privateloader | 2e448c667bcf8ad88fe4348710d16538_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
2e448c667bcf8ad88fe4348710d16538_JaffaCakes118
Size 16.9MB
Sample240510-kkpstsgd63
SHA256 4d3341852934062b81cc8c0f6c3b1b0c76594998b1ef74a31caf79382790c1eb
MD5 2e448c667bcf8ad88fe4348710d16538
SHA1 8064fbca3b789366511fb3c87a9582e43b349e88
SHA512 e24360da0a24d0ef56d67a1601d1909e925e2b9c519be08fecf535db3ea14ecd8441596991f02b953858d6c2525fa900ed34f9bd44bac308212346101cf584d4
SSDEEP 393216:K8xSu0uH36+PrS4jCJ3VZrueimktEN/2ZMxf7pcZ3vTYk7+uwAIAEK6:KCSFuXdrSWCJ33r0mktk7AH7+dAIpK6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

File Explorer

2e448c667bcf8ad88fe4348710d16538_JaffaCakes118

.exe 16.9MB

2e448c667bcf8ad88fe4348710d16538_JaffaCakes118

IMPHASH f3880ccde6c67f917b53b2e5efc13d61
SHA256 4d3341852934062b81cc8c0f6c3b1b0c76594998b1ef74a31caf79382790c1eb
MD5 2e448c667bcf8ad88fe4348710d16538
SHA1 8064fbca3b789366511fb3c87a9582e43b349e88
SHA512 e24360da0a24d0ef56d67a1601d1909e925e2b9c519be08fecf535db3ea14ecd8441596991f02b953858d6c2525fa900ed34f9bd44bac308212346101cf584d4
SSDEEP 393216:K8xSu0uH36+PrS4jCJ3VZrueimktEN/2ZMxf7pcZ3vTYk7+uwAIAEK6:KCSFuXdrSWCJ33r0mktk7AH7+dAIpK6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

92:cf:36:2f:e8:55:e4:ba:88:ae:69:2b:b0:f0:50:2d:5c:e7:e9:61:86:ee:ee:58:9d:59:ed:44:3c:93:2b:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Arcsin Inc.,O=Arcsin Inc.,L=Shibuya,ST=Tokyo,C=JP

Chains

Aug 2, 2019

CN=Arcsin Inc.,O=Arcsin Inc.,L=Shibuya,ST=Tokyo,C=JP

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Digest

74:42:5a:59:3a:04:74:14:99:7e:e5:57:2c:2f:e3:8b:09:61:c2:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Arcsin Inc.,O=Arcsin Inc.,L=Shibuya,ST=Tokyo,C=JP

Chains

Aug 2, 2019

CN=Arcsin Inc.,O=Arcsin Inc.,L=Shibuya,ST=Tokyo,C=JP

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Arcsin Inc.,O=Arcsin Inc.,L=Shibuya,ST=Tokyo,C=JP

Serial Number

2d:0c:64:04:98:93:2e:ae:29:a4:6e:e4

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 31, 2019 - Jul 20, 2020

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=Arcsin Inc.,O=Arcsin Inc.,L=Shibuya,ST=Tokyo,C=JP

Serial Number

2d:0c:64:04:98:93:2e:ae:29:a4:6e:e4

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 31, 2019 - Jul 20, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

360682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\CodeBases\isdev\redist\Language Independent\i386\setupPreReq.pdb

comctl32

ord17

kernel32

MoveFileW LocalFree FormatMessageW GetSystemInfo MulDiv RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadLibraryExW GetVersion GetLocalTime GetFileAttributesW GetCurrentDirectoryW FileTimeToLocalFileTime GetFileTime GetSystemDefaultUILanguage GlobalAlloc GlobalFree FlushFileBuffers VirtualQuery IsBadReadPtr GetDiskFreeSpaceExW GetDriveTypeW GetCurrentThread InterlockedExchange LoadLibraryExA GetModuleHandleW GetProcAddress GetSystemDirectoryA LoadLibraryA GetLastError SetLastError GetPrivateProfileStringW GetFileSize CloseHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile lstrlenA MultiByteToWideChar WideCharToMultiByte ReadFile SetFilePointer WriteFile HeapAlloc GetSystemTimeAsFileTime SetFileAttributesW FindNextFileW FindFirstFileW FindClose CreateDirectoryW CompareFileTime VerLanguageNameW GetUserDefaultLangID GetSystemDefaultLangID lstrcmpiW lstrcmpW IsValidLocale GetLocaleInfoW lstrcpyA ExitThread GetExitCodeProcess GetCommandLineW LoadLibraryW FreeLibrary FreeResource lstrcmpA SystemTimeToFileTime ResetEvent SetEvent FindResourceExW SetFileTime OpenProcess GetProcessTimes ReadConsoleW WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode CompareStringA CompareStringW lstrcatW GetVersionExW InterlockedDecrement InterlockedIncrement CreateEventW QueryPerformanceFrequency GetTempFileNameW CopyFileW GetTickCount GetExitCodeThread CreateThread FindResourceW GlobalUnlock GlobalLock SizeofResource LockResource LoadResource lstrcpyW SetErrorMode GetTempPathW ExpandEnvironmentStringsW CreateFileW MoveFileExW WriteProcessMemory VirtualProtectEx GetWindowsDirectoryW GetSystemDirectoryW FlushInstructionCache SetThreadContext GetThreadContext CreateProcessW ResumeThread TerminateProcess ExitProcess GetCurrentProcess Sleep WaitForSingleObject DuplicateHandle RemoveDirectoryW DeleteFileW SetCurrentDirectoryW lstrlenW lstrcpynW GetModuleFileNameW GetProcessHeap HeapFree GetConsoleCP GetTimeFormatW GetDateFormatW OutputDebugStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetFileType HeapReAlloc GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCurrentThreadId HeapSize GetModuleHandleExW GetStdHandle GetFullPathNameW IsProcessorFeaturePresent IsDebuggerPresent RtlUnwind LCMapStringW DecodePointer EncodePointer

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW SetTimer KillTimer LoadCursorW LoadIconW wsprintfW PeekMessageW MsgWaitForMultipleObjects GetDesktopWindow ShowWindow DialogBoxIndirectParamW EndDialog GetDlgItem SetWindowTextW SetWindowPos CharPrevW wvsprintfW LoadImageW CreateDialogParamW MoveWindow GetParent GetWindowTextW SetCursor GetWindow GetDlgItemTextW SetFocus SetForegroundWindow SetActiveWindow SetDlgItemTextW FindWindowW SubtractRect IntersectRect SetRect GetWindowDC GetSysColorBrush GetSysColor GetDC GetSystemMetrics GetDlgCtrlID CreateDialogIndirectParamW ExitWindowsEx CharUpperW wsprintfA CallWindowProcW DrawIcon DrawTextW UpdateWindow InvalidateRect SetPropW GetPropW RemovePropW MapWindowPoints DrawFocusRect CopyRect InflateRect EnumChildWindows GetClassNameW MapDialogRect RegisterClassExW MonitorFromPoint CharNextW IsDialogMessageW FindWindowExW ScreenToClient MessageBoxW GetWindowRect EnableWindow SendDlgItemMessageW DestroyWindow IsWindow SendMessageW WaitForInputIdle SetWindowLongW GetWindowLongW GetClientRect EndPaint BeginPaint ReleaseDC FillRect

gdi32

CreateHalftonePalette GetDIBColorTable SelectPalette RealizePalette GetSystemPaletteEntries CreatePalette CreateFontW SetTextColor SetBkMode GetDeviceCaps CreateSolidBrush GetObjectW TranslateCharsetInfo CreateFontIndirectW SetStretchBltMode StretchBlt SelectObject DeleteDC CreateDIBitmap CreateCompatibleDC BitBlt DeleteObject GetStockObject CreateCompatibleBitmap CreateDCW CreatePatternBrush GetTextExtentPoint32W RestoreDC SaveDC DeleteMetaFile CreateBitmap CreateRectRgn PatBlt PlayMetaFile SelectClipRgn SetBkColor SetMapMode SetMetaFileBitsEx SetPixel SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx UnrealizeObject

advapi32

RegSetValueExW RegOpenKeyExW RegOpenKeyW RegOverridePredefKey LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken OpenProcessToken SetEntriesInAclW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateWellKnownSid RegQueryInfoKeyW RegEnumKeyExW RegDeleteKeyW RegEnumValueW RegDeleteValueW RegQueryValueExW RegCreateKeyExW RegCloseKey

shell32

CommandLineToArgvW ShellExecuteW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteExW SHGetFolderPathW

ole32

CoInitializeSecurity CoInitialize CoUninitialize CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CLSIDFromProgID CoCreateGuid CoCreateInstance CoTaskMemFree

oleaut32

SysAllocString SysStringLen VarBstrCmp UnRegisterTypeLi RegisterTypeLi LoadTypeLi SysStringByteLen SysAllocStringByteLen VarBstrCat VarBstrFromDate VariantClear VariantChangeType GetErrorInfo VarUI4FromStr SysReAllocStringLen SysAllocStringLen SysFreeString SystemTimeToVariantTime

shlwapi

PathFileExistsW

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromResource GdipCreateFromHDC GdipDeleteGraphics GdipSetInterpolationMode GdipDrawImageRectI GdipGetImageWidth GdipGetImageHeight GdipAlloc GdipFree GdiplusStartup GdipCloneImage GdipCreateBitmapFromStream GdipDisposeImage

Sharing

General

Malware Config

Signatures

File Explorer

2e448c667bcf8ad88fe4348710d16538_JaffaCakes118

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

gdiplus

generic