General

Malware Config

Signatures

Files

• 6917d8d1a0451f8e7d1075997100c5f5_JaffaCakes118

  .exe windows:4 windows x86 arch:x86

  c61dbe28f4dcd882fa518894f74fc4e5

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  30:05:7d:6e:26:0d:0a:17:ff:ad:1b:da:f6:67:eb:f4

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  13-10-2017 00:00

  Not After

  12-11-2019 23:59

  Subject

  CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  4f:15:bf:0d:75:ea:66:90:38:08:05:c5:e4:5c:fa:82

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  13-10-2017 00:00

  Not After

  12-11-2019 23:59

  Subject

  CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fa:f1:e5:13:73:5e:52:2d:14:a7:7f:d1:67:1a:11:87:28:a0:4f:26:ee:22:ab:b3:fa:cb:16:64:af:92:aa:69

  Signer

  Actual PE Digest

  fa:f1:e5:13:73:5e:52:2d:14:a7:7f:d1:67:1a:11:87:28:a0:4f:26:ee:22:ab:b3:fa:cb:16:64:af:92:aa:69

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  d7:2d:57:63:10:e0:22:31:0e:2d:56:18:61:d3:7c:93:2b:1b:ae:e9

  Signer

  Actual PE Digest

  d7:2d:57:63:10:e0:22:31:0e:2d:56:18:61:d3:7c:93:2b:1b:ae:e9

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  d:\Jenkins\workspace\srf_develop\ShuRuFa\程序\Trunk\Bin\pdbmap\WanNengWB\Moniter32.pdb

  Imports

  kernel32

  FlushFileBuffers

  LockFile

  UnlockFile

  SetEndOfFile

  DuplicateHandle

  GetVolumeInformationW

  GetFullPathNameW

  FileTimeToLocalFileTime

  GetFileTime

  GetStartupInfoW

  TerminateProcess

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetSystemTimeAsFileTime

  FindFirstFileA

  HeapReAlloc

  RaiseException

  RtlUnwind

  ExitProcess

  ExitThread

  HeapSize

  VirtualQuery

  GetStdHandle

  GetModuleFileNameA

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCommandLineW

  SetHandleCount

  GetFileType

  GetStartupInfoA

  HeapDestroy

  HeapCreate

  SetFilePointer

  GetACP

  GetOEMCP

  IsValidCodePage

  LCMapStringA

  LCMapStringW

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  GetStringTypeA

  GetStringTypeW

  GetTimeZoneInformation

  GetConsoleCP

  GetConsoleMode

  SetConsoleCtrlHandler

  GetCurrentDirectoryA

  GetDriveTypeA

  GetFullPathNameA

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  SetStdHandle

  SetEnvironmentVariableA

  MoveFileW

  GetThreadLocale

  lstrlenA

  InterlockedIncrement

  TlsFree

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  GlobalHandle

  GlobalReAlloc

  TlsGetValue

  GlobalFlags

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  GetModuleHandleA

  GlobalFindAtomW

  CompareStringW

  GetVersionExA

  GlobalAddAtomW

  SetLastError

  FreeResource

  GlobalDeleteAtom

  GetCurrentThread

  ConvertDefaultLocale

  GetVersion

  EnumResourceLanguagesW

  lstrcmpA

  GetLocaleInfoW

  CompareStringA

  InterlockedExchange

  SleepEx

  GetSystemDirectoryA

  PeekNamedPipe

  WaitForMultipleObjects

  GlobalMemoryStatus

  FlushConsoleInputBuffer

  GetTempFileNameW

  GetFileInformationByHandle

  ReadConsoleInputA

  SetConsoleMode

  lstrcmpW

  lstrlenW

  CreateThread

  HeapFree

  GetProcessHeap

  HeapAlloc

  LoadLibraryA

  IsBadReadPtr

  VirtualProtect

  VirtualFree

  VirtualAlloc

  GetLongPathNameW

  MulDiv

  ReleaseMutex

  CreateMutexW

  CreateFileA

  FormatMessageW

  FindClose

  FindFirstFileW

  MoveFileExW

  InterlockedDecrement

  CopyFileW

  GlobalUnlock

  OpenProcess

  GlobalLock

  DeleteFileW

  GlobalFree

  GlobalAlloc

  GetModuleHandleW

  FileTimeToSystemTime

  ExpandEnvironmentStringsW

  GetSystemInfo

  LocalAlloc

  GetTempPathW

  ReadFile

  GetLastError

  WriteFile

  GetFileSize

  GetFileAttributesW

  LocalFree

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  QueryPerformanceCounter

  GetPrivateProfileStringW

  GetEnvironmentVariableW

  GetCurrentThreadId

  CreateFileW

  GetProcAddress

  LoadLibraryW

  WritePrivateProfileStringW

  GetLocalTime

  SetUnhandledExceptionFilter

  SetErrorMode

  FreeLibrary

  GetCurrentProcess

  GetCurrentProcessId

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  Sleep

  GetPrivateProfileIntW

  GetModuleFileNameW

  WideCharToMultiByte

  MultiByteToWideChar

  GetTickCount

  CreateDirectoryW

  WaitForSingleObject

  CloseHandle

  GetCPInfo

  CreateProcessW

  user32

  RegisterClipboardFormatW

  DestroyMenu

  CharUpperW

  UnregisterClassW

  MessageBeep

  GetNextDlgGroupItem

  ReleaseCapture

  SetCapture

  InvalidateRgn

  InvalidateRect

  SetRect

  IsRectEmpty

  CopyAcceleratorTableW

  CharNextW

  LoadCursorW

  GetSysColorBrush

  ShowWindow

  MoveWindow

  SetWindowTextW

  IsDialogMessageW

  CreateDialogIndirectParamW

  GetNextDlgTabItem

  EndDialog

  EndPaint

  BeginPaint

  GetWindowDC

  ClientToScreen

  GrayStringW

  DrawTextExW

  DrawTextW

  TabbedTextOutW

  RegisterWindowMessageW

  SendDlgItemMessageW

  SendDlgItemMessageA

  WinHelpW

  IsChild

  GetCapture

  SetPropW

  GetPropW

  RemovePropW

  SetFocus

  SetActiveWindow

  GetDlgItem

  DestroyWindow

  GetMessageTime

  MapWindowPoints

  UpdateWindow

  GetMenu

  GetSubMenu

  GetMenuItemID

  GetMenuItemCount

  CreateWindowExW

  GetClassInfoExW

  GetClassInfoW

  RegisterClassW

  GetSysColor

  AdjustWindowRectEx

  EqualRect

  CopyRect

  GetDlgCtrlID

  DefWindowProcW

  CallWindowProcW

  OffsetRect

  IntersectRect

  SystemParametersInfoA

  GetWindowPlacement

  GetLastActivePopup

  IsWindowEnabled

  MessageBoxW

  SetCursor

  UnhookWindowsHookEx

  GetWindow

  SetWindowContextHelpId

  MapDialogRect

  PostThreadMessageW

  SetWindowPos

  SetWindowsHookExW

  GetClassLongW

  CallNextHookEx

  GetMessageW

  TranslateMessage

  UnregisterClassA

  MessageBoxA

  GetProcessWindowStation

  GetUserObjectInformationW

  DispatchMessageW

  GetActiveWindow

  GetKeyState

  PeekMessageW

  GetCursorPos

  ValidateRect

  PostQuitMessage

  SetMenuItemBitmaps

  GetMenuCheckMarkDimensions

  LoadBitmapW

  ModifyMenuW

  GetMenuState

  EnableMenuItem

  CheckMenuItem

  GetTopWindow

  PtInRect

  ReleaseDC

  GetDC

  GetWindowRect

  GetClassNameW

  IsWindowVisible

  IsWindow

  GetFocus

  SetForegroundWindow

  GetForegroundWindow

  GetWindowTextW

  GetWindowThreadProcessId

  GetParent

  PostMessageW

  SetWindowLongW

  GetWindowLongW

  GetDesktopWindow

  LoadIconW

  EnableWindow

  GetClientRect

  GetSystemMetrics

  SendMessageW

  IsIconic

  GetMessagePos

  gdi32

  GetRgnBox

  SetViewportOrgEx

  GetMapMode

  CreateRectRgnIndirect

  SelectObject

  Escape

  ExtTextOutW

  GetTextColor

  GetBkColor

  GetStockObject

  DeleteDC

  ExtSelectClipRgn

  ScaleWindowExtEx

  SetWindowExtEx

  ScaleViewportExtEx

  SetViewportExtEx

  GetDeviceCaps

  TextOutW

  RectVisible

  PtVisible

  GetWindowExtEx

  GetViewportExtEx

  DeleteObject

  SetMapMode

  RestoreDC

  SaveDC

  GetObjectW

  SetBkColor

  SetTextColor

  GetClipBox

  CreateBitmap

  OffsetViewportOrgEx

  comdlg32

  GetFileTitleW

  winspool.drv

  ClosePrinter

  OpenPrinterW

  DocumentPropertiesW

  advapi32

  LookupAccountSidW

  RegQueryValueW

  RegDeleteKeyW

  RevertToSelf

  ImpersonateLoggedOnUser

  SetSecurityDescriptorDacl

  InitializeSecurityDescriptor

  RegOpenKeyW

  RegEnumKeyW

  RegisterEventSourceA

  DuplicateTokenEx

  OpenProcessToken

  GetTokenInformation

  RegCreateKeyExW

  RegQueryValueExW

  RegDeleteValueW

  RegCreateKeyExA

  RegCloseKey

  RegSetValueExW

  RegOpenKeyExW

  DeregisterEventSource

  ReportEventA

  shell32

  SHGetSpecialFolderPathW

  SHGetFolderPathW

  comctl32

  InitCommonControlsEx

  shlwapi

  PathFindExtensionW

  PathFindFileNameW

  PathStripToRootW

  PathFileExistsW

  PathIsUNCW

  oledlg

  OleUIBusyW

  ole32

  CreateILockBytesOnHGlobal

  CoRegisterMessageFilter

  CoGetClassObject

  CoTaskMemAlloc

  StgCreateDocfileOnILockBytes

  CoTaskMemFree

  CLSIDFromProgID

  CLSIDFromString

  OleFlushClipboard

  OleIsCurrentClipboard

  OleUninitialize

  StgOpenStorageOnILockBytes

  CoFreeUnusedLibraries

  OleInitialize

  CoRevokeClassObject

  oleaut32

  SysAllocString

  SysFreeString

  SysAllocStringLen

  VariantClear

  VariantChangeType

  VariantInit

  SysStringLen

  OleCreateFontIndirect

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  SafeArrayDestroy

  VariantCopy

  urlmon

  URLDownloadToFileW

  ws2_32

  shutdown

  gethostname

  ioctlsocket

  select

  WSACleanup

  WSAStartup

  WSAGetLastError

  closesocket

  socket

  recv

  send

  getsockname

  ntohs

  bind

  htons

  getsockopt

  getpeername

  setsockopt

  connect

  WSASetLastError

  inet_addr

  gethostbyname

  inet_ntoa

  htonl

  getservbyname

  gethostbyaddr

  getservbyport

  sendto

  recvfrom

  accept

  listen

  __WSAFDIsSet

  wininet

  InternetSetOptionW

  InternetReadFile

  InternetOpenW

  InternetOpenUrlW

  InternetCloseHandle

  HttpQueryInfoW

  Exports

  Exports

  curl_easy_cleanup

  curl_easy_duphandle

  curl_easy_escape

  curl_easy_getinfo

  curl_easy_init

  curl_easy_pause

  curl_easy_perform

  curl_easy_recv

  curl_easy_reset

  curl_easy_send

  curl_easy_setopt

  curl_easy_strerror

  curl_easy_unescape

  curl_escape

  curl_formadd

  curl_formfree

  curl_formget

  curl_free

  curl_getdate

  curl_getenv

  curl_global_cleanup

  curl_global_init

  curl_global_init_mem

  curl_maprintf

  curl_mfprintf

  curl_mprintf

  curl_msnprintf

  curl_msprintf

  curl_multi_add_handle

  curl_multi_assign

  curl_multi_cleanup

  curl_multi_fdset

  curl_multi_info_read

  curl_multi_init

  curl_multi_perform

  curl_multi_remove_handle

  curl_multi_setopt

  curl_multi_socket

  curl_multi_socket_action

  curl_multi_socket_all

  curl_multi_strerror

  curl_multi_timeout

  curl_mvaprintf

  curl_mvfprintf

  curl_mvprintf

  curl_mvsnprintf

  curl_mvsprintf

  curl_share_cleanup

  curl_share_init

  curl_share_setopt

  curl_share_strerror

  curl_slist_append

  curl_slist_free_all

  curl_strequal

  curl_strnequal

  curl_unescape

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 320KB - Virtual size: 317KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 48KB - Virtual size: 90KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 300KB - Virtual size: 298KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ