09a2bdec9fe5beb38d79a52b867329cf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

09a2bdec9fe5beb38d79a52b867329cf_JaffaCakes118
Size

5.1MB
MD5

09a2bdec9fe5beb38d79a52b867329cf
SHA1

8a1d89355f9809f6f17905b5af9fa4ad332b29b0
SHA256

f5c32615e10d47a3ee805bcc51d8f999008c72d854291df4d6f4efa1adbcab9e
SHA512

a90d5c2d1fcdba55ad6e9e81403aab78e21bdb187ca2fa9eb53a968e19a0667c5ed305cee52c9024b7eb9e4d3f8666af33b3e75fc87c1540a83018182dd9c81d
SSDEEP

98304:f4XgYT2J+qKzazV+CeSrypLBrtrlypYNGvITuCCqMJIenQdgd5A:f4Xb5qKEO5yqGvIKycQ2dK

Score

1^/10

Malware Config

Signatures

Files

09a2bdec9fe5beb38d79a52b867329cf_JaffaCakes118
.zip
Gamestart.exe
.exe windows:4 windows x86 arch:x86

a9b3d89f6baedf5babb70a8b8cfd7187

Code Sign

32:45:34:37:27:85:dc:65:97:c2:1d:1e:e4:76:1e:86
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

01/02/2016, 03:08

Not After

01/05/2019, 03:08

Subject

CN=南京凡游网络技术有限公司,O=南京凡游网络技术有限公司,L=南京市,ST=江苏省,C=CN,1.2.840.113549.1.9.1=#0c0f7a686f7579406b756169382e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:e9:3f:fd:7b:96:f9:44:ab:92:e4:15:3b:f2:29:12:f3:5d:86:ff
Signer

Actual PE Digest

73:e9:3f:fd:7b:96:f9:44:ab:92:e4:15:3b:f2:29:12:f3:5d:86:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svn\APPS\GMSetupPacker\Build\bin\release_static\GMUnPacker.pdb

Imports

wininet

InternetSetOptionW
InternetReadFile
InternetOpenW
HttpQueryInfoW
InternetOpenUrlW
InternetCloseHandle

ws2_32

send
gethostbyname
connect
inet_ntoa
WSAStartup
inet_addr
htons
setsockopt
recv
socket
closesocket

msimg32

AlphaBlend

comctl32

_TrackMouseEvent

riched20

ord4

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

FindFirstFileW
CreateProcessW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MoveFileW
MoveFileExW
SetLastError
lstrlenW
CreateDirectoryW
DeleteFileW
GetDriveTypeW
RemoveDirectoryW
GetCurrentThreadId
ResumeThread
SetFilePointer
SetEndOfFile
SetFileTime
GetFileTime
GetFileSize
ReadFile
CreateFileW
LoadLibraryW
FreeLibrary
LocalFree
GetProcAddress
LoadLibraryExW
CreateEventW
HeapFree
FreeResource
TerminateProcess
FindResourceW
LockResource
LoadResource
HeapAlloc
ExpandEnvironmentStringsW
GetProcessHeap
SizeofResource
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetExitCodeProcess
SuspendThread
GetTempFileNameW
GetSystemDirectoryW
DeviceIoControl
GetTempPathW
OutputDebugStringW
GetCurrentDirectoryW
GetFullPathNameW
GetLongPathNameW
SetCurrentDirectoryW
FindClose
GetVolumeInformationW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
GetSystemInfo
InterlockedDecrement
lstrcpyW
lstrcmpiW
GetVersionExW
SetPriorityClass
QueryPerformanceCounter
ReleaseSemaphore
CreateSemaphoreW
MulDiv
InterlockedIncrement
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetSystemTimeAsFileTime
OutputDebugStringA
GetModuleHandleA
LocalAlloc
CreateProcessA
lstrcmpW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
FindNextFileW
GetFileAttributesW
SetFileAttributesW
ResetEvent
SetEvent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FormatMessageW
GetTickCount
GetLastError
GetModuleHandleW
CloseHandle
GetPrivateProfileIntW
lstrlenA
WritePrivateProfileStringW
CopyFileW
GetModuleFileNameA
CreateFileA
lstrcatA
WaitForSingleObject
lstrcpyA
RtlUnwind
GetModuleFileNameW
GetCommandLineW
WriteFile
GetTempPathA
Sleep
GetPrivateProfileStringW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetCPInfo
LCMapStringW
LCMapStringA
RaiseException
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetStartupInfoW
ExitThread
CreateThread
HeapReAlloc
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetCurrentProcessId
VirtualAlloc
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetThreadLocale

user32

DefWindowProcW
LoadImageW
EndPaint
GetMessageW
MonitorFromWindow
DispatchMessageW
DestroyWindow
TrackPopupMenu
GetCursorPos
SetCapture
SetFocus
ShowCaret
TranslateAcceleratorW
InvalidateRect
UpdateLayeredWindow
SetWindowRgn
BeginPaint
PtInRect
GetKeyState
CreateCaret
HideCaret
IsWindow
ScreenToClient
CreateWindowExW
GetFocus
GetMonitorInfoW
ReleaseCapture
GetUpdateRect
GetDC
IsWindowEnabled
ReleaseDC
ClientToScreen
SendMessageW
LoadStringW
GetActiveWindow
GetWindowRect
GetWindowThreadProcessId
IsRectEmpty
CallWindowProcW
IsZoomed
GetWindowTextW
SystemParametersInfoW
GetForegroundWindow
SetForegroundWindow
GetClientRect
GetParent
AttachThreadInput
GetWindowTextLengthW
IsChild
ShowWindow
RegisterClassW
GetPropW
RegisterClassExW
LoadCursorW
SetPropW
DestroyIcon
GetClassInfoExW
EnableWindow
SetTimer
SetWindowTextW
PostQuitMessage
IsIconic
PostMessageW
KillTimer
wsprintfA
MessageBoxW
GetSystemMetrics
IsWindowVisible
SetWindowLongW
SetWindowPos
GetWindowLongW
GetSysColor
SetMenuItemInfoW
SetCursor
LoadMenuW
GetSubMenu
GetClassNameW
CreateAcceleratorTableW
DestroyAcceleratorTable
InvalidateRgn
TrackMouseEvent
ChildWindowFromPointEx
GetAsyncKeyState
FillRect
CharPrevW
DrawTextW
DrawIconEx
CopyImage
RedrawWindow
CharNextA
GetWindow
LoadBitmapW
IntersectRect
DrawFocusRect
MapWindowPoints
CharNextW
MoveWindow
OffsetRect
SetCaretPos
TranslateMessage

gdi32

GetBitmapBits
ExtTextOutW
GetClipBox
GetClipRgn
SetBitmapBits
CreateSolidBrush
RoundRect
ExtSelectClipRgn
TextOutW
SetBkMode
GetTextExtentPoint32W
StretchBlt
SelectClipRgn
SetBkColor
GetCharABCWidthsW
SetStretchBltMode
GetDeviceCaps
SetTextColor
CreateFontIndirectW
CreateEllipticRgn
GetTextMetricsW
CreateCompatibleDC
MoveToEx
CreateRectRgnIndirect
GetStockObject
LineTo
BitBlt
CombineRgn
GetObjectW
Rectangle
CreateRoundRectRgn
EnumFontsW
CreateRectRgn
DeleteObject
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateDIBSection
CreatePen

advapi32

FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW

shell32

ShellExecuteExW
ShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteA
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoInitializeSecurity
CoSetProxyBlanket
CLSIDFromProgID
CLSIDFromString
DoDragDrop
CreateStreamOnHGlobal
OleLockRunning
RevokeDragDrop
OleDuplicateData
ReleaseStgMedium

oleaut32

OleLoadPicture
VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

PathGetArgsW
StrRetToStrW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Readme.txt
config.xml
ħ ޵а.data

Sharing

General

Malware Config

Signatures

Files

a9b3d89f6baedf5babb70a8b8cfd7187

Code Sign

32:45:34:37:27:85:dc:65:97:c2:1d:1e:e4:76:1e:86Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

73:e9:3f:fd:7b:96:f9:44:ab:92:e4:15:3b:f2:29:12:f3:5d:86:ffSigner

Headers

File Characteristics

PDB Paths

Imports

wininet

ws2_32

msimg32

comctl32

riched20

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 216KB - Virtual size: 213KB

.data Size: 24KB - Virtual size: 37KB

.tls Size: 4KB - Virtual size: 9B

.rsrc Size: 252KB - Virtual size: 251KB

32:45:34:37:27:85:dc:65:97:c2:1d:1e:e4:76:1e:86
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

73:e9:3f:fd:7b:96:f9:44:ab:92:e4:15:3b:f2:29:12:f3:5d:86:ff
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 216KB - Virtual size: 213KB

.data
Size: 24KB - Virtual size: 37KB

.tls
Size: 4KB - Virtual size: 9B

.rsrc
Size: 252KB - Virtual size: 251KB