General

Malware Config

Signatures

Files

• 68c087f1601ab51088558b5a8f643a84_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  54b968c4a9ce85d0263b220b73d9a146

  
  

  Code Sign

  18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-11-2006 00:00

  Not After

  16-07-2036 23:59

  Subject

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  45:bb:20:2a:9d:33:0e:fa:75:86:52:1a:e6:f2:20:e4

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  01-02-2019 00:00

  Not After

  31-01-2020 23:59

  Subject

  CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  02-04-2008 00:00

  Not After

  01-12-2037 23:59

  Subject

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  22-07-2014 00:00

  Not After

  21-07-2024 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7f:aa:d4:d3:ff:7b:07:fb:e9:fd:c3:b7:07:fb:79:2c

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  16-02-2018 00:00

  Not After

  15-02-2021 23:59

  Subject

  CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  ab:c1:4f:0f:2f:60:d5:1e:57:00:c0:13:ff:b9:ac:e1:0b:49:22:4b:10:9c:04:4f:99:c4:cc:e0:df:eb:18:16

  Signer

  Actual PE Digest

  ab:c1:4f:0f:2f:60:d5:1e:57:00:c0:13:ff:b9:ac:e1:0b:49:22:4b:10:9c:04:4f:99:c4:cc:e0:df:eb:18:16

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  7c:98:4f:d9:06:f7:36:eb:82:9e:f9:78:3e:aa:23:85:54:37:a2:a4

  Signer

  Actual PE Digest

  7c:98:4f:d9:06:f7:36:eb:82:9e:f9:78:3e:aa:23:85:54:37:a2:a4

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  F:\QT_DL_INSTALLER_BUILD\web-installer\WebInstaller\noneAdminRelease\WebInstaller.pdb

  Imports

  wininet

  InternetConnectW

  HttpSendRequestW

  InternetSetOptionW

  HttpQueryInfoW

  InternetReadFile

  InternetGetLastResponseInfoW

  InternetCloseHandle

  InternetGetConnectedState

  InternetCrackUrlW

  InternetQueryOptionW

  HttpOpenRequestW

  InternetOpenW

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  gdiplus

  GdiplusStartup

  GdiplusShutdown

  GdipCreateBitmapFromStream

  GdipReleaseDC

  GdipGetImageWidth

  GdipCloneImage

  GdipFillRectangleI

  GdipCreateFromHDC

  GdipCreateBitmapFromHBITMAP

  GdipCreateBitmapFromFile

  GdipDisposeImage

  GdipAlloc

  GdipCreateSolidFill

  GdipSetSmoothingMode

  GdipDrawImageRectI

  GdipDeleteGraphics

  GdipSetPenMode

  GdipGetImageHeight

  GdipDeletePen

  GdipFree

  GdipDeleteBrush

  GdipCreatePen1

  psapi

  GetModuleFileNameExW

  crypt32

  CryptMsgClose

  CertGetNameStringW

  CertFreeCertificateContext

  CertFindCertificateInStore

  CertCloseStore

  CryptMsgGetParam

  CryptQueryObject

  kernel32

  EncodePointer

  ReadConsoleInputA

  SetConsoleMode

  IsValidCodePage

  GetACP

  GetOEMCP

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetVersionExW

  WriteFile

  ReadFile

  GetStdHandle

  GetLastError

  LeaveCriticalSection

  EnterCriticalSection

  WaitForMultipleObjects

  WideCharToMultiByte

  MultiByteToWideChar

  GetFullPathNameW

  CreateDirectoryW

  SetFileTime

  CreateFileW

  lstrlenW

  RemoveDirectoryW

  CloseHandle

  DeleteFileW

  SetFileAttributesW

  FindFirstFileW

  FindClose

  FindNextFileW

  GetFileSize

  SetFilePointer

  SetEndOfFile

  GlobalMemoryStatus

  GetModuleHandleW

  GetProcAddress

  GetSystemInfo

  VirtualFree

  VirtualAlloc

  WaitForSingleObject

  SetEvent

  InitializeCriticalSection

  ResetEvent

  CreateEventW

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  InterlockedDecrement

  OutputDebugStringW

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemDefaultLCID

  CreateThread

  CopyFileW

  GetFileAttributesW

  lstrlenA

  GetEnvironmentVariableW

  FlushFileBuffers

  GetLongPathNameW

  GetVersion

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  Sleep

  GetModuleFileNameW

  CreateFileMappingW

  GetCurrentProcess

  OpenProcess

  TerminateProcess

  Process32FirstW

  Process32NextW

  CreateToolhelp32Snapshot

  HeapAlloc

  HeapFree

  GetProcessHeap

  GetTickCount

  GetExitCodeProcess

  EnumSystemLanguageGroupsW

  GetProcessId

  LocalAlloc

  LocalFree

  InterlockedIncrement

  GlobalLock

  GlobalAlloc

  MulDiv

  lstrcmpW

  GlobalUnlock

  FlushInstructionCache

  RaiseException

  SetLastError

  GlobalFree

  GlobalHandle

  FreeLibrary

  LoadLibraryExW

  lstrcmpiW

  GetModuleHandleA

  GetFileType

  QueryPerformanceCounter

  LoadLibraryA

  GetVersionExA

  FlushConsoleInputBuffer

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  HeapSize

  RtlUnwind

  GetConsoleCP

  SetFilePointerEx

  GetStringTypeW

  LoadLibraryW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  ReadConsoleW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  HeapReAlloc

  ExitThread

  GetSystemTimeAsFileTime

  GetLocalTime

  GetTimeZoneInformation

  GetCPInfo

  GetModuleHandleExW

  WriteConsoleW

  GetCommandLineW

  ExitProcess

  AreFileApisANSI

  SetConsoleCtrlHandler

  GetConsoleMode

  SetStdHandle

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  CompareStringW

  LCMapStringW

  SetEnvironmentVariableA

  HeapDestroy

  InterlockedCompareExchange

  InitializeSListHead

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  SizeofResource

  DecodePointer

  user32

  EndPaint

  GetMessageW

  GetUserObjectInformationW

  GetProcessWindowStation

  MessageBoxA

  CallNextHookEx

  GetClientRect

  CreateAcceleratorTableW

  SetFocus

  GetMenuItemInfoW

  BeginPaint

  GetClassInfoExW

  TranslateMessage

  SetWindowContextHelpId

  IsDialogMessageW

  RegisterClassExW

  GetWindowPlacement

  CreateDialogIndirectParamW

  CheckMenuRadioItem

  GetWindowTextW

  PeekMessageW

  GetClassNameW

  ReleaseDC

  GetDlgItem

  SetWindowLongW

  EndDialog

  RedrawWindow

  SendDlgItemMessageW

  GetSysColor

  IsWindow

  SetMenuDefaultItem

  SetWindowsHookExW

  UnhookWindowsHookEx

  ReleaseCapture

  ClientToScreen

  GetParent

  EnableWindow

  SetWindowTextW

  SetMenuItemInfoW

  CallWindowProcW

  DestroyWindow

  GetWindowTextLengthW

  DestroyAcceleratorTable

  SetTimer

  ScreenToClient

  MapDialogRect

  CharNextW

  RegisterWindowMessageW

  FillRect

  IsChild

  GetWindow

  MoveWindow

  DispatchMessageW

  KillTimer

  InvalidateRect

  GetWindowLongW

  GetDesktopWindow

  GetLastInputInfo

  SetLayeredWindowAttributes

  GetSystemMetrics

  SwitchToThisWindow

  UpdateLayeredWindow

  GetWindowRect

  PostQuitMessage

  UnregisterClassW

  LoadCursorW

  GetDC

  LoadIconW

  SystemParametersInfoW

  SetWindowPos

  ShowWindow

  FindWindowExW

  CreateWindowExW

  MessageBoxW

  RegisterClassW

  ValidateRect

  DefWindowProcW

  PostMessageW

  EnumWindows

  GetWindowThreadProcessId

  SetCapture

  GetFocus

  SetDlgItemTextW

  AnimateWindow

  CharUpperW

  SendMessageW

  InvalidateRgn

  gdi32

  BitBlt

  DeleteDC

  CreateDIBSection

  CreateSolidBrush

  SelectObject

  CreateCompatibleBitmap

  GetStockObject

  GetObjectW

  GetDeviceCaps

  CreateCompatibleDC

  DeleteObject

  advapi32

  OpenProcessToken

  RegOpenKeyExW

  RegCloseKey

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  GetTokenInformation

  RegSetValueW

  RegDeleteKeyW

  LookupAccountSidW

  RegEnumKeyExW

  RegCreateKeyExW

  RegDeleteValueW

  RegSetValueExW

  RegQueryInfoKeyW

  DeregisterEventSource

  ReportEventA

  RegisterEventSourceA

  RegQueryValueExW

  shell32

  ExtractIconW

  SHFileOperationW

  ShellExecuteW

  ShellExecuteExW

  SHCreateDirectoryExW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetDesktopFolder

  ole32

  CoCreateInstance

  CoCreateGuid

  OleLockRunning

  CLSIDFromProgID

  CLSIDFromString

  CreateStreamOnHGlobal

  StringFromGUID2

  OleInitialize

  OleUninitialize

  CoTaskMemFree

  CoGetClassObject

  CoTaskMemAlloc

  CoUninitialize

  CoTaskMemRealloc

  CoInitialize

  oleaut32

  SysFreeString

  VariantClear

  VariantCopy

  SysStringLen

  VariantInit

  SysAllocStringLen

  DispCallFunc

  LoadTypeLi

  OleCreateFontIndirect

  LoadRegTypeLi

  VarUI4FromStr

  SysAllocString

  shlwapi

  ord176

  UrlEscapeW

  PathIsDirectoryEmptyW

  comctl32

  InitCommonControlsEx

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 334KB - Virtual size: 334KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 34KB - Virtual size: 69KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 137KB - Virtual size: 137KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ