34147258b1528d120f8a133ac84141a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

34147258b1528d120f8a133ac84141a2_JaffaCakes118
Size

1.2MB
MD5

34147258b1528d120f8a133ac84141a2
SHA1

1884e6c78593d21eb71ae817b81ec95cb8ab67da
SHA256

8e7c1897c01f83bf67614f4864ef708edec1eb0a11025c9f3f5e9d3aa9752f60
SHA512

31c1c81ac94090b1c4d602f5e20d8310b187adc1e154f84ce1a1eb7a56aca9a180c68d5702f244e3403600f300f62b5d8ec9f1614bf1809291cf7ce705c34bee
SSDEEP

24576:+U15JD/0lHcJD/0sJbvEJbvb6PzI/JbU/JbU/m0hvguc00hvguc00hvgucONN5QN:+gpn3Q0aSpv

Score

1^/10

Malware Config

Signatures

Files

34147258b1528d120f8a133ac84141a2_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b76c1e2ebe7ea011a900d58a5a9e8726

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/07/2010, 00:00

Not After

11/06/2013, 23:59

Subject

CN=Realtek Semiconductor Corp,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RTCN,O=Realtek Semiconductor Corp,L=Hsinchu,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fc:73:b7:a7:82:39:5d:76:2f:04:12:23:6b:c3:e1:5f:1a:10:0d:2f
Signer

Actual PE Digest

fc:73:b7:a7:82:39:5d:76:2f:04:12:23:6b:c3:e1:5f:1a:10:0d:2f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupOpenInfFileA
SetupCloseInfFile
SetupFindNextLine
CM_Get_DevNode_Status_Ex
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupGetStringFieldA
SetupFindFirstLineA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList

kernel32

ReadFile
SetFilePointer
FlushFileBuffers
GetCPInfo
GetOEMCP
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
GetCommandLineA
GetProcessHeap
RaiseException
GetThreadLocale
HeapSize
GetACP
IsValidCodePage
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GlobalFlags
WritePrivateProfileStringA
InterlockedIncrement
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameA
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GlobalFree
GlobalLock
GlobalUnlock
FormatMessageA
FindFirstFileA
FindNextFileA
FindClose
SetLastError
GetCurrentThread
GetCurrentProcess
GlobalAlloc
GetWindowsDirectoryA
lstrcatA
LoadLibraryA
GetFileSize
WriteFile
FreeLibrary
lstrlenA
CompareStringA
LocalFree
LocalAlloc
CreateFileA
DeviceIoControl
CloseHandle
GetVersionExA
GetVersion
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
ExitProcess

user32

ShowWindow
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
GetWindowTextA
SetWindowTextA
ClientToScreen
GetSystemMetrics
CharUpperA
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
DestroyMenu
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
UnhookWindowsHookEx
PostQuitMessage
PostMessageA
CheckMenuItem
EnableMenuItem
ModifyMenuA
SendMessageA
GetParent
GetFocus
LoadBitmapA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions

gdi32

DeleteDC
GetStockObject
SetWindowExtEx
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
ScaleWindowExtEx

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegQueryValueExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupPrivilegeNameA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyA
RegOpenKeyA
RegEnumValueA
RegCloseKey
RegSetValueExA

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

ChkAPOSupportDolbyPCEE4_DAA
ChkAPOSupportDolbyPCEE4_DHT
ChkBroadComID
ChkHDMISupported
ChkLoadDrvPrivilege
ChkRtkRegKeyEmpty_x64_CU
ChkRtkRegKeyEmpty_x64_LM
ChkRtkRegKeyEmpty_x86_CU
ChkRtkRegKeyEmpty_x86_LM
ChkSupportAPODTSAPOUltraPCBoost
ChkSupportAPOSupportSonceFocus30
ChkSupportAPOSupportSonceFocus30_NoSonicFocusGUI
ChkSupportAPOSupportSonceFocus30_SonicFocusGUI
ChkSupportAPOSupportSonceFocus30_SonicMasterGUI
ChkSupportDolbySpruce
ChkSupportHP_AIO
ChkSupportHP_AIO_SonicFocusBeats
ChkSupportMaxxAudio30
ChkSupportMaxxVolumeSD
ChkSupportSoundRoom
ConfirmRtkDrv
ExtractBeatsIcon
ExtractHideWin
ExtractRtkIcon
ExtractSetupService
GetAudioInterface
GetDrvPolicy
GetHDASubID
GetRegistryProperty
GetRtkHDAudioGlobalPolicy
GetRtkHDAudioGlobalPolicy_APODTSAPOUltraPCBoost_All
GetRtkHDAudioGlobalPolicy_APOSupportSonicFocus30
GetRtkHDAudioGlobalPolicy_APOSupportSonicFocus30_SF3GUIType
GetRtkHDAudioGlobalPolicy_APOUseMaxx30
GetRtkHDAudioGlobalPolicy_APOUseMaxxVolumeSD
GetRtkHDAudioGlobalPolicy_HPAIOModel
GetRtkHDAudioGlobalPolicy_SonicFocusBeats
GetRtkHDAudioGlobalPolicy_SoundRoom
GetRtkHDAudioGlobalPolicy_SupDSpruce
InfGetMfgIDString
IsMediaCenterOS
IsServerOS
SetCDfmt
SetDSHWAcceleration_BasicLv

Sections

.text
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b76c1e2ebe7ea011a900d58a5a9e8726

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53Certificate

Extended Key Usages

Key Usages

fc:73:b7:a7:82:39:5d:76:2f:04:12:23:6b:c3:e1:5f:1a:10:0d:2fSigner

Headers

File Characteristics

Imports

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 136KB

.rdata Size: 36KB - Virtual size: 32KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 24KB - Virtual size: 21KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

2c:80:89:2e:01:15:b0:b7:7a:a3:59:4b:9a:73:39:53
Certificate

fc:73:b7:a7:82:39:5d:76:2f:04:12:23:6b:c3:e1:5f:1a:10:0d:2f
Signer

.text
Size: 140KB - Virtual size: 136KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 24KB - Virtual size: 21KB