c15db2f99032476751335150f1c575d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c15db2f99032476751335150f1c575d2_JaffaCakes118
Size

194KB
MD5

c15db2f99032476751335150f1c575d2
SHA1

a9ebf4abfd9ed0a8e99fad79fae4941c7eb5e154
SHA256

c2e67957a7e108d9bded04badc92d1089c6c73c7badba9d221f5b049b3a76be0
SHA512

40e7c3676c2f80d4007778267d64bc56053c5a8a2b8228f35693a8b76e977dff48c2f69a9bf1e72d2bd4b369dc61c44795804b98d62144f87ce0a78fc28b0744
SSDEEP

3072:+UzEPPaqqEucY4wP1Y8HszmF68ZylsZguu7Hd/HdCefrGg1x8Z6tzjq+zzj7DWt7:+A8Y4wPqSZY7Hd/Hd9frLVDgOnUU2gq

Score

1^/10

Malware Config

Signatures

Files

c15db2f99032476751335150f1c575d2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

f4e51729b53821ce8d8d23c37a4e0ba5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:11:97:d7:ee:26:8d:26:52:3c:a3:39:96:07:ef:09
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06/07/2017, 00:00

Not After

21/06/2020, 23:59

Subject

CN=YOUHOLDER CO.\, LTD.,O=YOUHOLDER CO.\, LTD.,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:12:ed:5b:9e:29:2b:5e:3e:1a:1b:40:12:c5:df:ff:92:10:b4:73
Signer

Actual PE Digest

64:12:ed:5b:9e:29:2b:5e:3e:1a:1b:40:12:c5:df:ff:92:10:b4:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\GitLab-Runner\builds\9e6ca229\0\winapp\mc\MCExtendQuote\Release\MCExtendQuote.pdb

Imports

mfc100u

ord2201
ord4331
ord2823
ord1295
ord895
ord11846
ord11209
ord11240
ord9499
ord7391
ord11237
ord11228
ord5261
ord3416
ord11353
ord261
ord13415
ord13219
ord1978
ord3846
ord1476
ord11494
ord6869
ord1292
ord890
ord6140
ord11845
ord9498
ord11236
ord13568
ord13571
ord13569
ord1911
ord13567
ord13570
ord7179
ord11469
ord13267
ord10976
ord14162
ord1739
ord7126
ord11864
ord3625
ord3684
ord8530
ord13387
ord7108
ord13381
ord11477
ord11476
ord2164
ord4744
ord13854
ord11784
ord7548
ord7624
ord13605
ord1862
ord322
ord7176
ord4086
ord11615
ord11838
ord13168
ord13212
ord7211
ord4151
ord11683
ord1899
ord4150
ord3507
ord7913
ord11801
ord7357
ord2062
ord13396
ord11330
ord2057
ord6036
ord5264
ord285
ord13127
ord5229
ord2629
ord1326
ord286
ord2119
ord1987
ord4088
ord6660
ord265
ord266
ord1446
ord1312
ord11619
ord11531
ord7662
ord468
ord1445
ord5517
ord11530
ord7661
ord5118
ord4794
ord5302
ord5807
ord1019
ord1871
ord2898
ord5074
ord1870
ord745
ord11503
ord6704
ord4642
ord4923
ord5115
ord8483
ord4901
ord4645
ord4623
ord6931
ord6932
ord6922
ord4792
ord7393
ord9328
ord8346
ord342
ord3879
ord920
ord6323
ord7300
ord6667
ord6674
ord1310
ord1313
ord5514
ord11527
ord465
ord469
ord1016
ord1020
ord871
ord7524
ord258
ord1298
ord1442
ord2614
ord7658
ord290
ord4519
ord280
ord1450
ord296
ord409
ord4290
ord902
ord2064
ord2068
ord5813
ord1272
ord13572
ord908
ord2091
ord2055
ord2053
ord2080
ord1984
ord2045
ord3413
ord408
ord1953
ord2090
ord2088
ord1945
ord1873
ord1934
ord323
ord1301
ord1300

msvcr100

_wtol
wcstod
_wtoi64
_CxxThrowException
memset
memmove
__CxxFrameHandler3
memcpy
free
realloc
malloc
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_recalloc
calloc
_localtime64_s
_mktime64

kernel32

GetLocalTime
WritePrivateProfileStringW
MultiByteToWideChar
GetCurrentThreadId
lstrlenW
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
lstrcpyW
LeaveCriticalSection
EnterCriticalSection
GetLastError
FindResourceW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
LocalAlloc
LocalFree
TerminateThread
lstrlenA
GetCurrentDirectoryW
GetDllDirectoryW
SetCurrentDirectoryW
SetDllDirectoryW
GetProcAddress
GetSystemTime
InterlockedDecrement
CreateEventW
ResetEvent
WaitForSingleObject
CreateSemaphoreW
CloseHandle
SetEvent
Sleep
GetModuleFileNameW
SystemTimeToFileTime
LoadResource
LockResource
FreeLibrary
GetModuleHandleExW
FileTimeToSystemTime
WideCharToMultiByte
DeleteCriticalSection

user32

PostThreadMessageW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoUninitialize
CoInitializeEx
CLSIDFromString
CoCreateInstance
CLSIDFromProgID

oleaut32

SetErrorInfo
VariantChangeType
GetErrorInfo
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantClear
VariantInit
CreateErrorInfo

Exports

Exports

Deinit
GetCP
GetExpireDateTimeSpan
GetHotMonthByDateTime
GetMonth
GetStrike
GetUnderlying
GetValidPrice
GetValidPrice2
Init
get_chip
get_currency_exchange_rate
get_dividend_info
get_hot_spread
get_hot_spread_2
get_open_interest
get_open_interest_2
get_realtime_greeks
get_realtime_price
get_realtime_price_2
get_realtime_string
get_realtime_string_2
get_realtime_value
get_realtime_value_2

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4e51729b53821ce8d8d23c37a4e0ba5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:11:97:d7:ee:26:8d:26:52:3c:a3:39:96:07:ef:09Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

64:12:ed:5b:9e:29:2b:5e:3e:1a:1b:40:12:c5:df:ff:92:10:b4:73Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc100u

msvcr100

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 134KB - Virtual size: 133KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 11KB - Virtual size: 11KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:11:97:d7:ee:26:8d:26:52:3c:a3:39:96:07:ef:09
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

64:12:ed:5b:9e:29:2b:5e:3e:1a:1b:40:12:c5:df:ff:92:10:b4:73
Signer

.text
Size: 134KB - Virtual size: 133KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 11KB - Virtual size: 11KB