17f140dab54e529ffcb6f12667e5e219_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

17f140dab54e529ffcb6f12667e5e219_JaffaCakes118
Size

83KB
MD5

17f140dab54e529ffcb6f12667e5e219
SHA1

139ac37078893818f0a7083658544bef8f1f2beb
SHA256

a76b952b0f6a7fbd43f35d1d47f74b854b706bd7ead4db830e516394a4bc65ad
SHA512

02146bf3eee52f38d6247f021114e2884d0ea820e0c8dd7ed467a7aff46375bd9b31f8d493e3fc18e8fbc4af2a95412a43437b573c92bccccdb30923ff74463f
SSDEEP

1536:cRtGf+UmC/7ESZQDdqw6T6CanUhGPghCCxYPGRo3i+fER+D4BWHMJ7GRoD69kTqD:qtGf+UmC/AddS6CanUhGPghCCxYPGRoF

Score

1^/10

Malware Config

Signatures

Files

17f140dab54e529ffcb6f12667e5e219_JaffaCakes118
.dll windows:5 windows x86 arch:x86

06bd270461e2c9faa7c7a9ad3007f845

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2016, 09:16

Not After

21/07/2019, 08:09

Subject

CN=深圳市为爱普信息技术有限公司,OU=IT Dept.,O=深圳市为爱普信息技术有限公司,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:98:1a:86:80:b4:9d:aa:1b:61:d3:a9:2d:63:b0:24:e7:cb:c6:c2
Signer

Actual PE Digest

b9:98:1a:86:80:b4:9d:aa:1b:61:d3:a9:2d:63:b0:24:e7:cb:c6:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\SVN\idm_2010\Release\idm_jb.pdb

Imports

kernel32

Sleep
GetExitCodeProcess
MultiByteToWideChar
GetLastError
GetProcAddress
FindClose
GetLocalTime
Process32Next
RemoveDirectoryW
GetModuleHandleA
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
CopyFileW
WideCharToMultiByte
InitializeCriticalSection
WaitForSingleObject
Process32First
FindFirstFileW
DeleteFileW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
DecodePointer
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
EncodePointer

advapi32

CryptAcquireContextA
OpenSCManagerA
QueryServiceStatus
ChangeServiceConfigA
StartServiceA
CloseServiceHandle
OpenServiceA
CryptGenRandom
CryptReleaseContext

shell32

ShellExecuteExW
SHGetSpecialFolderPathW

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

ws2_32

send
connect
select
htons
setsockopt
recv
gethostbyname
socket
closesocket

shlwapi

PathFileExistsW

libplist2

plist_new_dict
plist_get_data_val
plist_new_bool
plist_new_array
plist_array_append_item
plist_new_uint
plist_copy
plist_new_string
plist_dict_get_item
plist_new_data
plist_dict_set_item
plist_get_string_val
plist_get_node_type
plist_free
plist_get_uint_val
plist_get_bool_val
plist_from_xml
plist_to_xml
plist_from_bin

libcrypto-1_1

X509_set1_notBefore
X509_set1_notAfter
PEM_read_bio_RSAPublicKey
ASN1_INTEGER_free
X509_set_serialNumber
BIO_s_mem
EVP_PKEY_free
SHA1_Update
ASN1_INTEGER_new
SHA1_Final
ASN1_TIME_new
X509_set_version
BIO_ctrl
EVP_PKEY_new
BN_new
ASN1_TIME_free
X509_set_pubkey
X509_new
X509_sign
ASN1_TIME_set
PEM_write_bio_X509
X509_add_ext
ASN1_INTEGER_set
BN_set_word
X509_EXTENSION_free
SHA1_Init
RSA_new
PEM_write_bio_PrivateKey
X509V3_EXT_cleanup
X509V3_set_ctx
EVP_PKEY_assign
RSA_generate_key_ex
X509V3_EXT_conf_nid
EVP_sha1
BN_free
X509_free
BIO_new
PEM_read_bio_RSAPrivateKey
BIO_new_mem_buf
BIO_int_ctrl
PEM_read_bio_X509
RSA_free
BIO_free
BIO_s_socket

libssl-1_1

TLSv1_method
SSL_get_error
SSL_do_handshake
SSL_CTX_use_certificate
SSL_set_bio
SSL_CTX_use_RSAPrivateKey
SSL_set_verify
SSL_set_connect_state
SSL_read
SSL_CTX_free
SSL_free
SSL_write
SSL_CTX_new
SSL_get_current_cipher
SSL_shutdown
SSL_new
SSL_CIPHER_get_name

idm_813

cancel_proxy_813
set_proxy_813
jb83
init_dll_813

idm_jb6

jb6
init_dll_jb6

idm_jb71x

init_dll_jb71x
jb71x

idm_jb8x

jb8x
init_dll_jb8x

idm_jb90

init_dll_jb90
jb90

msvcr100

_CxxThrowException
memcpy
memset
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
_wcsdup
fseek
ftell
fwrite
vsprintf_s
strtol
rewind
_snwprintf
_mbsicmp
_stricmp
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
__iob_func
perror
_time64
_errno
strerror
fclose
_strdup
fread
_snprintf
_wfopen
malloc
free
strncmp
__CxxFrameHandler3

idm_lang

translation
set_lang

idm_backup

ios_backup_and_restore

Exports

Exports

cancel_proxy_jb
init_dll_jb
ios_jailbreak
ios_jailbreak_check
ios_jailbreak_clear
ios_jailbreak_print_info
set_proxy_jb

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06bd270461e2c9faa7c7a9ad3007f845

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5Certificate

Extended Key Usages

Key Usages

b9:98:1a:86:80:b4:9d:aa:1b:61:d3:a9:2d:63:b0:24:e7:cb:c6:c2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

msvcp100

ws2_32

shlwapi

libplist2

libcrypto-1_1

libssl-1_1

idm_813

idm_jb6

idm_jb71x

idm_jb8x

idm_jb90

msvcr100

idm_lang

idm_backup

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

b9:98:1a:86:80:b4:9d:aa:1b:61:d3:a9:2d:63:b0:24:e7:cb:c6:c2
Signer

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB