636403c0bab70c5e196d8ac598fb6d2f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

636403c0bab70c5e196d8ac598fb6d2f_JaffaCakes118
Size

1.6MB
MD5

636403c0bab70c5e196d8ac598fb6d2f
SHA1

1d4df6876fdc5d2b53d4a0f1cc50aca4a87bf28a
SHA256

3f1110e1f78ff2f1a983ad893d3c7838da8048485d3af97e7d068433d0705359
SHA512

b8f3b3d4f3b7d7f1c0675c9dc48790ef8005ffd9e7819b363651585f3fa4b12f4eadd4c616e8ff0f2b667d691cdf68baaced1e60e7589c4ab587b12083dfb8a6
SSDEEP

24576:XgK5mTqk8oIWwHZSlioOKKhuwx0gPTvufUbZ1YOtLlqfUY/48jRT+JLlkESmiyCc:wzc1Lpuwx0mZGMEUY/48jRTqL2ESnW

Score

1^/10

Malware Config

Signatures

Files

636403c0bab70c5e196d8ac598fb6d2f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fa22c31a69b4f2fb262609f3d420cf0f

Code Sign

35:d0:db:03:c4:17:9b:99:e5:33:70:97:d3:ea:37:ce
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

02/07/2015, 05:55

Not After

02/09/2017, 05:55

Subject

CN=上海游创网络科技有限公司,O=上海游创网络科技有限公司,L=上海市,ST=上海市,C=CN,1.2.840.113549.1.9.1=#0c0d6c65697a40313138382e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:28

Not After

15/08/2023, 20:38

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c1:8c:98:82:5e:47:05:c4:95:a8:d8:44:b5:de:37:fc:54:ba:6e:33
Signer

Actual PE Digest

c1:8c:98:82:5e:47:05:c4:95:a8:d8:44:b5:de:37:fc:54:ba:6e:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\svn\APPS\GMSetupPacker\Build\bin\release_static\Gamestart.pdb

Imports

wininet

InternetReadFile
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlW
InternetSetOptionW
InternetOpenW

ws2_32

send
gethostbyname
connect
inet_ntoa
WSAStartup
inet_addr
htons
setsockopt
recv
socket
closesocket

msimg32

AlphaBlend

comctl32

_TrackMouseEvent

riched20

ord4

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

FindNextFileW
CreateProcessW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MoveFileW
MoveFileExW
SetLastError
lstrlenW
DeleteFileW
GetDriveTypeW
RemoveDirectoryW
CreateDirectoryW
GetCurrentThreadId
ResumeThread
SetFilePointer
SetEndOfFile
SetFileTime
GetFileTime
GetFileSize
ReadFile
CreateFileW
LoadLibraryW
FreeLibrary
LocalFree
GetProcAddress
LoadLibraryExW
CreateEventW
HeapFree
FreeResource
TerminateProcess
FindResourceW
LockResource
LoadResource
HeapAlloc
ExpandEnvironmentStringsW
GetProcessHeap
SizeofResource
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
GetExitCodeProcess
SuspendThread
DeviceIoControl
GetTempPathW
FindFirstFileW
GetCurrentDirectoryW
GetFullPathNameW
GetLongPathNameW
SetCurrentDirectoryW
GetTempFileNameW
GetSystemDirectoryW
FindClose
GetVolumeInformationW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
GetSystemInfo
InterlockedDecrement
lstrcpyW
lstrcmpiW
GetVersionExW
SetPriorityClass
QueryPerformanceCounter
ReleaseSemaphore
CreateSemaphoreW
MulDiv
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
InterlockedIncrement
GetSystemTimeAsFileTime
OutputDebugStringA
GetModuleHandleA
LocalAlloc
CreateProcessA
lstrcmpW
VerifyVersionInfoW
VerSetConditionMask
lstrcmpA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
OutputDebugStringW
GetFileAttributesW
SetFileAttributesW
SetEvent
ResetEvent
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetPrivateProfileStringW
FormatMessageW
GetTickCount
GetLastError
GetModuleHandleW
CloseHandle
GetPrivateProfileIntW
lstrlenA
WritePrivateProfileStringW
CopyFileW
GetModuleFileNameA
CreateFileA
lstrcatA
RtlUnwind
WaitForSingleObject
lstrcpyA
GetModuleFileNameW
GetCommandLineW
WriteFile
GetTempPathA
Sleep
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetCPInfo
LCMapStringW
LCMapStringA
RaiseException
InterlockedExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetStartupInfoW
ExitThread
CreateThread
HeapReAlloc
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetCurrentProcessId
VirtualAlloc
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetThreadLocale

user32

RegisterClassExW
GetPropW
GetFocus
GetMonitorInfoW
ReleaseCapture
GetUpdateRect
GetDC
IsWindowEnabled
ReleaseDC
SetCaretPos
TranslateMessage
SendMessageW
EndPaint
GetMessageW
MonitorFromWindow
DispatchMessageW
DestroyWindow
TrackPopupMenu
GetCursorPos
SetCapture
SetFocus
ShowCaret
TranslateAcceleratorW
InvalidateRect
UpdateLayeredWindow
SetWindowRgn
BeginPaint
PtInRect
GetKeyState
CreateCaret
ClientToScreen
ScreenToClient
CreateWindowExW
LoadStringW
GetActiveWindow
IsChild
GetWindowRect
IsRectEmpty
LoadCursorW
GetWindow
IsZoomed
GetWindowTextW
SystemParametersInfoW
GetForegroundWindow
SetForegroundWindow
GetClientRect
GetParent
AttachThreadInput
GetWindowTextLengthW
GetSystemMetrics
SetPropW
DestroyIcon
GetClassInfoExW
EnableWindow
LoadImageW
DefWindowProcW
CallWindowProcW
RegisterClassW
IsWindowVisible
ShowWindow
SetTimer
SetWindowTextW
PostQuitMessage
IsIconic
PostMessageW
KillTimer
wsprintfA
MessageBoxW
SetWindowLongW
SetWindowPos
GetWindowLongW
GetSysColor
SetCursor
GetClassNameW
LoadMenuW
SetMenuItemInfoW
GetSubMenu
CreateAcceleratorTableW
DestroyAcceleratorTable
InvalidateRgn
ChildWindowFromPointEx
TrackMouseEvent
GetAsyncKeyState
CopyImage
FillRect
CharPrevW
DrawTextW
DrawIconEx
MoveWindow
CharNextA
MapWindowPoints
LoadBitmapW
IntersectRect
DrawFocusRect
GetWindowThreadProcessId
CharNextW
RedrawWindow
OffsetRect
HideCaret
IsWindow

gdi32

ExtSelectClipRgn
TextOutW
SetBkMode
GetClipRgn
GetTextExtentPoint32W
StretchBlt
SelectClipRgn
SetBkColor
GetCharABCWidthsW
SetStretchBltMode
GetBitmapBits
ExtTextOutW
GetClipBox
SetBitmapBits
CreateSolidBrush
RoundRect
GetDeviceCaps
SetTextColor
DeleteObject
SelectObject
DeleteDC
CreatePen
CreateDIBSection
CreateFontIndirectW
CreateEllipticRgn
GetTextMetricsW
CreateCompatibleDC
MoveToEx
CreateRectRgnIndirect
GetStockObject
LineTo
BitBlt
CombineRgn
GetObjectW
Rectangle
CreateRoundRectRgn
CreateCompatibleBitmap
CreateRectRgn
EnumFontsW

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyW

shell32

ShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteExW
ShellExecuteA
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
CoInitializeSecurity
CoSetProxyBlanket
CLSIDFromProgID
CLSIDFromString
DoDragDrop
CreateStreamOnHGlobal
OleLockRunning
RevokeDragDrop
OleDuplicateData
ReleaseStgMedium

oleaut32

OleLoadPicture
VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

PathGetArgsW
StrRetToStrW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 216KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa22c31a69b4f2fb262609f3d420cf0f

Code Sign

35:d0:db:03:c4:17:9b:99:e5:33:70:97:d3:ea:37:ceCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36Certificate

Extended Key Usages

Key Usages

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40Certificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

c1:8c:98:82:5e:47:05:c4:95:a8:d8:44:b5:de:37:fc:54:ba:6e:33Signer

Headers

File Characteristics

PDB Paths

Imports

wininet

ws2_32

msimg32

comctl32

riched20

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 216KB - Virtual size: 215KB

.data Size: 24KB - Virtual size: 37KB

.tls Size: 4KB - Virtual size: 9B

.rsrc Size: 252KB - Virtual size: 251KB

35:d0:db:03:c4:17:9b:99:e5:33:70:97:d3:ea:37:ce
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36
Certificate

6b:da:df:ef:f0:66:1b:d2:64:2a:f4:6e:cb:b2:79:40
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

c1:8c:98:82:5e:47:05:c4:95:a8:d8:44:b5:de:37:fc:54:ba:6e:33
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 216KB - Virtual size: 215KB

.data
Size: 24KB - Virtual size: 37KB

.tls
Size: 4KB - Virtual size: 9B

.rsrc
Size: 252KB - Virtual size: 251KB