4c878be1f908f1aa226831557f833ccf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4c878be1f908f1aa226831557f833ccf_JaffaCakes118
Size

12.8MB
MD5

4c878be1f908f1aa226831557f833ccf
SHA1

21da9ff8f1195fb2909940d1ffba734045e5ad1f
SHA256

020992e80f208a8e907ed9fef2ea608f50acaf20cf1c9c24d8cd25eb9de48351
SHA512

81061032f94af974351aa6890b53a897f130be593f96013cf9149d32ed82621bb81fe423f8bc048ea385f5ebcafac5a36e4eee86beafd62773819bc2188c425b
SSDEEP

196608:8sEUQX5L5PeT6QTuQWvd4GPhmwNuXL77iB7UCWNcTjDCmMQ/F25ihMbdMYKK3:8DjZ5wgQWv6ZwEXH+9U/NcuxcXedh3

Score

1^/10

Malware Config

Signatures

Files

4c878be1f908f1aa226831557f833ccf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bef59fe98228e1cf53e293b72b0ee05c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ef:f0:15:0a:08:27:b1:f9:57:d7:7b:12:2c:be:26:fb:09:98:ba:ad:e4:81:36:0b:32:32:ad:f7:fc:a1:b6:3c
Signer

Actual PE Digest

ef:f0:15:0a:08:27:b1:f9:57:d7:7b:12:2c:be:26:fb:09:98:ba:ad:e4:81:36:0b:32:32:ad:f7:fc:a1:b6:3c

Digest Algorithm

sha256

PE Digest Matches

true

96:b8:aa:0d:69:14:8c:70:8a:14:43:d5:a5:40:2e:ad:10:15:be:ba
Signer

Actual PE Digest

96:b8:aa:0d:69:14:8c:70:8a:14:43:d5:a5:40:2e:ad:10:15:be:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\261601\out\Release\Install.pdb

Imports

kernel32

OpenProcess
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
WideCharToMultiByte
GetDiskFreeSpaceExW
GetDriveTypeW
GetVersionExW
GetTickCount
GetProcAddress
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
GetLastError
lstrlenW
GetModuleFileNameW
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
GetCommandLineW
OutputDebugStringA
GetSystemTime
OutputDebugStringW
GetStartupInfoW
CreateProcessW
lstrcmpiA
lstrcmpA
CreateWaitableTimerA
SetWaitableTimer
ResumeThread
OpenEventA
CreateToolhelp32Snapshot
Process32FirstW
Module32FirstW
Module32NextW
Process32NextW
CreateFileW
LockFile
GetFileSize
ReadFile
UnlockFile
CloseHandle
DeleteCriticalSection
RaiseException
SetLastError
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
DeleteFileW
GlobalFindAtomW
GlobalAddAtomW
GetShortPathNameW
GlobalDeleteAtom
Sleep
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
WritePrivateProfileStringW
SetEnvironmentVariableW
SetEnvironmentVariableA
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetModuleHandleA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FatalAppExitA
HeapCreate
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetCPInfo
LCMapStringA
SetStdHandle
ExitProcess
GetFileType
WriteConsoleW
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
TlsFree
DeleteAtom
FindAtomW
TlsAlloc
AddAtomW
FindResourceExW
LoadResource
LockResource
OpenThread
GetAtomNameW
TlsSetValue
TlsGetValue
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
GetLocaleInfoA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
MulDiv
InterlockedCompareExchange
InterlockedExchange
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
DeleteFileA
OpenMutexW
GetCurrentThread
FindFirstChangeNotificationW
FindCloseChangeNotification
SearchPathW
GetCurrentDirectoryW
GetWindowsDirectoryW
SetEndOfFile
SetFileTime
GetFileInformationByHandle
CompareFileTime
lstrcpynW
lstrcmpW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
CreateMutexW
ReleaseMutex
GetFileSizeEx
GetExitCodeThread
TerminateThread
SetFilePointer
lstrlenA
GetConsoleWindow
AllocConsole
GetStdHandle
GetFileAttributesExW
GetFileTime
DeviceIoControl
FlushFileBuffers
SizeofResource
FindResourceW
HeapAlloc
CreateEventA
GetProcessHeap
HeapFree
GetSystemDefaultLangID
WaitForMultipleObjects
GetPrivateProfileStringW
LocalAlloc
GetEnvironmentVariableW
LocalFree
GetSystemInfo
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateEventW
ResetEvent
WriteFile
LCMapStringW
lstrcpyW
GetSystemDirectoryW
GetLogicalDriveStringsW
MoveFileExW
CopyFileW
GetCurrentProcessId
TerminateProcess
GetLongPathNameW
WaitForSingleObject
GetExitCodeProcess
LoadLibraryW
GetSystemWindowsDirectoryW
GetFileAttributesW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetFullPathNameW
GetTempPathW
FormatMessageW
SetEvent
GetLocalTime
CreateDirectoryW
GetTempFileNameW
MoveFileW

user32

TranslateMessage
GetMessageW
PeekMessageW
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateWindowExW
DestroyWindow
OffsetRect
IsRectEmpty
CopyRect
DispatchMessageW
BeginPaint
KillTimer
SetTimer
GetWindowRect
SetWindowPos
PostQuitMessage
SystemParametersInfoW
UpdateLayeredWindow
CallWindowProcW
SetWindowLongW
CreateIconFromResource
CreateIconFromResourceEx
EndPaint
CreateDialogParamW
LookupIconIdFromDirectory
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
DefWindowProcW
GetParent
ShowWindow
InvalidateRect
ExitWindowsEx
SetWindowTextW
MoveWindow
BringWindowToTop
CharNextW
FillRect
GetWindowDC
ReleaseDC
ScreenToClient
GetSystemMetrics
GetClientRect
GetWindowLongW
SendMessageW
MapWindowPoints
IsWindow
PostMessageW
GetWindowThreadProcessId
FindWindowW
FindWindowExW
GetWindowTextLengthW
GetWindowTextW
MessageBoxW
SendMessageTimeoutW
PostThreadMessageW
LoadStringW
GetShellWindow
WaitForInputIdle
GetActiveWindow
IsWindowVisible
SetRect
SetCursor
IsDialogMessageW
DialogBoxParamW
EndDialog
SetWindowRgn
PtInRect
UnregisterClassA
RedrawWindow
GetDC
GetWindow
MonitorFromWindow
GetMonitorInfoW
LoadImageW

gdi32

GetStockObject
GetTextExtentPoint32W
DeleteDC
ExtTextOutW
SetBkColor
CreateCompatibleDC
SelectObject
SetViewportOrgEx
CreateCompatibleBitmap
DeleteObject
StretchBlt
CreateHalftonePalette
EnumFontFamiliesW
CreateDIBSection
SetDIBColorTable
SetPixelV
GdiFlush
SetDIBitsToDevice
CreateSolidBrush
GetPixel
SaveDC
RestoreDC
BitBlt
SetStretchBltMode
CreateFontW
CreateRectRgn
CombineRgn
GetDeviceCaps
GetPaletteEntries
CreateFontIndirectW

advapi32

RegDeleteValueW
CreateProcessAsUserW
RegOpenCurrentUser
OpenSCManagerW
OpenServiceW
QueryServiceStatus
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
CloseServiceHandle
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenThreadToken
RegEnumValueW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
ImpersonateLoggedOnUser
GetTokenInformation
RegCreateKeyW
DuplicateTokenEx
CreateWellKnownSid
GetLengthSid
SetTokenInformation
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
DeleteAce
GetTrusteeNameW
EqualSid
GetUserNameW
LookupAccountNameW
LookupAccountSidW
GetExplicitEntriesFromAclW
RevertToSelf

shell32

SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathA
SHCreateDirectoryExA
SHGetFolderPathW
ord165
ord680
SHCreateDirectoryExW
SHChangeNotify
SHFileOperationW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetSpecialFolderLocation

ole32

CoSetProxyBlanket
CreateStreamOnHGlobal
StringFromGUID2
CoInitializeSecurity
OleRun
CLSIDFromProgID
CoInitializeEx
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitialize

oleaut32

VariantChangeType
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysStringLen
VariantInit
VarUI4FromStr
SysFreeString
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantCopy

shlwapi

StrToIntExW
SHGetValueA
SHSetValueA
PathRemoveFileSpecW
PathCombineW
SHSetValueW
PathFileExistsW
PathAppendW
SHGetValueW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW
PathFindFileNameW
SHDeleteValueW
SHDeleteKeyW
wnsprintfW
PathIsPrefixW
AssocQueryStringW
PathCanonicalizeW
PathCompactPathW
PathFindExtensionA
PathFindFileNameA
PathRelativePathToW
StrStrW
PathIsRootW
StrCmpW

comctl32

InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipAlloc
GdipCreatePen1
GdipDeletePen
GdipSetPenStartCap
GdipSetPenEndCap
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLine
GdipDrawString
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectRect
GdipDrawImageRectRectI
GdipDeleteBrush
GdipFree
GdipCloneBrush
GdipCreateSolidFill
GdipMeasureString
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipDrawImagePointRectI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipCreateImageAttributes

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

secur32

GetUserNameExW

setupapi

SetupIterateCabinetW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

wininet

InternetCrackUrlW
InternetGetConnectedState

urlmon

URLDownloadToCacheFileW
URLDownloadToCacheFileA
URLDownloadToFileW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

winmm

timeGetTime

iphlpapi

GetAdaptersInfo

netapi32

Netbios

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bef59fe98228e1cf53e293b72b0ee05c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:daCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dcCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

33:90:20:77:61:c4:26:dd:94:50:03:0dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

ef:f0:15:0a:08:27:b1:f9:57:d7:7b:12:2c:be:26:fb:09:98:ba:ad:e4:81:36:0b:32:32:ad:f7:fc:a1:b6:3cSigner

96:b8:aa:0d:69:14:8c:70:8a:14:43:d5:a5:40:2e:ad:10:15:be:baSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

psapi

secur32

setupapi

wintrust

crypt32

wininet

urlmon

version

wtsapi32

userenv

winmm

iphlpapi

netapi32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 244KB - Virtual size: 243KB

.data Size: 36KB - Virtual size: 49KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 62KB - Virtual size: 62KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

ef:f0:15:0a:08:27:b1:f9:57:d7:7b:12:2c:be:26:fb:09:98:ba:ad:e4:81:36:0b:32:32:ad:f7:fc:a1:b6:3c
Signer

96:b8:aa:0d:69:14:8c:70:8a:14:43:d5:a5:40:2e:ad:10:15:be:ba
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 244KB - Virtual size: 243KB

.data
Size: 36KB - Virtual size: 49KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 62KB - Virtual size: 62KB