6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118
Size

787KB
MD5

6c59d8e79b6c69cd3c0668f457d8617e
SHA1

8e7236acd63d5d20bb9272e8e292b6630f802bae
SHA256

2e41e3cf3aaaaa3960f5d61bbef502c820359805e836bee7b46b30c8a038349b
SHA512

399cb0258a1273066c4246445faf06ec4bb3d54098379286ebdb29518a071365c94035a584aa6a0b4f0fe8c32074a88c46edf24fb8bbc5df2accaca4f4c33c95
SSDEEP

24576:uHYmcLLDmoW3Dm+sZ4SY0LX3sRrr35G6Rb15Mbj1fd:u4NLSFYZ5Y8X826uj11

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

6c59d8e79b6c69cd3c0668f457d8617e_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ae8d76170686a6231e1d0b78efbb857c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:e6:b0:90:d7:01:41:de:18:63:8f:48:fd:51:1b:e5
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

01-12-2018 00:00

Not After

30-11-2021 23:59

Subject

SERIALNUMBER=91330100716105852F,CN=ALIBABA (CHINA) NETWORK TECHNOLOGY CO.\,LTD.,OU=Security dept,O=ALIBABA (CHINA) NETWORK TECHNOLOGY CO.\,LTD.,L=杭州,ST=浙江,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130f48616e677a686f752047616f78696e,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04-03-2014 00:00

Not After

03-03-2024 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:e6:b0:90:d7:01:41:de:18:63:8f:48:fd:51:1b:e5
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

01-12-2018 00:00

Not After

30-11-2021 23:59

Subject

SERIALNUMBER=91330100716105852F,CN=ALIBABA (CHINA) NETWORK TECHNOLOGY CO.\,LTD.,OU=Security dept,O=ALIBABA (CHINA) NETWORK TECHNOLOGY CO.\,LTD.,L=杭州,ST=浙江,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130f48616e677a686f752047616f78696e,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19-02-2018 00:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:34:f2:1a:16:3f:30:b4:a9:06:e6:a5:e7:53:1c:ac:0a:89:1e:22:ee:b8:31:87:61:72:45:77:5e:2f:a4:0e
Signer

Actual PE Digest

c0:34:f2:1a:16:3f:30:b4:a9:06:e6:a5:e7:53:1c:ac:0a:89:1e:22:ee:b8:31:87:61:72:45:77:5e:2f:a4:0e

Digest Algorithm

sha256

PE Digest Matches

true

66:13:f5:1c:f3:fb:6d:81:c1:03:6b:b2:52:7b:d5:a9:3a:2a:a9:d5
Signer

Actual PE Digest

66:13:f5:1c:f3:fb:6d:81:c1:03:6b:b2:52:7b:d5:a9:3a:2a:a9:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CryptMsgGetParam
CertGetNameStringA
CertCloseStore
CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
CertFindCertificateInStore

imm32

ImmIsIME
ImmGetDescriptionA

ws2_32

ntohs
ntohl
htons
htonl

kernel32

Sleep
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
EnterCriticalSection
LeaveCriticalSection
CloseHandle
WaitForSingleObject
GlobalAlloc
GlobalFree
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleW
IsBadReadPtr
LocalFree
LocalAlloc
OutputDebugStringA
DeviceIoControl
CreateFileA
GetVersionExW
GetVersion
GetProcAddress
OutputDebugStringW
DisableThreadLibraryCalls
SizeofResource
LockResource
LoadResource
FindResourceExW
GetSystemInfo
GetVersionExA
LoadLibraryW
GetLastError
CreateFileW
InterlockedDecrement
ReadFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
FreeLibrary
lstrlenA
lstrlenW
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
GetStdHandle
WriteFile
HeapCreate
GetStringTypeW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThread
SetLastError
IsProcessorFeaturePresent
FindResourceW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
InterlockedExchange
EncodePointer
DecodePointer
InterlockedCompareExchange
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
RtlUnwind
ExitThread
CreateThread
GetSystemTimeAsFileTime
ExitProcess
GetCommandLineA
LCMapStringW
GetCPInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FatalAppExitA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

IsWindow
GetWindowThreadProcessId
GetForegroundWindow
GetWindowRect
GetSystemMetrics
UnhookWindowsHookEx
SetWindowsHookExW
FindWindowExW
CallNextHookEx
GetLastInputInfo
GetKeyboardLayout
GetWindowTextA
GetClassNameA
GetKeyState

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

rpcrt4

UuidFromStringW

Exports

Exports

FreeUABuff
GetUA
StartCollina
StopCollina

Sections

.text
Size: - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 772KB - Virtual size: 771KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae8d76170686a6231e1d0b78efbb857c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

1a:e6:b0:90:d7:01:41:de:18:63:8f:48:fd:51:1b:e5Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

1a:e6:b0:90:d7:01:41:de:18:63:8f:48:fd:51:1b:e5Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

c0:34:f2:1a:16:3f:30:b4:a9:06:e6:a5:e7:53:1c:ac:0a:89:1e:22:ee:b8:31:87:61:72:45:77:5e:2f:a4:0eSigner

66:13:f5:1c:f3:fb:6d:81:c1:03:6b:b2:52:7b:d5:a9:3a:2a:a9:d5Signer

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

imm32

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

iphlpapi

setupapi

rpcrt4

Exports

Exports

Sections

.text Size: - Virtual size: 288KB

.rdata Size: - Virtual size: 44KB

.data Size: - Virtual size: 18KB

.vmp0 Size: - Virtual size: 638KB

.vmp1 Size: 772KB - Virtual size: 771KB

.reloc Size: 512B - Virtual size: 232B

.rsrc Size: 1024B - Virtual size: 708B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

1a:e6:b0:90:d7:01:41:de:18:63:8f:48:fd:51:1b:e5
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

1a:e6:b0:90:d7:01:41:de:18:63:8f:48:fd:51:1b:e5
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

c0:34:f2:1a:16:3f:30:b4:a9:06:e6:a5:e7:53:1c:ac:0a:89:1e:22:ee:b8:31:87:61:72:45:77:5e:2f:a4:0e
Signer

66:13:f5:1c:f3:fb:6d:81:c1:03:6b:b2:52:7b:d5:a9:3a:2a:a9:d5
Signer

.text
Size: - Virtual size: 288KB

.rdata
Size: - Virtual size: 44KB

.data
Size: - Virtual size: 18KB

.vmp0
Size: - Virtual size: 638KB

.vmp1
Size: 772KB - Virtual size: 771KB

.reloc
Size: 512B - Virtual size: 232B

.rsrc
Size: 1024B - Virtual size: 708B