0aa6c0811297eb7864755403448bd9aa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0aa6c0811297eb7864755403448bd9aa_JaffaCakes118
Size

581KB
MD5

0aa6c0811297eb7864755403448bd9aa
SHA1

1dac9f2e0729008168db89eabec0eaf738db9535
SHA256

090c9879d4f3c8673143e62ab54ac4740158beb836ceddd5b996176da8d20a38
SHA512

79eb9904ee7e0c02a8003cea8b54b1d5c9d738c5390d95d60ebd7bfbfadef5e112c6e0e77a2366b02a7abbb1e580b90a2388364b2c5a64a60b8f5760b51209e1
SSDEEP

6144:I2Yo3SLHLOi4zS1xUC04v8gTRxpOj0nnSP68kU40tYQCQdlkmcJEDbWojIlrWhTa:wuF1C04v8wR460tjCShWcSZtegt

Score

1^/10

Malware Config

Signatures

Files

0aa6c0811297eb7864755403448bd9aa_JaffaCakes118
.exe windows:5 windows x64 arch:x64

7afcc472d8a67eaead1b1bc515863e42

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/03/2016, 00:00

Not After

26/08/2017, 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/01/2016, 00:00

Not After

23/08/2017, 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:c0:74:2f:a4:9c:cc:72:0b:2e:bb:7a:c3:51:52:a7:e3:cf:85:3b:e6:17:4f:1f:f9:bc:66:b0:49:11:48:26
Signer

Actual PE Digest

10:c0:74:2f:a4:9c:cc:72:0b:2e:bb:7a:c3:51:52:a7:e3:cf:85:3b:e6:17:4f:1f:f9:bc:66:b0:49:11:48:26

Digest Algorithm

sha256

PE Digest Matches

true

07:4a:d0:2f:63:50:86:ee:4a:39:d3:96:29:2c:cc:b3:0e:94:8c:7a
Signer

Actual PE Digest

07:4a:d0:2f:63:50:86:ee:4a:39:d3:96:29:2c:cc:b3:0e:94:8c:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FindResourceExW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
GetLastError
CloseHandle
HeapFree
LocalAlloc
HeapAlloc
GetProcessHeap
LocalFree
GetCurrentProcess
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleW
GetVersionExW
VirtualFreeEx
LoadLibraryW
WriteProcessMemory
VirtualAllocEx
lstrlenW
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
lstrlenA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
FlushInstructionCache
FindNextFileW
FindClose
Sleep
OutputDebugStringW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCurrentThreadId
lstrcmpiW
SuspendThread
lstrcpyW
SetLastError
CreateProcessW
GetStartupInfoW
ReadFile
GetFileSizeEx
CreateFileA
DeviceIoControl
CreateFileW
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
ExpandEnvironmentStringsW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
MoveFileExW
MoveFileW
GetTickCount
DeleteFileW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDrives
GetExitCodeThread
CreateThread
FindResourceW
GlobalMemoryStatusEx
GetSystemDirectoryW
GetWindowsDirectoryW
GetFullPathNameW
GetTempFileNameW
WriteFile
WaitNamedPipeW
DeleteFileA
MoveFileA
CopyFileW
GetLocalTime
SetEvent
OpenEventW
CreateEventW
lstrcpyA
RemoveDirectoryW
GetComputerNameW
OpenMutexW
GetCommandLineW
GetCurrentProcessId
HeapReAlloc
HeapDestroy
LoadLibraryA
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
GetCurrentDirectoryW
WriteConsoleW
FlushFileBuffers
SetStdHandle
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetStringTypeW
InterlockedPushEntrySList
ExitProcess
HeapCreate
GetVersion
HeapSetInformation
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
GetFileType
SetHandleCount
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
RtlLookupFunctionEntry
RtlUnwindEx
DecodePointer
EncodePointer
RtlPcToFileHeader
GetLocaleInfoW
GetStdHandle
FlsAlloc
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
LoadResource
LockResource
SizeofResource
FindFirstFileW
RaiseException
FlsFree
FlsSetValue
FlsGetValue
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExitThread
HeapSize

user32

PeekMessageW
CharNextW
DefWindowProcW
RegisterClassExW
SetWindowLongPtrW
CreateWindowExW
GetMessageW
DestroyWindow
wsprintfW
GetSystemMetrics
RegisterWindowMessageW
IsWindow
FindWindowW
TranslateMessage
DispatchMessageW
CallWindowProcW
PostThreadMessageW
GetWindowThreadProcessId
UnregisterClassA
MessageBoxW
GetClassInfoExW
LoadCursorW
GetWindowLongPtrW

shell32

ShellExecuteExW
CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitialize
CoTaskMemRealloc
CoInitializeSecurity
CoTaskMemFree
CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

oleaut32

VarUI4FromStr
VariantClear
VariantInit
SysAllocString
VariantTimeToSystemTime
SysFreeString
SystemTimeToVariantTime

shlwapi

PathFileExistsA
PathFileExistsW
PathAppendW

mprapi

MprConfigServerConnect
MprConfigGetFriendlyName

iphlpapi

GetInterfaceInfo
GetNetworkParams
GetAdaptersInfo
GetPerAdapterInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetReadFile
InternetOpenW
InternetSetOptionW
InternetOpenUrlW
InternetCloseHandle
InternetCheckConnectionW
HttpQueryInfoW

urlmon

URLDownloadToFileW

Sections

.text
Size: 405KB - Virtual size: 405KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7afcc472d8a67eaead1b1bc515863e42

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1fCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

10:c0:74:2f:a4:9c:cc:72:0b:2e:bb:7a:c3:51:52:a7:e3:cf:85:3b:e6:17:4f:1f:f9:bc:66:b0:49:11:48:26Signer

07:4a:d0:2f:63:50:86:ee:4a:39:d3:96:29:2c:cc:b3:0e:94:8c:7aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

shlwapi

mprapi

iphlpapi

version

wininet

urlmon

Sections

.text Size: 405KB - Virtual size: 405KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 10KB - Virtual size: 21KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 41KB - Virtual size: 40KB

.reloc Size: 3KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

10:c0:74:2f:a4:9c:cc:72:0b:2e:bb:7a:c3:51:52:a7:e3:cf:85:3b:e6:17:4f:1f:f9:bc:66:b0:49:11:48:26
Signer

07:4a:d0:2f:63:50:86:ee:4a:39:d3:96:29:2c:cc:b3:0e:94:8c:7a
Signer

.text
Size: 405KB - Virtual size: 405KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 10KB - Virtual size: 21KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 41KB - Virtual size: 40KB

.reloc
Size: 3KB - Virtual size: 3KB