204f84a157b5db68268f865a984e21b3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

204f84a157b5db68268f865a984e21b3_JaffaCakes118
Size

780KB
MD5

204f84a157b5db68268f865a984e21b3
SHA1

a23c1172fda902dc09db7ff4ed8b5a35e4bf6e6f
SHA256

ca463e8e4af94221092436703d0bcd593af359e1bc31cbe6980b11aeca108cda
SHA512

5705983e658d475245649c8471f4b9a8cc3fe3b006a35470d04014bcb73de20609b843218c7cf9e584410acb82a495ee10e06eb0f3ddcc759ccdc8f00381a92d
SSDEEP

24576:Yt7UklAxaHLE/DJflrWZJOnVtLeMyBR1fJ:0o6O/LeMWRVJ

Score

1^/10

Malware Config

Signatures

Files

204f84a157b5db68268f865a984e21b3_JaffaCakes118
.dll windows:6 windows x86 arch:x86

d60f686e0c469b5dc8d7217f844e757b

Code Sign

0a:fd:7d:7a:6e:74:35:6d:f0:bf:4d:1b:6e:2d:78:62
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06/03/2019, 00:00

Not After

05/03/2022, 23:59

Subject

CN=Fors Distribushn,O=Fors Distribushn,POSTALCODE=170100,STREET=Simeonovskaya st 41,L=Tver,ST=Tverskaya obl.,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:0f:d8:42:e2:0f:83:d3:70:1c:ba:1e:cb:a6:8d:fb:32:c7:78:9d
Signer

Actual PE Digest

65:0f:d8:42:e2:0f:83:d3:70:1c:ba:1e:cb:a6:8d:fb:32:c7:78:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\Projects\vServer\Release\vServer.pdb

Imports

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
CryptGenRandom
CryptAcquireContextA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext

ws2_32

recvfrom
accept
ntohl
sendto
getaddrinfo
GetAddrInfoW
ntohs
connect
send
recv
__WSAFDIsSet
WSACleanup
gethostname
select
WSASetLastError
WSAStartup
htonl
WSARecvFrom
bind
WSAIoctl
closesocket
WSASend
shutdown
listen
WSASocketW
getpeername
getsockname
socket
WSARecv
getsockopt
ioctlsocket
setsockopt
WSAGetLastError
htons
FreeAddrInfoW
freeaddrinfo

crypt32

CertFreeCertificateContext

wldap32

ord41
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord46
ord50
ord45
ord60
ord211
ord143

normaliz

IdnToAscii

kernel32

ExitProcess
IsValidLocale
GetUserDefaultLCID
SystemTimeToTzSpecificLocalTime
EnumSystemLocalesW
HeapFree
HeapAlloc
HeapReAlloc
GetDriveTypeW
GetFullPathNameW
GetModuleHandleExW
GetTimeZoneInformation
ExitThread
GetFileAttributesExW
GetConsoleCP
SetStdHandle
RaiseException
RtlUnwind
LoadLibraryW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
CreateTimerQueue
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
SetThreadPriority
CreateThread
SignalObjectAndWait
MultiByteToWideChar
GetLastError
WideCharToMultiByte
CancelIo
SetHandleInformation
RegisterWaitForSingleObject
UnregisterWait
PostQueuedCompletionStatus
CloseHandle
CreateEventA
CreateIoCompletionPort
SetFileCompletionNotificationModes
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
GetConsoleMode
GetFileType
LocalFree
FormatMessageA
DebugBreak
ReadFile
SetNamedPipeHandleState
SetLastError
EnterCriticalSection
GetCurrentProcess
WriteFile
CreateNamedPipeW
LeaveCriticalSection
FreeEnvironmentStringsW
PeekNamedPipe
WaitForSingleObject
CreateFileW
DuplicateHandle
QueueUserWorkItem
CancelSynchronousIo
GetNamedPipeHandleStateA
GetCurrentThread
CancelIoEx
SwitchToThread
DeleteCriticalSection
GetCurrentProcessId
ConnectNamedPipe
FlushFileBuffers
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
GetFileInformationByHandle
SetFilePointerEx
SetConsoleCtrlHandler
Sleep
SleepConditionVariableCS
TryEnterCriticalSection
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
ResumeThread
SetEvent
TlsAlloc
TlsGetValue
TlsFree
CreateSemaphoreA
GetLongPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
VerifyVersionInfoA
GetModuleFileNameW
SetEnvironmentVariableW
GetVersionExW
FileTimeToSystemTime
QueryPerformanceFrequency
VerSetConditionMask
QueryPerformanceCounter
GetModuleHandleA
LoadLibraryA
GetProcAddress
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
GetStdHandle
GetTickCount64
InitializeCriticalSectionEx
FreeLibrary
SleepEx
WaitForSingleObjectEx
GetSystemDirectoryA
ExpandEnvironmentStringsA
WaitForMultipleObjects
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
GetProcessHeap
SetEndOfFile
HeapSize
InitializeCriticalSection
CompareStringW
DecodePointer
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
CreateEventW
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer

user32

TranslateMessage
DispatchMessageA
MapVirtualKeyW
GetMessageA

Exports

Exports

getBuildTime
getVersion
setStatusListener
start
stop

Sections

.text
Size: 601KB - Virtual size: 600KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d60f686e0c469b5dc8d7217f844e757b

Code Sign

0a:fd:7d:7a:6e:74:35:6d:f0:bf:4d:1b:6e:2d:78:62Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

65:0f:d8:42:e2:0f:83:d3:70:1c:ba:1e:cb:a6:8d:fb:32:c7:78:9dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

crypt32

wldap32

normaliz

kernel32

user32

Exports

Exports

Sections

.text Size: 601KB - Virtual size: 600KB

.rdata Size: 134KB - Virtual size: 134KB

.data Size: 9KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 30KB - Virtual size: 29KB

0a:fd:7d:7a:6e:74:35:6d:f0:bf:4d:1b:6e:2d:78:62
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

65:0f:d8:42:e2:0f:83:d3:70:1c:ba:1e:cb:a6:8d:fb:32:c7:78:9d
Signer

.text
Size: 601KB - Virtual size: 600KB

.rdata
Size: 134KB - Virtual size: 134KB

.data
Size: 9KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 30KB - Virtual size: 29KB