38e75dabb5ee2a176e686fd831a49067_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

38e75dabb5ee2a176e686fd831a49067_JaffaCakes118
Size

1.5MB
MD5

38e75dabb5ee2a176e686fd831a49067
SHA1

a3b15f55e5e2f882dd6187d4d9bd481b611aa83d
SHA256

79afa9838d8cb614971db2723b4be22708aeb02d3debed9062712ad7486c96db
SHA512

4a4c65ac7b7fc3213be1ad285a9345c5e5481f2654886fd6b09bc150756013562dcf0f2601c39c08fd5d43c146b914048203d7817d89cbca0d096deb79ebe532
SSDEEP

24576:dhba18D2nAtUJ4LgXnZdGlaj9gOai1EoebpyTPPTAW4miPTKihaPTQFW4iuSwZPG:anyQ4L8nZEoj9ghi1RebpyT390bYVruE

Score

1^/10

Malware Config

Signatures

Files

38e75dabb5ee2a176e686fd831a49067_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f65d5f67411cca92322ccff26f827608

Code Sign

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:52:bb:b8:8a:77:1d:70:fe:94:e7:20:b3:bc:cb:5e
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

27/09/2018, 10:47

Not After

26/09/2020, 10:47

Subject

CN=昆山百诺信息科技有限公司,O=昆山百诺信息科技有限公司,L=苏州市,ST=江苏省,C=CN,1.2.840.113549.1.9.1=#0c1079756875696a756e403630322e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:81:b1:ad:ab:9a:50:25:b3:53:aa:10:cd:64:66:a7:0c:79:c1:15:3e:f9:97:42:70:09:83:b3:aa:5a:31:8f
Signer

Actual PE Digest

65:81:b1:ad:ab:9a:50:25:b3:53:aa:10:cd:64:66:a7:0c:79:c1:15:3e:f9:97:42:70:09:83:b3:aa:5a:31:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\work\yxbox\trunk\bin\Win32\Release\leyoubox\YGBrowser.pdb

Imports

wininet

GetUrlCacheEntryInfoW
InternetOpenW
InternetCrackUrlW
InternetReadFile
InternetOpenUrlW
DeleteUrlCacheEntryW
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetQueryDataAvailable
InternetSetOptionExW
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetConnectW
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetCloseHandle

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

ReadFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationW
GetFullPathNameW
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetFileSizeEx
GetFileTime
SetErrorMode
GetStartupInfoW
HeapFree
HeapAlloc
VirtualProtect
FileTimeToLocalFileTime
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesA
HeapReAlloc
RtlUnwind
RaiseException
ExitProcess
HeapSize
SetStdHandle
GetFileType
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GetCurrentProcessId
GlobalAddAtomW
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
FileTimeToSystemTime
GetThreadLocale
lstrcmpA
FormatMessageW
LocalFree
MulDiv
SetLastError
CreateSemaphoreW
ReleaseSemaphore
TerminateProcess
ResumeThread
GetCurrentThreadId
WaitForMultipleObjects
ExitThread
CreateEventW
SetEvent
WaitForSingleObject
GetShortPathNameW
FindClose
CreateDirectoryA
WritePrivateProfileStringW
CreateFileW
GetFileAttributesW
GetVersionExW
CopyFileW
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryW
GetCurrentProcess
FindFirstFileW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
FreeLibrary
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
GlobalFree
GetLastError
CloseHandle
CreateThread
Sleep
FreeResource
GlobalUnlock
GlobalLock
GlobalAlloc
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileW
GetCommandLineW
GetModuleFileNameW
lstrlenW
GetModuleHandleW
WideCharToMultiByte
LockResource
GetProcAddress
MultiByteToWideChar
SizeofResource
LoadLibraryW
GetTickCount
LoadResource
FindResourceW
lstrlenA
GetModuleHandleA
LocalAlloc
VirtualAlloc

user32

RegisterClipboardFormatW
PostThreadMessageW
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
CharNextW
GetMessageW
TranslateMessage
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetPropW
RemovePropW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
SetMenu
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetMenu
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
EndPaint
GetKeyState
WindowFromPoint
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetWindowTextW
GetFocus
GetParent
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
GetWindow
GetMenuState
GetMenuItemID
GetMenuItemCount
SetRectEmpty
CopyRect
ScreenToClient
SetCapture
SetFocus
GetWindowLongW
SetWindowLongW
ReleaseCapture
CallWindowProcW
DefWindowProcW
IsWindow
UnregisterClassW
DestroyMenu
MessageBeep
GetNextDlgGroupItem
GetWindowThreadProcessId
wsprintfW
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
GetSysColorBrush
GetSysColor
CharUpperW
GetSubMenu
EnableWindow
MessageBoxW
IsWindowVisible
LoadCursorW
SetCursor
PtInRect
GetWindowRect
GetCursorPos
KillTimer
SystemParametersInfoW
InvalidateRect
IsZoomed
UpdateWindow
GetClientRect
SetTimer
SetWindowPos
LoadImageW
SendMessageW
SetPropW
LoadIconW
PostMessageW
BeginPaint
GetWindowDC
ReleaseDC
GetSystemMetrics
GetDC
DestroyWindow

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
ExtTextOutW
ScaleViewportExtEx
CreateRectRgnIndirect
GetRgnBox
GetMapMode
TextOutW
RectVisible
PtVisible
SetViewportExtEx
RestoreDC
SaveDC
GetTextColor
GetBkColor
GetStockObject
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
Escape

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegOpenKeyW
RegQueryValueExW
RegQueryValueW
RegEnumKeyW
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW

shell32

ShellExecuteExW
SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindFileNameW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoGetMalloc

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SysStringLen
SysAllocStringLen
VariantCopy
SysFreeString
VariantChangeType
VariantClear
VariantInit
OleCreateFontIndirect
SysAllocString

gdiplus

GdipCreatePath
GdipDeletePath
GdipGetFontSize
GdipAddPathString
GdipGetFamily
GdipGetFontStyle
GdipGetPathWorldBounds
GdipDrawRectangleI
GdipDeleteStringFormat
GdipCreatePen1
GdipGetImageWidth
GdipCreateStringFormat
GdipFillRectangleI
GdipSetSolidFillColor
GdipCreateFontFamilyFromName
GdipDrawString
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipLoadImageFromFile
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStream
GdipDrawImageRectRect
GdipDeleteBrush
GdipDeletePen
GdipCloneBrush
GdipSetImageAttributesColorMatrix
GdipGetImageHeight
GdipSetTextRenderingHint
GdipDeleteFont
GdipSetImageAttributesWrapMode
GdipSetStringFormatAlign
GdipDeleteFontFamily
GdipCreateSolidFill
GdipDisposeImageAttributes
GdipCreateFont
GdipCreateImageAttributes

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

netapi32

Netbios

snmpapi

SnmpUtilOidNCmp
SnmpUtilVarBindFree
SnmpUtilOidCpy

ws2_32

connect
select
WSAGetLastError
htons
recv
socket
__WSAFDIsSet
closesocket
gethostbyname
send
WSAStartup

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f65d5f67411cca92322ccff26f827608

Code Sign

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47Certificate

Extended Key Usages

Key Usages

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

10:52:bb:b8:8a:77:1d:70:fe:94:e7:20:b3:bc:cb:5eCertificate

Extended Key Usages

Key Usages

65:81:b1:ad:ab:9a:50:25:b3:53:aa:10:cd:64:66:a7:0c:79:c1:15:3e:f9:97:42:70:09:83:b3:aa:5a:31:8fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

iphlpapi

netapi32

snmpapi

ws2_32

Sections

.text Size: 343KB - Virtual size: 343KB

.rdata Size: 81KB - Virtual size: 80KB

.data Size: 13KB - Virtual size: 29KB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 44KB - Virtual size: 44KB

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

10:52:bb:b8:8a:77:1d:70:fe:94:e7:20:b3:bc:cb:5e
Certificate

65:81:b1:ad:ab:9a:50:25:b3:53:aa:10:cd:64:66:a7:0c:79:c1:15:3e:f9:97:42:70:09:83:b3:aa:5a:31:8f
Signer

.text
Size: 343KB - Virtual size: 343KB

.rdata
Size: 81KB - Virtual size: 80KB

.data
Size: 13KB - Virtual size: 29KB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 44KB - Virtual size: 44KB