398cae19f7268f7fbbdf610b5f6b48fb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

398cae19f7268f7fbbdf610b5f6b48fb_JaffaCakes118
Size

42.7MB
MD5

398cae19f7268f7fbbdf610b5f6b48fb
SHA1

6a98f3150da49125f48fe5cff8e66cbc834bf161
SHA256

1e163a44f808486b101f00a292d2457ddc1d879c90b52754c1c895c0060efa50
SHA512

5013960bcb1f5e1ca7ac0f5ef29695f30de4d7c300ef8ac78b55282d9026e2836bc55f0668d5c83dc6f31c9650310f5ec3f4c0f76bf5af3c860e0e39e16550e5
SSDEEP

786432:ty/47E6LHR8ZxqZQIjgY77SeSYdvF3oU4HwBvV7yjQrwk7VUyh:EA7EWHR8mqI04748vNoU8UR7Kyh

Score

1^/10

Malware Config

Signatures

Files

398cae19f7268f7fbbdf610b5f6b48fb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f72e4e2037c91300763e94fbc9e7d0c4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:83:ef:09:6f:14:d7:bc:f9:f0:69:9c:ea:15:6b:7f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/02/2012, 00:00

Not After

21/02/2015, 23:59

Subject

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e9:5d:62:8c:33:87:5b:f9:bf:81:f5:08:54:09:3a:0a:05:e9:4b:63
Signer

Actual PE Digest

e9:5d:62:8c:33:87:5b:f9:bf:81:f5:08:54:09:3a:0a:05:e9:4b:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\svnwork\stormplayer\tags\5.43.1127.1111\Setup\BF_NewInstall\src\BF_InstallEngine\bin\Release\B5_Install.pdb

Imports

kernel32

GetTickCount
GetDriveTypeW
lstrcpyW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
OpenMutexW
GetSystemDirectoryW
GetWindowsDirectoryW
TerminateThread
GlobalFree
lstrcmpW
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
RaiseException
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
CreateFileMappingW
OpenFileMappingW
CreateMutexW
GetModuleFileNameW
SetLastError
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
FlushInstructionCache
CreateEventW
SetEvent
CreateDirectoryA
SetFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
ReadFile
SetFilePointer
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
RtlUnwind
LCMapStringW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetFileSize
CreateFileA
WritePrivateProfileStringW
GetPrivateProfileStringW
GetSystemInfo
GetVersionExW
LocalFree
GetModuleHandleW
CopyFileW
Sleep
MoveFileExW
CreateDirectoryW
CreateFileW
HeapFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
lstrcmpiW
RemoveDirectoryW
FindFirstFileW
lstrcatW
lstrlenW
GetFileAttributesW
lstrcpynW
TerminateProcess
OpenProcess
Process32NextW
FindResourceExW
Process32FirstW
CreateToolhelp32Snapshot
SystemTimeToFileTime
GetLocalTime
WideCharToMultiByte
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryExW
SetErrorMode
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceW
CloseHandle
WaitForSingleObject
CreateProcessW
GetACP
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
EncodePointer
CreateThread
ExitThread
DecodePointer
ExitProcess
VirtualQuery
VirtualProtect
InterlockedPopEntrySList
MultiByteToWideChar
lstrlenA
LoadLibraryW
GetTempPathW
lstrcmpiA
GlobalReAlloc
GetVersion
GetFileType
GetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
LoadLibraryA
GetLastError

user32

wsprintfW
DefWindowProcW
SetWindowLongW
GetWindowLongW
CallWindowProcW
RegisterClassExW
LoadCursorW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
GetParent
ClientToScreen
CreateAcceleratorTableW
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
RedrawWindow
SetWindowPos
CharNextW
GetSysColor
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
GetWindow
UnregisterClassA
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
IsWindowEnabled
TrackMouseEvent
EnableWindow
SetWindowRgn
PostQuitMessage
KillTimer
SetTimer
EqualRect
DestroyWindow
SetFocus
SetMenuItemInfoW
RemoveMenu
GetMenuState
SetMenuInfo
GetMenuInfo
GetClassNameA
CallNextHookEx
GetCursorPos
SetWindowsHookExW
SetPropA
SetClassLongW
GetClassLongW
IsWindowVisible
UnhookWindowsHookEx
GetMenuItemInfoW
OffsetRect
CopyRect
InflateRect
SetWindowTextA
FindWindowA
GetWindowDC
GetMenuItemCount
SetParent
UpdateWindow
GetPropA
EndDialog
IsZoomed
GetWindowRect
LoadIconW
GetWindowThreadProcessId
FindWindowExW
DialogBoxParamW
FindWindowW
WaitForInputIdle
MessageBoxW
EnableMenuItem
GetSystemMenu
PostMessageW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SendMessageTimeoutW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
SystemParametersInfoW
ShowWindow
SetRectEmpty
DrawTextW
MonitorFromWindow
GetMonitorInfoW
GetSystemMetrics
IsDialogMessageW
IsIconic
MapWindowPoints
IsRectEmpty
SetRect
PtInRect
SetCursor
DrawIconEx

gdi32

DeleteDC
GetStockObject
DeleteObject
SetTextColor
SetBkColor
ExtTextOutW
CreatePen
CreateFontIndirectW
SetBkMode
GetClipBox
ExcludeClipRect
Rectangle
GetRgnBox
StretchBlt
GetPixel
CreateFontW
RoundRect
GetTextExtentPoint32W
Ellipse
CreateDCW
SelectPalette
RealizePalette
GetDIBits
CreateDIBitmap
CreateDIBSection
ExtCreateRegion
CombineRgn
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDeviceCaps
GetObjectW
CreateSolidBrush

advapi32

RegisterEventSourceA
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
DeleteService
ControlService
CloseServiceHandle
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
GetUserNameW
BuildExplicitAccessWithNameW
DeleteAce
GetExplicitEntriesFromAclW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetFileSecurityW
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
ReportEventA
DeregisterEventSource
RegDeleteValueW
RegDeleteKeyW

shell32

ShellExecuteW
SHChangeNotify
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHFileOperationW
SHGetFolderPathW

ole32

OleUninitialize
CoCreateInstance
CLSIDFromProgID
CoInitialize
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromString
CoUninitialize
OleInitialize
PropVariantClear
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc

oleaut32

OleCreateFontIndirect
SysStringLen
VariantInit
LoadRegTypeLi
SysAllocStringByteLen
SysAllocStringLen
VariantClear
LoadTypeLi
SysStringByteLen
SysFreeString
SysAllocString
VarUI4FromStr

wininet

InternetGetConnectedState

sensapi

IsNetworkAlive

psapi

GetModuleFileNameExW

shlwapi

PathIsSameRootW
StrStrIW
SHStrDupW
StrChrIW
PathAppendW
PathFileExistsW
PathIsDirectoryW
SHGetValueW
SHSetValueW
SHDeleteKeyW
SHDeleteValueW
StrCmpW
PathAddBackslashW
PathRemoveFileSpecW
PathStripToRootW
PathSkipRootW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

TransparentBlt

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

winhttp

WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winmm

timeSetEvent
timeKillEvent

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipFree
GdipReleaseDC
GdipAlloc
GdipSetCompositingMode
GdipSetCompositingQuality
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdipDrawImageRectRect
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode

Sections

.text
Size: 754KB - Virtual size: 754KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41.5MB - Virtual size: 41.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f72e4e2037c91300763e94fbc9e7d0c4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:83:ef:09:6f:14:d7:bc:f9:f0:69:9c:ea:15:6b:7fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e9:5d:62:8c:33:87:5b:f9:bf:81:f5:08:54:09:3a:0a:05:e9:4b:63Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

sensapi

psapi

shlwapi

comctl32

msimg32

wtsapi32

winhttp

version

winmm

iphlpapi

gdiplus

Sections

.text Size: 754KB - Virtual size: 754KB

.rdata Size: 182KB - Virtual size: 182KB

.data Size: 51KB - Virtual size: 74KB

.rsrc Size: 41.5MB - Virtual size: 41.5MB

.reloc Size: 171KB - Virtual size: 170KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:83:ef:09:6f:14:d7:bc:f9:f0:69:9c:ea:15:6b:7f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e9:5d:62:8c:33:87:5b:f9:bf:81:f5:08:54:09:3a:0a:05:e9:4b:63
Signer

.text
Size: 754KB - Virtual size: 754KB

.rdata
Size: 182KB - Virtual size: 182KB

.data
Size: 51KB - Virtual size: 74KB

.rsrc
Size: 41.5MB - Virtual size: 41.5MB

.reloc
Size: 171KB - Virtual size: 170KB