privateloader | 3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118
Size 50.5MB
Sample240513-js5ctagd53
SHA256 8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d
MD5 3e783a62c7fc85f00e66e14c5486dd3c
SHA1 74db726e7647b5761e5ee59a4af9186d4bc0565d
SHA512 fef258075bb9e33894ec59e3156b71d5acbdee8cfeb642091db2ce1777197cdbfa3c31c51474b695ba238360b9bb14e338a79495b965c96cab680b07bf9d899f
SSDEEP 1572864:mQB4fzl1mP4qEZ2z9ztZ/aXT2rEsabUOmkTLUZbgW:mA4fuP4qEirPrEFUOmkTibV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

File Explorer

3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118

.exe 50.5MB

3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118

IMPHASH 2c249b0e6e58031d6f455ddf67bc0098
SHA256 8fc12ed1e2754db5054c1c53cdd09e4ff829c180294b4a29b078b41df0bfdc7d
MD5 3e783a62c7fc85f00e66e14c5486dd3c
SHA1 74db726e7647b5761e5ee59a4af9186d4bc0565d
SHA512 fef258075bb9e33894ec59e3156b71d5acbdee8cfeb642091db2ce1777197cdbfa3c31c51474b695ba238360b9bb14e338a79495b965c96cab680b07bf9d899f
SSDEEP 1572864:mQB4fzl1mP4qEZ2z9ztZ/aXT2rEsabUOmkTLUZbgW:mA4fuP4qEirPrEFUOmkTibV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

07:bb:7e:65:86:c7:d0:0d:36:17:00:e4:13:9f:e7:72

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 5, 2015 - Feb 6, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

370439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\nsis2\src\build\urelease\stub_lzma\stub_lzma.pdb

kernel32

CloseHandle SetFileTime SetEndOfFile SetFilePointer CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount HeapAlloc GetModuleFileNameW GetProcAddress TerminateProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode UnregisterWaitEx GetCurrentProcessId GetCurrentThreadId OutputDebugStringW lstrcpynA lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread RegisterWaitForSingleObject GetEnvironmentVariableW CreateEventW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetSystemDirectoryW GetSystemTimeAsFileTime InterlockedExchange OpenProcess lstrcpyW LoadLibraryA GetVersionExW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA SetConsoleCtrlHandler FileTimeToLocalFileTime SetConsoleMode GetConsoleMode GetStdHandle DeleteCriticalSection lstrcmpiW LeaveCriticalSection LocalFree FormatMessageW GetCurrentDirectoryW SetLastError FindCloseChangeNotification FindFirstChangeNotificationW GetLogicalDriveStringsW FileTimeToSystemTime WaitForMultipleObjects SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW LCMapStringW CreateFileA WriteConsoleW SetStdHandle IsValidCodePage GetOEMCP GetACP GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP FatalAppExitA GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount HeapSize GetLocaleInfoW IsProcessorFeaturePresent VirtualQuery HeapDestroy HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThread InterlockedDecrement InterlockedIncrement IsValidLocale TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW HeapSetInformation HeapReAlloc RtlUnwind EncodePointer DecodePointer RaiseException ExitThread lstrcmpW GlobalFree ExpandEnvironmentStringsW GlobalAlloc GetExitCodeProcess LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA WriteFile MultiByteToWideChar FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv SetDllDirectoryW LoadLibraryW GetModuleHandleW GetCurrentProcess VirtualAlloc VirtualFree WaitForSingleObject GetFileSize ReadFile GetProcessHeap EnterCriticalSection HeapFree

user32

CharPrevW CharUpperW CharNextA MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW wvsprintfW SystemParametersInfoW DispatchMessageW GetClassInfoW DialogBoxParamW SetWindowPos EndPaint DrawTextW FillRect GetClientRect BeginPaint DefWindowProcW SendMessageW InvalidateRect EnableWindow PeekMessageW CreateWindowExW wsprintfA CharPrevExA CharLowerW CharToOemW RegisterClassW DestroyWindow IsWindowEnabled SetClassLongW GetDC LoadImageW SetWindowLongW CallWindowProcW GetSystemMenu EnableMenuItem CreateDialogParamW EndDialog GetSystemMetrics CreatePopupMenu AppendMenuW GetWindowRect TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard LoadBitmapW IsWindowVisible GetMessagePos ScreenToClient IsDlgButtonChecked GetAsyncKeyState CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW ExitWindowsEx SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem

gdi32

SetBkColor GetDeviceCaps CreateBrushIndirect DeleteObject SelectObject SetTextColor CreateFontIndirectW SetBkMode

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ShellExecuteW SHFileOperationW SHGetFileInfoW

advapi32

RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumValueW RegOpenKeyExW RegEnumKeyW RegCloseKey RegDeleteKeyW

comctl32

ImageList_Destroy ImageList_AddMasked ImageList_Create ord17

ole32

OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

oleaut32

SysAllocStringByteLen VariantCopy VariantClear SysFreeString SysAllocString

psapi

GetModuleInformation

dnsapi

DnsQuery_A DnsFree

ws2_32

inet_addr htonl inet_ntoa

iphlpapi

GetPerAdapterInfo GetAdaptersInfo

Name

.text

Size

550KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3e783a62c7fc85f00e66e14c5486dd3c_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

oleaut32

psapi

dnsapi

ws2_32

iphlpapi

generic