
    .exe windows:4 windows x86 arch:x86

    fbed6d3cdca258546bf123861efb423a


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/Plugin/SgImeWord.dll
    .dll windows:4 windows x86 arch:x86

    f91f5cbdb7900bcd01edd1ba46fa5f65


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • InstTemp/Resource.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • InstTemp/ScdMaker.exe
    .exe windows:4 windows x86 arch:x86

    88abcbd1a51141f0301cfd296d17116b


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/ScdReg.exe
    .exe windows:4 windows x86 arch:x86

    c9669d1f462715324739c7822f9ffad6


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/ScdViewer.exe
    .exe windows:4 windows x86 arch:x86

    8683975be732665dbe929ba4bf34d476


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/SkinReg.exe
    .exe windows:4 windows x86 arch:x86

    6c4067b0ae40cc2321708c248c817f5f


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/SpeedMeter.exe
    .exe windows:4 windows x86 arch:x86

    fa9b040212519faa86a622267b04a35e


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/UserLogon.exe
    .exe windows:4 windows x86 arch:x86

    3179030321644109eec00300c261565d


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/UserPage.exe
    .exe windows:4 windows x86 arch:x86

    c4f00a801eca325d1858b6ed7ce9b0ed


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/UsrDictUtil.exe
    .exe windows:4 windows x86 arch:x86

    b44e2ceb2223f9142281857853011198


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/ZipLib.dll
    .dll windows:4 windows x86 arch:x86

    6647bba59701ffc0138cf0511d0bc7af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • InstTemp/config.exe
    .exe windows:4 windows x86 arch:x86

    2710c672b26a8ab4617dfcaf15a4719f


    Code Sign

    Headers

    Imports

    Sections

  • InstTemp/sgim_annex.bin
  • InstTemp/sgim_bigram.bin
  • InstTemp/sgim_hz.bin
  • InstTemp/sgim_py.bin
  • InstTemp/sgim_sys.bin
  • InstTemp/userNetSchedule.exe
    .exe windows:4 windows x86 arch:x86

    452a926ae9d2eb625245455d39b83601


    Code Sign

    Headers

    Imports

    Sections

  • MoHuYin.ini
  • PinyinUp.exe
    .exe windows:4 windows x86 arch:x86

    fbed6d3cdca258546bf123861efb423a


    Code Sign

    Headers

    Imports

    Sections

  • Punctures.ini
  • Resource.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • ScdMaker.exe
    .exe windows:4 windows x86 arch:x86

    88abcbd1a51141f0301cfd296d17116b


    Code Sign

    Headers

    Imports

    Sections

  • ScdReg.exe
    .exe windows:4 windows x86 arch:x86

    c9669d1f462715324739c7822f9ffad6


    Code Sign

    Headers

    Imports

    Sections

  • ScdViewer.exe
    .exe windows:4 windows x86 arch:x86

    8683975be732665dbe929ba4bf34d476


    Code Sign

    Headers

    Imports

    Sections

  • ShuangPinSchemes/ABC.ini
  • ShuangPinSchemes/MS2003.ini
  • ShuangPinSchemes/PinyinJiaJia.ini
  • ShuangPinSchemes/Sogou.ini
  • ShuangPinSchemes/ZiGuang.ini
  • ShuangPinSchemes/ZiRanMa.ini
  • SkinReg.exe
    .exe windows:4 windows x86 arch:x86

    6c4067b0ae40cc2321708c248c817f5f


    Code Sign

    Headers

    Imports

    Sections

  • SpeedMeter.exe
    .exe windows:4 windows x86 arch:x86

    fa9b040212519faa86a622267b04a35e


    Code Sign

    Headers

    Imports

    Sections

  • Uninstall.exe.nsis
  • UserLogon.exe
    .exe windows:4 windows x86 arch:x86

    3179030321644109eec00300c261565d


    Code Sign

    Headers

    Imports

    Sections

  • UserPage.exe
    .exe windows:4 windows x86 arch:x86

    c4f00a801eca325d1858b6ed7ce9b0ed


    Code Sign

    Headers

    Imports

    Sections

  • UsrDictUtil.exe
    .exe windows:4 windows x86 arch:x86

    b44e2ceb2223f9142281857853011198


    Code Sign

    Headers

    Imports

    Sections

  • ZipLib.dll
    .dll windows:4 windows x86 arch:x86

    6647bba59701ffc0138cf0511d0bc7af


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • config.exe
    .exe windows:4 windows x86 arch:x86

    2710c672b26a8ab4617dfcaf15a4719f


    Code Sign

    Headers

    Imports

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • phrases.ini
  • plugin/SgImeWord.dll
    .dll windows:4 windows x86 arch:x86

    f91f5cbdb7900bcd01edd1ba46fa5f65


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scd/ʫ.scel
  • scd/¸top180.scel
  • scd/δʾѡ.scel
  • scd/йƱ.scel
  • scd/ʫ300.scel
  • scd/´.scel
  • scdlist.ini
  • sgim_annex.bin
  • sgim_bigram.bin
  • sgim_hz.bin
  • sgim_py.bin
  • sgim_sys.bin
  • userNetSchedule.exe
    .exe windows:4 windows x86 arch:x86

    452a926ae9d2eb625245455d39b83601


    Code Sign

    Headers

    Imports

    Sections