1d76b6d6a60bba38f6e7aed3775e6fd1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1d76b6d6a60bba38f6e7aed3775e6fd1_JaffaCakes118
Size 12.4MB
Sample240506-vevr1adh87
SHA256 91593a1ed6d8e1a262271ad1f02286121af76f258fd03c9a715be240ff706bc7
MD5 1d76b6d6a60bba38f6e7aed3775e6fd1
SHA1 8ce406a2b3a005dcf96aa5149b3253c5847be785
SHA512 ada50b03018daabead0725dde573779943cdd7b27d175d247d36275078e8db8207f421f35b4222aba061fe79c3ec033e198c1ab3af8927eb3d69e7ee67a5a5bd
SSDEEP 393216:JqOxgY8ITxRq3+X67Uiwx2cLDmjwIXB7dw/A:QO+GNRli8XLDmrXA/A
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1d76b6d6a60bba38f6e7aed3775e6fd1_JaffaCakes118

.exe 12.4MB

1d76b6d6a60bba38f6e7aed3775e6fd1_JaffaCakes118

IMPHASH e3bf5067062c50d685880004d529c5b5
SHA256 91593a1ed6d8e1a262271ad1f02286121af76f258fd03c9a715be240ff706bc7
MD5 1d76b6d6a60bba38f6e7aed3775e6fd1
SHA1 8ce406a2b3a005dcf96aa5149b3253c5847be785
SHA512 ada50b03018daabead0725dde573779943cdd7b27d175d247d36275078e8db8207f421f35b4222aba061fe79c3ec033e198c1ab3af8927eb3d69e7ee67a5a5bd
SSDEEP 393216:JqOxgY8ITxRq3+X67Uiwx2cLDmjwIXB7dw/A:QO+GNRli8XLDmrXA/A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

73:94:c5:d5:8f:e5:45:19:72:6a:d5:73:25:f9:a8:02:0a:d8:40:04:65:a1:2b:c8:f0:ab:eb:32:b7:2b:41:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Chains

Mar 18, 2020

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

4b:20:58:c4:ab:6f:98:58:09:59:04:6b:47:9e:63:1b:df:d4:2b:02

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Chains

Mar 18, 2020

Subject

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Serial Number

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 23, 2019 - Sep 22, 2020

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Serial Number

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 19, 2019 - Sep 22, 2020

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

535216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

connect ntohs setsockopt htonl ioctlsocket getpeername getsockopt closesocket htons gethostname listen accept sendto recvfrom socket ntohl getsockname bind send freeaddrinfo getaddrinfo WSACleanup WSAStartup recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSAIoctl

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

lstrcpynW CreateMutexW GetLastError SetLastError InitializeCriticalSectionAndSpinCount FreeLibrary GetProcAddress ResetEvent SetEvent WaitForMultipleObjects LoadLibraryW CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus TlsFree LoadLibraryExW GetTickCount TerminateProcess TlsGetValue TlsAlloc TlsSetValue GetModuleHandleExW CreateMutexA Sleep CloseHandle ExitProcess CreateDirectoryW ReadFile GetFileTime GetVolumeInformationW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetWindowsDirectoryW GetSystemDirectoryW GetCurrentProcess WriteFile RemoveDirectoryW GetNativeSystemInfo GetVersionExW CreateThread RaiseException IsDebuggerPresent Process32FirstW Process32NextW CreateToolhelp32Snapshot GetProcessId GetCurrentThreadId QueryPerformanceCounter GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime GetModuleHandleW GetThreadPriority QueryPerformanceFrequency GetCurrentThread FileTimeToSystemTime SetThreadPriority FindClose FindNextFileW FindFirstFileExW FindFirstFileW FlushFileBuffers GetSystemInfo SetFilePointerEx SetEndOfFile GetFileSizeEx CreateEventW GetModuleHandleA ExpandEnvironmentStringsW ResumeThread CreatePipe AssignProcessToJobObject GetStdHandle GetExitCodeProcess OpenProcess DuplicateHandle WaitForSingleObject GetDiskFreeSpaceExW FormatMessageA GetCurrentProcessId LoadLibraryExA SizeofResource HeapFree HeapSize GetSystemDirectoryA LockResource HeapReAlloc FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy VerSetConditionMask GetProcessHeap VerifyVersionInfoW GetSystemWow64DirectoryW GetLocalTime GetModuleFileNameA GetComputerNameExA SetFilePointer lstrcpynA EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead SleepEx WaitForSingleObjectEx ExpandEnvironmentStringsA GetFileType PeekNamedPipe HeapCreate InitializeCriticalSection FlushInstructionCache MulDiv GetFullPathNameW FreeResource GetVersionExA IsBadReadPtr LoadLibraryA GlobalAlloc GlobalLock GlobalUnlock DosDateTimeToFileTime lstrcpyA lstrcpyW lstrlenA TerminateThread WriteConsoleW GetTempPathW SetThreadAffinityMask DeviceIoControl CreateFileA GetComputerNameW OutputDebugStringW RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode ExitThread FreeLibraryAndExitThread GetACP GetDriveTypeW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetEnvironmentVariableW GetModuleFileNameW OutputDebugStringA LocalFree GetCommandLineW WideCharToMultiByte MultiByteToWideChar CopyFileW MoveFileExW SetCurrentDirectoryW GetCurrentDirectoryW DeleteFileW GetFileAttributesExW SetFileAttributesW GetFileAttributesW CreateFileW

user32

IsWindowEnabled CreatePopupMenu DestroyMenu GetMenuItemCount AppendMenuW TrackPopupMenu GetMenuInfo SetMenuInfo GetMenuItemInfoW SetForegroundWindow SetMenuContextHelpId FillRect InvertRect DrawIconEx OemToCharBuffW CreateIconIndirect WindowFromPoint CharUpperA GetIconInfo CharNextW OffsetRect DestroyIcon GetClassNameW ScreenToClient SetCaretPos HideCaret GetCaretBlinkTime CreateCaret GetCursorPos SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow ReleaseCapture SetCapture GetCapture IsZoomed IsIconic SetLayeredWindowAttributes TrackMouseEvent IsMenu EqualRect IsRectEmpty UnionRect IntersectRect InflateRect CopyRect SetRect SetCursor GetKeyState GetFocus SetFocus IsWindow DestroyCursor GetMonitorInfoW MonitorFromWindow LoadCursorW GetWindow GetParent MapWindowPoints GetWindowRect GetClientRect GetDlgItem CallWindowProcW GetWindowThreadProcessId CharLowerBuffW wsprintfA SystemParametersInfoW SetWindowLongW ShowWindow SetWindowPos DestroyWindow PostMessageW GetWindowLongW SystemParametersInfoA DrawTextW IsWindowVisible wsprintfW EnableMenuItem SendMessageW MessageBoxW GetActiveWindow PostQuitMessage KillTimer TranslateMessage GetQueueStatus CallMsgFilterW MsgWaitForMultipleObjectsEx PeekMessageW SetTimer DispatchMessageW RegisterClassExW WaitMessage UnregisterClassW GetSystemMetrics GetMessageW LoadImageW CreateIconFromResource LoadBitmapW GetSysColor CreateWindowExW DefWindowProcW ClientToScreen PtInRect

advapi32

CloseServiceHandle CreateProcessAsUserW RegQueryInfoKeyW SystemFunction036 EnumServicesStatusW RegOpenCurrentUser SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertSidToStringSidA LookupAccountNameW CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextW CreateServiceW QueryServiceStatus OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW QueryServiceConfig2W OpenServiceW GetAclInformation GetAce EqualSid SetNamedSecurityInfoW CopySid GetNamedSecurityInfoW IsValidSid AddAce InitializeAcl GetLengthSid OpenThreadToken GetUserNameA GetUserNameW AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership GetTokenInformation

ole32

CoInitializeEx CoTaskMemFree StringFromGUID2 PropVariantClear CoInitializeSecurity CoSetProxyBlanket CoCreateGuid StringFromCLSID CreateStreamOnHGlobal CoCreateInstance CoUninitialize

shlwapi

PathAppendW ord176 SHStrDupW PathFileExistsA StrToIntExW StrIsIntlEqualW PathFileExistsW PathCombineW StrCmpIW

userenv

DestroyEnvironmentBlock UnloadUserProfile CreateEnvironmentBlock

winmm

timeBeginPeriod timeGetTime timeEndPeriod

imm32

ImmAssociateContext ImmReleaseContext ImmGetContext

msimg32

GradientFill AlphaBlend

gdiplus

GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipGraphicsClear GdipDrawImageRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipGetImageHeight GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth

iphlpapi

GetAdaptersInfo

gdi32

SetTextColor SetROP2 SetRectRgn ExtSelectClipRgn SaveDC RoundRect RestoreDC RectInRegion PtInRegion Pie OffsetRgn IntersectClipRect GetTextExtentPoint32W GetTextColor GetRgnBox GetClipRgn ExcludeClipRect Ellipse CreateRectRgnIndirect CreateRectRgn CreatePatternBrush CreatePen CreateEllipticRgnIndirect GetWorldTransform Arc GetViewportOrgEx BitBlt GetCurrentObject SetViewportOrgEx CreateCompatibleBitmap StretchBlt GetObjectW SetBkMode Rectangle GetStockObject GetClipBox CreateSolidBrush CreateFontIndirectW SelectObject DeleteDC CreateCompatibleDC CreateBitmap EnumFontsW SetGraphicsMode GetDeviceCaps CreateRoundRectRgn DeleteObject SetWorldTransform CreateDIBSection ExtCreatePen Polyline CreateDIBitmap CreateDCW CombineRgn StretchDIBits

oleaut32

SysFreeString SysAllocString VariantClear

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

285KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.ress

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1d76b6d6a60bba38f6e7aed3775e6fd1_JaffaCakes118

PE Signature issue

ws2_32

version

kernel32

user32

advapi32

ole32

shlwapi

userenv

winmm

imm32

msimg32

gdiplus

iphlpapi

gdi32

oleaut32

crypt32

generic