41939c7c29bc2e041e02372cf8775603_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41939c7c29bc2e041e02372cf8775603_JaffaCakes118
Size

1.8MB
MD5

41939c7c29bc2e041e02372cf8775603
SHA1

7353ed02e82024c77ad7b22126a4a8b5a9467eb0
SHA256

a1a733ab1e2101901eb5b9888a81b549a54f0fedc60476bbc44c4ae373983996
SHA512

de8e303d035b4683438befd7334578c53540a050f3864c409f761d03ce91a3ea5ba4b9b9b5f0b9b505622f55557006d21f1266b949b5469a43157969c2878fd5
SSDEEP

49152:dmBgrrg4LrVyRwhSvk5Z+DWje1jEQ2UHiy50jR3G:dmGrr5LrVyReSrCUSIP50jNG

Score

1^/10

Malware Config

Signatures

Files

41939c7c29bc2e041e02372cf8775603_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eea0a87242598e7d36f5e4aa46e2f71b

Code Sign

26:74:61:28:88:77:8c:d8:e2:b4:b7:98:c1:d8:44:d1
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

07/04/2016, 05:37

Not After

07/07/2017, 05:37

Subject

CN=趣游时代（北京）科技有限公司,O=趣游时代（北京）科技有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:eb:95:45:51:91:31:95:cd:2d:0e:bf:b7:c2:0e:1b
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

07/04/2016, 05:05

Not After

07/07/2017, 05:05

Subject

CN=趣游时代（北京）科技有限公司,O=趣游时代（北京）科技有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:55:37:80:23:4f:5f:4a:7d:bf:4c:53:38:5b:81:53:c7:64:35:af:79:95:ad:b4:0a:92:24:21:1f:cf:95:ca
Signer

Actual PE Digest

5f:55:37:80:23:4f:5f:4a:7d:bf:4c:53:38:5b:81:53:c7:64:35:af:79:95:ad:b4:0a:92:24:21:1f:cf:95:ca

Digest Algorithm

sha256

PE Digest Matches

true

b0:08:f2:61:29:2c:9f:5e:7f:57:30:db:c9:4f:e3:c4:a9:33:7f:20
Signer

Actual PE Digest

b0:08:f2:61:29:2c:9f:5e:7f:57:30:db:c9:4f:e3:c4:a9:33:7f:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

i:\360\new MiniClient\release\jxclient.pdb

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GetFileAttributesA
GetFileTime
GetCPInfo
GetOEMCP
SetErrorMode
ExitProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
HeapReAlloc
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
HeapSize
GetFileType
Sleep
GetStdHandle
GetACP
IsValidCodePage
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
GetTimeZoneInformation
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
SetFilePointer
ReadFile
GetThreadLocale
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetModuleFileNameW
FormatMessageA
MulDiv
WritePrivateProfileStringA
GlobalAddAtomA
TlsFree
GlobalFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalFree
LocalAlloc
InterlockedIncrement
GetCurrentProcessId
SetLastError
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
FreeLibrary
GetModuleHandleA
CreateDirectoryA
GetShortPathNameA
GetCurrentThread
SetThreadPriority
GetCurrentProcess
SetPriorityClass
lstrcatA
lstrcpyA
FlushFileBuffers
WriteFile
FreeResource
CreateFileA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GlobalLock
GlobalAlloc
GlobalUnlock
CloseHandle
WaitForSingleObject
SetEvent
CreateThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeleteFileA
InterlockedDecrement
InterlockedExchange
CompareStringA
GetVersion
CompareStringW
GetEnvironmentVariableA
lstrlenW
lstrlenA
GetLastError
GetVersionExA
CopyFileA
GetTickCount
CreateEventA
MultiByteToWideChar
FindResourceA
LoadResource
CreateProcessA
LockResource
SizeofResource
WideCharToMultiByte
SetStdHandle

user32

PostThreadMessageA
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
WindowFromPoint
ShowWindow
MoveWindow
SetWindowTextA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetForegroundWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
GetSysColor
AdjustWindowRectEx
ScreenToClient
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
IsDialogMessageA
MessageBeep
IsChild
GetTopWindow
GetNextDlgGroupItem
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetCursor
GetWindow
SetWindowContextHelpId
MapDialogRect
ReleaseCapture
SetFocus
SetWindowPos
GetDesktopWindow
SetCapture
InvalidateRgn
InvalidateRect
ReleaseDC
EqualRect
IntersectRect
OffsetRect
IsRectEmpty
CopyRect
IsWindow
CopyAcceleratorTableA
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
DestroyMenu
UnregisterClassA
RegisterClipboardFormatA
PeekMessageA
GetCursorPos
ValidateRect
GetSysColorBrush
LoadCursorA
CharNextA
EndPaint
RegisterClassA
BeginPaint
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostMessageA
LoadBitmapA
GetDC
SetWindowLongA
AdjustWindowRect
GetWindowLongA
PtInRect
GetKeyState
GetAsyncKeyState
GetParent
GetFocus
MessageBoxA
CharUpperA
SystemParametersInfoA
GetSystemMetrics
IsIconic
EnableWindow
KillTimer
GetWindowRect
SetTimer
PostQuitMessage
SendMessageA
SetRect
DrawIcon
GetClientRect
LoadIconA
GetWindowPlacement

gdi32

SetWindowExtEx
GetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetStockObject
GetBkColor
GetTextColor
GetMapMode
GetViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateDIBSection
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
SetMapMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
GetRgnBox
CreateRectRgnIndirect
CreateBitmap
DeleteDC
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegOpenKeyA
RegCloseKey
RegCreateKeyExA
RegQueryValueA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA
SHChangeNotify
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA

comctl32

InitCommonControlsEx
_TrackMouseEvent

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathIsDirectoryA
UrlUnescapeA

oledlg

ord8

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromProgID
CLSIDFromString
CoRegisterMessageFilter
CoDisconnectObject
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

LoadTypeLi
OleCreateFontIndirect
VariantChangeType
SafeArrayDestroy
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringLen
VariantClear
VariantCopy
VariantInit
SysAllocStringByteLen
SysAllocString
SysFreeString

ws2_32

WSACleanup
WSAStartup
WSASetLastError

gdiplus

GdipGetImageWidth
GdipFree
GdipCloneImage
GdipDeleteBrush
GdipDisposeImage
GdipCloneBrush
GdipDrawImagePointRectI
GdipDrawImageRect
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreateFont
GdipCreateFromHDC
GdipGetImageHeight
GdipSetSmoothingMode
GdipDrawImageRectI
GdipReleaseDC
GdipCreateBitmapFromHBITMAP
GdipDrawString
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipAlloc
GdipDeleteFontFamily
GdipDeleteGraphics
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipGetGenericFontFamilySansSerif
GdiplusStartup
GdipLoadImageFromStream

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

wininet

HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetSetOptionExA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetGetLastResponseInfoA

Sections

.text
Size: 272KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eea0a87242598e7d36f5e4aa46e2f71b

Code Sign

26:74:61:28:88:77:8c:d8:e2:b4:b7:98:c1:d8:44:d1Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

65:eb:95:45:51:91:31:95:cd:2d:0e:bf:b7:c2:0e:1bCertificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

5f:55:37:80:23:4f:5f:4a:7d:bf:4c:53:38:5b:81:53:c7:64:35:af:79:95:ad:b4:0a:92:24:21:1f:cf:95:caSigner

b0:08:f2:61:29:2c:9f:5e:7f:57:30:db:c9:4f:e3:c4:a9:33:7f:20Signer

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

ws2_32

gdiplus

winmm

wininet

Sections

.text Size: 272KB - Virtual size: 269KB

.rdata Size: 72KB - Virtual size: 69KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

26:74:61:28:88:77:8c:d8:e2:b4:b7:98:c1:d8:44:d1
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

65:eb:95:45:51:91:31:95:cd:2d:0e:bf:b7:c2:0e:1b
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

5f:55:37:80:23:4f:5f:4a:7d:bf:4c:53:38:5b:81:53:c7:64:35:af:79:95:ad:b4:0a:92:24:21:1f:cf:95:ca
Signer

b0:08:f2:61:29:2c:9f:5e:7f:57:30:db:c9:4f:e3:c4:a9:33:7f:20
Signer

.text
Size: 272KB - Virtual size: 269KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB