6b7a588048aba96888a969240359df18_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6b7a588048aba96888a969240359df18_JaffaCakes118
Size

1022KB
MD5

6b7a588048aba96888a969240359df18
SHA1

0ade4fe7fe38ffce904294e0b60751428728840a
SHA256

90473d93e4d1f2943d04c5f237fc219fd95fe0cda51251eb6aaf3d8b305eba11
SHA512

4c70c419ec7193aa9a90022d78b0e2d8bdd9686cdcfcef4e6087c43be468d16dbc50e35114cb166e4a474ceb6b4f90a9d1ed59df75dd411c1ddca8d5c0f92df8
SSDEEP

24576:N5TV8hlW80MafypSNBWzd/U2sg5XOjUUWRJgJR9b:bmhlnSOzNJWjUrRCJz

Score

1^/10

Malware Config

Signatures

Files

6b7a588048aba96888a969240359df18_JaffaCakes118
.dll windows:4 windows x86 arch:x86

eafd69dcf4113dfd376ee9950d275970

Code Sign

7c:44:3d:7d:bb:05:4e:45:9c:51:3d:66:5d:fa:8d:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11-10-2018 00:00

Not After

02-02-2020 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:2d:8c:bf:49:c9:09:4c:7e:a9:9e:6a:68:36:5e:32
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11-10-2018 00:00

Not After

02-02-2020 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b7:ba:a3:4b:15:eb:5b:3e:4c:d9:23:e4:1f:44:53:9f:0f:62:9c:f9:0f:1e:cf:af:03:28:14:a1:22:42:6b:dd
Signer

Actual PE Digest

b7:ba:a3:4b:15:eb:5b:3e:4c:d9:23:e4:1f:44:53:9f:0f:62:9c:f9:0f:1e:cf:af:03:28:14:a1:22:42:6b:dd

Digest Algorithm

sha256

PE Digest Matches

true

79:1b:d9:c4:6a:d2:83:4e:6d:3e:74:1c:6b:d8:75:70:34:ad:11:db
Signer

Actual PE Digest

79:1b:d9:c4:6a:d2:83:4e:6d:3e:74:1c:6b:d8:75:70:34:ad:11:db

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\work\TencentVideoWindows\develop999\Setup\PluginSource\ProcDLL\Release\ProcDLL.pdb

Imports

kernel32

lstrlenW
GetPrivateProfileStringW
GetModuleHandleW
GetSystemDirectoryW
GlobalFree
lstrcpyW
GlobalAlloc
GetCurrentThreadId
lstrcatW
QueryDosDeviceW
GetLogicalDriveStringsW
GetTickCount
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
GetModuleFileNameW
SetFileAttributesW
CopyFileW
LocalFree
TerminateProcess
DuplicateHandle
TerminateThread
VirtualFree
VirtualAlloc
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
GetLongPathNameW
GetPrivateProfileIntW
OutputDebugStringW
GlobalSize
GlobalUnlock
GlobalLock
GetTempPathW
WritePrivateProfileSectionW
GetPrivateProfileSectionW
SetFilePointer
GetFileType
SystemTimeToFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
SetFileTime
FileTimeToSystemTime
FileTimeToDosDateTime
GetLocalTime
GetSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SetEndOfFile
GetDiskFreeSpaceW
UnlockFile
DeleteFileA
LockFileEx
AreFileApisANSI
WritePrivateProfileStringW
GetSystemInfo
GetTempPathA
GetFullPathNameW
HeapValidate
GetDiskFreeSpaceA
GetFileAttributesA
FormatMessageA
GetExitCodeProcess
CreateMutexW
OutputDebugStringA
UnlockFileEx
FormatMessageW
CreateFileMappingA
WaitForSingleObjectEx
GetFileAttributesExW
LockFile
FlushViewOfFile
GetThreadLocale
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InterlockedExchange
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
SetHandleCount
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
HeapSize
LCMapStringW
LCMapStringA
GetModuleFileNameA
GetStdHandle
ExitProcess
FatalAppExitA
HeapCreate
HeapDestroy
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
MoveFileW
Sleep
MoveFileExW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateDirectoryW
GetFileSize
ReadFile
GetFullPathNameA
ExpandEnvironmentStringsW
FreeLibrary
WriteFile
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
DeviceIoControl
CreateThread
WaitForSingleObject
lstrlenA
MultiByteToWideChar
GetCurrentProcessId
CreateProcessW
LoadLibraryW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetFileAttributesW
GetVersionExW
CreateFileW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Module32FirstW
Module32NextW
Process32NextW
LoadLibraryA
GetProcAddress
lstrcpynW
OpenProcess
lstrcmpiW
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetVersionExA
GetCommandLineA
ResumeThread
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
HeapCompact

user32

EndPaint
GetClientRect
BeginPaint
CallWindowProcW
SendMessageW
RedrawWindow
SetWindowPos
SetWindowLongW
PostMessageW
IsWindow
DestroyWindow
DispatchMessageW
TranslateMessage
WaitForInputIdle
GetDesktopWindow
EnumChildWindows
GetWindowLongW
FindWindowW
GetWindowThreadProcessId
UnregisterClassA
wsprintfW
GetDC
EnumDisplayDevicesW
AllowSetForegroundWindow
MsgWaitForMultipleObjects
PeekMessageW
LoadImageW
DialogBoxParamW
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
GetDlgItem
UpdateWindow
LoadStringW
ScreenToClient
MoveWindow
SetTimer
SetWindowTextW
SetDlgItemTextW
BringWindowToTop
EndDialog
KillTimer
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
GetClassNameW
SendMessageTimeoutW
ClientToScreen
OffsetRect
FindWindowExW
EnumWindows
GetWindowTextW
CharNextW
FillRect
LoadBitmapW
ReleaseDC
GetForegroundWindow
SetForegroundWindow
IsWindowVisible
AttachThreadInput
CreateDialogParamW
SetLayeredWindowAttributes
CreateWindowExW
ShowWindow
GetMessageW
IsDialogMessageW

gdi32

GetStockObject
CreateSolidBrush
SetBkMode
CreateFontW
SetTextColor
TextOutW
DeleteObject
GetObjectW
CreateCompatibleDC
SelectObject
StretchBlt
GetDeviceCaps

advapi32

AdjustTokenPrivileges
OpenProcessToken
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
DeleteService
OpenSCManagerW
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
CreateProcessAsUserW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
EnumDependentServicesW
OpenServiceW
ControlService
QueryServiceStatusEx
CloseServiceHandle
RegOpenKeyExA
RegOpenKeyW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
LookupPrivilegeValueW

shell32

SHGetSpecialFolderLocation
SHGetFolderPathW
SHFileOperationW
SHCreateDirectoryExW
SHChangeNotify
SHGetPathFromIDListW
ShellExecuteW

ole32

CoSetProxyBlanket
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CLSIDFromString
StringFromGUID2
CoTaskMemFree
CoInitialize
CoUninitialize
CoInitializeEx
CoTaskMemRealloc
CoLoadLibrary
CoFreeLibrary

oleaut32

SysStringLen
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantClear
VariantInit
SysFreeString
GetErrorInfo
VariantChangeType
CreateErrorInfo
SetErrorInfo
VarUI4FromStr

shlwapi

PathFindFileNameW
PathFileExistsW
PathStripPathW
PathIsDirectoryEmptyW
PathRemoveFileSpecW
ord176
PathAppendW
wnsprintfW

comctl32

_TrackMouseEvent

msimg32

TransparentBlt

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

netapi32

NetWkstaTransportEnum
Netbios
NetApiBufferFree

psapi

GetModuleFileNameExW
GetModuleBaseNameW
GetProcessImageFileNameW
EnumProcessModules

wininet

InternetGetCookieExW
InternetGetCookieW
InternetSetCookieW
InternetSetCookieExW

urlmon

URLDownloadToFileW

Exports

Exports

AddToFirewall
AsynDownload
AsynGetAndWriteHardwareInfo
AsynIPControlDownload
ChangeCacheACL
CheckAndRenameFiles
CheckDeleteUserDataFlag
CheckDownload
CheckExclude360
CheckExcludeProcess
CheckIPControlDownload
CheckInstallPath
CheckInstallType
CheckIsWindows10OrGreater
CheckIsWindows7OrGreater
CheckModuleUsing
CheckRunUIFlag
ClearP2PCache
ClearSSOConfig
CreateBitmapCtrl
CreateDiskShortCut
CreatePath
DeleteConnectTypeFile
DeleteDiskShortCut
DeleteInstalledToBrowserCookie
DeleteOldDirectory
DeleteTencentVideoLibraryShortcut
DeleteUserDesktopIcon
Destroy
ExcuteAsExplorer
ExcuteAsParent
ExitQQLiveServiceProcess
FindProcessByName
GetChannelFormIECookie
GetCheckBoxStatus
GetClipboard
GetCommentsInfo
GetFileVersion
GetGrandParentName
GetOSVersion
GetOriginalFilenameInfo
GetParentProcName
GetProtocalVersion
GetQNASCustomFlag
GetQNFCustomFlag
GetQSCMCustomFlag
GetShortCutOfApplicationInDirectory
GetUrlEncode
GetUserGUID
GetUserGUID2
HasUserAborted
InitFirewallInterface
InvokeShellVerb
IsProcRunning
JoinExCommandLine
KillProcByID
KillProcByName
KillProcByNameAndWait
KillProcByNameAndWait2
KillProcByPath
KillProcByPathAndWait
LockIEMainPage
ModifyDirPage
OpenFirewall
OpenFirewallWithoutInit
OpenUrlByDefaultBrowser
ParseCmdLine
PinOrUnpinStartMenuIcon
PinOrUnpinStartScreenIcon
PinOrUnpinTaskBarIcon
PopupTipBesideShortcut
RegMultiSzEdit
RegisterQQLiveProtocal
RemoveFirewall
RemoveFirewallWithoutInit
RemoveFromFirewall
SetCompletionRate
SetCtrlFontTitle
SetIEMainPage
SetInstallPath
SetInstallProgress
Show
ShowMsgBox
SvcUninstall
UnRegisterQQLiveProtocal
UnRegisterQQLiveService
UninitFirewallInterface
UnloadMatrixDriver
Update
UpdateAppData
WordFindHelper
WriteBootAutoRun
WriteConnectTypeFile
WriteConnectTypeFileEx
WriteHardInfoInRegForCheck
WriteInstalledToBrowserCookie
WriteQEACFlag
WriteQNASCustomFlag
WriteQNFCustomFlag
WriteQNMNFlag
WriteQNPSFlag
WriteQSCMCustomFlag
WriteUnistFlag
WriteVerInfo
free_instfilespage_bitmap
getWindow
kill_instfilespage_timer
load_instfilespage_bitmap
start_instfilespage_timer

Sections

.text
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eafd69dcf4113dfd376ee9950d275970

Code Sign

7c:44:3d:7d:bb:05:4e:45:9c:51:3d:66:5d:fa:8d:b7Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

5d:2d:8c:bf:49:c9:09:4c:7e:a9:9e:6a:68:36:5e:32Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

b7:ba:a3:4b:15:eb:5b:3e:4c:d9:23:e4:1f:44:53:9f:0f:62:9c:f9:0f:1e:cf:af:03:28:14:a1:22:42:6b:ddSigner

79:1b:d9:c4:6a:d2:83:4e:6d:3e:74:1c:6b:d8:75:70:34:ad:11:dbSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

netapi32

psapi

wininet

urlmon

Exports

Exports

Sections

.text Size: 800KB - Virtual size: 799KB

.rdata Size: 148KB - Virtual size: 145KB

.data Size: 16KB - Virtual size: 31KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 32KB - Virtual size: 30KB

7c:44:3d:7d:bb:05:4e:45:9c:51:3d:66:5d:fa:8d:b7
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

5d:2d:8c:bf:49:c9:09:4c:7e:a9:9e:6a:68:36:5e:32
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

b7:ba:a3:4b:15:eb:5b:3e:4c:d9:23:e4:1f:44:53:9f:0f:62:9c:f9:0f:1e:cf:af:03:28:14:a1:22:42:6b:dd
Signer

79:1b:d9:c4:6a:d2:83:4e:6d:3e:74:1c:6b:d8:75:70:34:ad:11:db
Signer

.text
Size: 800KB - Virtual size: 799KB

.rdata
Size: 148KB - Virtual size: 145KB

.data
Size: 16KB - Virtual size: 31KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 32KB - Virtual size: 30KB