04fefb002a13ce5027a947cf0f500af4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

04fefb002a13ce5027a947cf0f500af4_JaffaCakes118
Size

2.0MB
MD5

04fefb002a13ce5027a947cf0f500af4
SHA1

0a832705f757eb401709e22b373eb9b017d3f45a
SHA256

8c5e7a938131eab46973a394c43c5d89bd8fd1a80e75710c8059cbc6d599fe47
SHA512

5634a7120ac9ddf37b47497494ba3e26efa221f43698a69f66dedffcfbe3d64080cb7d9e2f167b7a2dbba74e55280e5904389083b7794663f74a39082e1f6c56
SSDEEP

24576:sTe6KJD/0lHcJD/0sJbvEJbvb6PzI/JbU/JbU/m0hvguc00hvguc00hvgucONN5D:cevn3Q0aSDxDI

Score

1^/10

Malware Config

Signatures

Files

04fefb002a13ce5027a947cf0f500af4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6b927e4cb6fc9da5a252c7dc1e52a674

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/05/2013, 00:00

Not After

11/07/2016, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:ee:d6:d0:bf:e2:68:a0:24:68:d7:8e:80:9a:fb:63:98:e2:c5:25
Signer

Actual PE Digest

62:ee:d6:d0:bf:e2:68:a0:24:68:d7:8e:80:9a:fb:63:98:e2:c5:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupOpenInfFileA
SetupCloseInfFile
SetupFindNextLine
CM_Get_DevNode_Status_Ex
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupGetStringFieldA
SetupFindFirstLineA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList

kernel32

GetThreadLocale
ReadFile
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
GetCommandLineA
GetProcessHeap
ExitProcess
HeapSize
GetACP
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GlobalFlags
WritePrivateProfileStringA
InterlockedIncrement
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameA
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
GlobalFree
GlobalLock
GlobalUnlock
FormatMessageA
FindFirstFileA
FindNextFileA
FindClose
SetLastError
GetCurrentThread
GlobalAlloc
GetWindowsDirectoryA
lstrcatA
LoadLibraryA
GetFileSize
WriteFile
FreeLibrary
lstrlenA
CompareStringA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
GetSystemDefaultLangID
GetUserDefaultLangID
LocalFree
LocalAlloc
CreateFileA
DeviceIoControl
CloseHandle
GetVersionExA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
RaiseException

user32

ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
ClientToScreen
GetSystemMetrics
GetWindow
CharUpperA
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
DestroyMenu
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions

gdi32

DeleteDC
GetStockObject
SetWindowExtEx
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
ScaleWindowExtEx

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupPrivilegeNameA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyA
RegOpenKeyA
RegEnumValueA
RegCloseKey
RegSetValueExA

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

ChkAPOSupportDolbyPCEE4_DAA
ChkAPOSupportDolbyPCEE4_DHT
ChkBroadComID
ChkDellAlienwareModel
ChkDellControlinStartMenu
ChkDolbyPCEE4_SelectorDemoOnly_Supported
ChkDolbyPCEE4_SelectorEditorOnly_Supported
ChkDolbyPCEE4_SelectorOnly_Supported
ChkDolbyPCEE4_SetupPCEE4Prog_NoDemo
ChkDolbyPCEE4_SetupPCEE4Prog_NoEditor
ChkDolbyPCEE4_SetupPCEE4Prog_NoSelector
ChkHDMISupported
ChkLoadDrvPrivilege
ChkRtkCPLSupported
ChkRtkNewGUISupported
ChkRtkRegKeyEmpty_x64_CU
ChkRtkRegKeyEmpty_x64_LM
ChkRtkRegKeyEmpty_x86_CU
ChkRtkRegKeyEmpty_x86_LM
ChkSupportAPODTSAPOUltraPCBoost
ChkSupportAPOSupportSonceFocus30
ChkSupportAPOSupportSonceFocus30_NoSonicFocusGUI
ChkSupportAPOSupportSonceFocus30_SonicFocusGUI
ChkSupportAPOSupportSonceFocus30_SonicMasterGUI
ChkSupportDolbySpruce
ChkSupportDolby_DS1_DAA
ChkSupportDolby_DS1_DHT
ChkSupportHP_AIO
ChkSupportHP_AIO_SonicFocusBeats
ChkSupportMaxxAudio30
ChkSupportMaxxVolumeSD
ChkSupportSoundRoom
Chk_HP_AIO_Model_Customized01_Supported
Chk_MAXX_MA3TCelticUI_Supported
Chk_SRS_HPPremiumBlackSkin_RTGS_HPDTS_SOUND_Supported
Chk_SRS_HPPremiumBlackSkin_Supported
Chk_SupportNahimicAPO_Supported
Chk_VistaNoDoblyUI_Official_Supported
ConfirmRtkDrv
ExtractBeatsIcon
ExtractDTSIcon
ExtractHideWin
ExtractRtkIcon
ExtractSRSIcon
ExtractSetupService
GetAudioInterface
GetDrvPolicy
GetHDASubID
GetRegistryProperty
GetRtkHDAudioGlobalPolicy
GetRtkHDAudioGlobalPolicy_APODTSAPOUltraPCBoost_All
GetRtkHDAudioGlobalPolicy_APOSupportSonicFocus30
GetRtkHDAudioGlobalPolicy_APOSupportSonicFocus30_SF3GUIType
GetRtkHDAudioGlobalPolicy_APOUseMaxx30
GetRtkHDAudioGlobalPolicy_APOUseMaxxVolumeSD
GetRtkHDAudioGlobalPolicy_HPAIOModel
GetRtkHDAudioGlobalPolicy_SonicFocusBeats
GetRtkHDAudioGlobalPolicy_SoundRoom
GetRtkHDAudioGlobalPolicy_SupDSpruce
InfGetMfgIDString
IsMediaCenterOS
IsServerOS
SetCDfmt
SetDSHWAcceleration_BasicLv
cm_GetOSInfo

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6b927e4cb6fc9da5a252c7dc1e52a674

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

62:ee:d6:d0:bf:e2:68:a0:24:68:d7:8e:80:9a:fb:63:98:e2:c5:25Signer

Headers

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 138KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 24KB - Virtual size: 23KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:22:2a:5d:cc:f7:16:df:5a:f9:c8:70:84:41:2d:d9
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

62:ee:d6:d0:bf:e2:68:a0:24:68:d7:8e:80:9a:fb:63:98:e2:c5:25
Signer

.text
Size: 140KB - Virtual size: 138KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 24KB - Virtual size: 23KB