5fe7ca40a0f63c01555c639755d701a1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5fe7ca40a0f63c01555c639755d701a1_JaffaCakes118
Size

1.2MB
MD5

5fe7ca40a0f63c01555c639755d701a1
SHA1

602b44e4dddf9d15f1df645aca3e47b2dffe1e82
SHA256

0c15bb3aad2339ab7fae7025f81b0e886bd212e1a6070b1e927cd48251282dd7
SHA512

ce805fc9073084a9b359b17f3ac8d5d20596baa749f5e493df190ec197bac3333c56f6cccf0a0d81c26c8e442fa85c70e9d2d9fca21ab6b4d2d1789a92a12584
SSDEEP

24576:Jpc/PIiL+q+TGZ9IfsPdRdejOkqsZVTNfNUo4h:Jpc/PIiLqG7Ifsdej5uh

Score

1^/10

Malware Config

Signatures

Files

5fe7ca40a0f63c01555c639755d701a1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c1d2a5fb5d5d48bf7e735397fc1d44fb

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

22/02/2012, 09:18

Not After

22/02/2015, 09:18

Subject

CN=Baidu (China) Co.\, Ltd.,O=Baidu (China) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\clientci\workspace\BaiduPlayer_installer_net_4.0\objs\BaiduPlayerNetSetup.pdb

Imports

kernel32

GetProcAddress
Process32FirstW
Process32NextW
GetDiskFreeSpaceExW
DeleteFileW
GetCurrentProcess
MulDiv
lstrcmpW
FlushInstructionCache
SetLastError
WideCharToMultiByte
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
SetThreadAffinityMask
FileTimeToSystemTime
SetEvent
WaitForMultipleObjectsEx
ResetEvent
CreateEventW
SetFilePointer
SetEndOfFile
SystemTimeToTzSpecificLocalTime
CreateDirectoryW
WriteFile
CopyFileW
FlushFileBuffers
MoveFileW
RemoveDirectoryW
GetFileAttributesExW
InterlockedExchange
GetPrivateProfileStringA
WritePrivateProfileStringA
FormatMessageA
GetCommandLineA
GetSystemDirectoryW
GetVolumeInformationA
GetSystemDirectoryA
GetModuleFileNameA
OutputDebugStringA
LocalFree
GetExitCodeThread
GetLocalTime
CreateFileA
ReadFileEx
CancelIo
GetUserDefaultLCID
VirtualFree
VirtualAlloc
GetOEMCP
GlobalFree
DeviceIoControl
FlushViewOfFile
GetOverlappedResult
lstrcmpA
LocalAlloc
FileTimeToLocalFileTime
CreateFileW
CreateMutexW
OpenMutexW
GetDriveTypeW
GetLogicalDrives
GetVersionExW
GetTempPathW
SetCurrentDirectoryW
GetCurrentThread
GetPrivateProfileIntA
GlobalUnlock
ReadFile
GetFileAttributesW
GlobalAlloc
GetPrivateProfileStringW
GetTickCount
GlobalLock
SetErrorMode
GetFileSize
ResumeThread
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
GetModuleHandleA
GetSystemInfo
ExitThread
CreateThread
GetTimeFormatA
GetDateFormatA
GetStartupInfoW
RtlUnwind
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
SuspendThread
TlsAlloc
TlsSetValue
TlsFree
HeapCreate
GetStdHandle
IsValidCodePage
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
DeleteCriticalSection
CreateToolhelp32Snapshot
lstrcmpiW
CreateFileMappingW
OpenThread
EnterCriticalSection
GetLastError
RaiseException
lstrlenW
GetModuleFileNameW
Thread32Next
SetStdHandle
IsBadWritePtr
LeaveCriticalSection
LoadLibraryW
Thread32First
InitializeCriticalSection
GetProcessHeap
WaitForSingleObject
HeapFree
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
SetUnhandledExceptionFilter
HeapAlloc
CreateProcessW
FreeLibrary
VirtualQuery
UnmapViewOfFile
MapViewOfFile
GetCommandLineW
LockResource
MultiByteToWideChar
SizeofResource
GetModuleHandleW
LoadResource
FindResourceW
FindResourceExW
CompareStringA
SetEnvironmentVariableA
lstrcpyW
CompareStringW

user32

ClientToScreen
PostThreadMessageW
KillTimer
DestroyWindow
wsprintfW
EndDialog
DialogBoxParamW
GetWindowTextLengthW
DestroyAcceleratorTable
PostQuitMessage
ScreenToClient
RegisterWindowMessageW
IsChild
SetCapture
GetFocus
GetParent
InvalidateRgn
CreateAcceleratorTableW
GetClassInfoExW
GetDC
GetClassNameW
ReleaseDC
GetDlgItem
RedrawWindow
GetSysColor
SetWindowPos
GetCursorPos
IsWindow
ReleaseCapture
SetWindowTextW
CallWindowProcW
GetWindow
MoveWindow
EndPaint
SetWindowRgn
SetTimer
FillRect
PostMessageW
TrackMouseEvent
LoadCursorW
GetClientRect
BeginPaint
GetForegroundWindow
RegisterClassExW
LoadIconW
InvalidateRect
GetWindowLongW
GetWindowTextW
SetWindowLongW
ShowWindow
CreateWindowExW
GetSystemMetrics
SendMessageW
UpdateWindow
DefWindowProcW
GetMessageW
CharNextW
TranslateMessage
DispatchMessageW
UnregisterClassA
SetFocus
GetDesktopWindow

gdi32

CreateDIBSection
StretchBlt
SetDIBColorTable
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetDIBColorTable
GetObjectW
CreateRoundRectRgn
CreatePen
DeleteDC
BitBlt
GetStockObject
GetDeviceCaps
SetTextCharacterExtra
GetTextExtentPointW
SetBkMode
SetTextColor
TextOutW
CreateSolidBrush

advapi32

SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegCreateKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
SetSecurityDescriptorDacl
RegDeleteKeyW
InitializeSecurityDescriptor
RegQueryInfoKeyW
RegCreateKeyExW
BuildExplicitAccessWithNameW

shell32

SHBrowseForFolderW
ShellExecuteW
SHFileOperationW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetPathFromIDListW

ole32

CoGetClassObject
OleUninitialize
OleInitialize
StringFromGUID2
CLSIDFromString
StringFromCLSID
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
CoCreateInstance

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
DispCallFunc
VariantClear
LoadTypeLi
VariantInit
LoadRegTypeLi
VarUI4FromStr
OleCreateFontIndirect
SysAllocStringLen

shlwapi

PathIsDirectoryW
PathFileExistsW
PathFileExistsA

ws2_32

htonl
ntohl
gethostbyname
inet_ntoa
WSACleanup
ntohs
closesocket
socket
sendto
inet_addr
WSAStartup
setsockopt
htons
getsockname
getsockopt
send
__WSAFDIsSet
bind
WSAAsyncSelect
WSACancelAsyncRequest
WSAAsyncGetHostByName
WSAIoctl
recvfrom
WSAEventSelect
WSAWaitForMultipleEvents
ioctlsocket
connect
select
WSAGetLastError
recv

gdiplus

GdiplusShutdown
GdipFree
GdipGetImageHeight
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipDrawImageI
GdipAlloc
GdipDisposeImage
GdipGetImagePaletteSize
GdipBitmapLockBits
GdipCloneImage
GdipGetImageWidth
GdiplusStartup

msimg32

TransparentBlt
AlphaBlend

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetSetCookieW
InternetSetOptionW

crypt32

CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgClose
CertCloseStore
CryptMsgGetParam
CryptDecodeObject

Sections

.text
Size: 528KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 564KB - Virtual size: 562KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1d2a5fb5d5d48bf7e735397fc1d44fb

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

gdiplus

msimg32

iphlpapi

version

wininet

crypt32

Sections

.text Size: 528KB - Virtual size: 525KB

.rdata Size: 104KB - Virtual size: 100KB

.data Size: 44KB - Virtual size: 98KB

.rsrc Size: 564KB - Virtual size: 562KB

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24
Certificate

.text
Size: 528KB - Virtual size: 525KB

.rdata
Size: 104KB - Virtual size: 100KB

.data
Size: 44KB - Virtual size: 98KB

.rsrc
Size: 564KB - Virtual size: 562KB