76f723681827e7165f5e16dd36c2ba4f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76f723681827e7165f5e16dd36c2ba4f_JaffaCakes118
Size

2.5MB
MD5

76f723681827e7165f5e16dd36c2ba4f
SHA1

1aa105dad0a0bd6b7a19f02cbe523672a3e54978
SHA256

051d7696db81928067d620ad476dc7d32de51270a68a40072175ff340239301e
SHA512

227159fce34a7ca783bf290ee8f67db41d88add3924b5261a1f4d9f2818fee2cbe4f71aafe41bd5c3581ce55bf0a05c472b712ea2f99bab1a416e8e1c310a67e
SSDEEP

24576:ISXOYkewQ3IT+4mzVv3/D8QHF2QRh9B4dTkZ+EUPoH5KTcAxt/qvRQdxQxO61kCh:JOY/ns+4mzpB4dTkMAlM8ixQI5C6wn

Score

1^/10

Malware Config

Signatures

Files

76f723681827e7165f5e16dd36c2ba4f_JaffaCakes118
.dll windows:6 windows x64 arch:x64

d4221e73c37baf75f4aee38d107e1f6a

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b8:7a:c8:94:8f:da:8d:43:88:ad:86:db:20:b8:0e:e4
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

06/02/2019, 00:00

Not After

05/02/2021, 23:59

Subject

CN=Luminati Networks,O=Luminati Networks,POSTALCODE=42507,STREET=3 Hamachshev st,L=Netanya,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/08/2013, 20:26

Not After

15/08/2023, 20:36

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:7f:9f:90:c9:55:43:fa:cd:8c:da:63:fb:4f:43:29:92:9f:5b:c3
Signer

Actual PE Digest

9d:7f:9f:90:c9:55:43:fa:cd:8c:da:63:fb:4f:43:29:92:9f:5b:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r_lum\pkg\win\sdk\lum_sdk64.dll.pdb

Imports

advapi32

AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
SetEntriesInAclW
SetNamedSecurityInfoW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

shlwapi

PathRemoveFileSpecW

winhttp

WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpSetStatusCallback
WinHttpReceiveResponse
WinHttpReadData

shell32

CommandLineToArgvW

kernel32

SetEnvironmentVariableA
SetEnvironmentVariableW
SetEndOfFile
HeapSize
GetTimeZoneInformation
CreateFileW
OutputDebugStringW
FreeLibrary
SetConsoleCtrlHandler
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
FindClose
FindFirstFileW
FindNextFileW
SetErrorMode
GetProcAddress
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
GetCommandLineW
GetLastError
GetCurrentThreadId
TerminateThread
GetVersionExW
GetModuleFileNameW
LocalFree
HeapFree
CreateDirectoryW
DeleteFileW
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
HeapReAlloc
GetFileAttributesExW
SetFileAttributesW
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
FileTimeToSystemTime
SetFilePointerEx
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetConsoleCP
GetConsoleMode
RtlUnwindEx
SetLastError
GetCurrentThread
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
CloseHandle
ReadFile
ReadConsoleW
SetStdHandle
DeleteCriticalSection
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
GetModuleHandleW
CreateSemaphoreW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
FatalAppExitA
WriteConsoleW
FlushFileBuffers
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetLocaleInfoW
IsValidLocale

Exports

Exports

?lum_sdk_clear_choice@@YAXXZ
?lum_sdk_get_choice@@YAHXZ
?lum_sdk_get_hwnd@@YA_JXZ
?lum_sdk_init@@YAXPEAD@Z
?lum_sdk_init_autorun@@YAXPEADH@Z
?lum_sdk_init_monitor@@YAXPEAD@Z
?lum_sdk_init_ui@@YAXPEAD@Z
?lum_sdk_init_wait@@YAXPEAD@Z
?lum_sdk_is_supported2@@YAHPEAH@Z
?lum_sdk_is_supported@@YAHXZ
?lum_sdk_run@@YAXXZ
?lum_sdk_run_wait@@YAXXZ
?lum_sdk_set_app_name@@YAXPEAD@Z
?lum_sdk_set_bg_color@@YAXPEAD@Z
?lum_sdk_set_btn_color@@YAXPEAD@Z
?lum_sdk_set_choice_change_cb@@YAXP6AXXZ@Z
?lum_sdk_set_dlg_pos@@YAXNN@Z
?lum_sdk_set_dlg_pos_type@@YAXW4dlg_pos_type_t@@@Z
?lum_sdk_set_dlg_size@@YAXH@Z
?lum_sdk_set_dlg_type@@YAXW4dlg_type_t@@@Z
?lum_sdk_set_logo_link@@YAXPEAD@Z
?lum_sdk_set_not_peer_txt@@YAXW4not_peer_txt_t@@@Z
?lum_sdk_set_parent@@YAX_J@Z
?lum_sdk_set_peer_txt@@YAXW4peer_txt_t@@@Z
?lum_sdk_set_position@@YAXHH@Z
?lum_sdk_set_size@@YAXHH@Z
?lum_sdk_set_style@@YAXH@Z
?lum_sdk_set_tos_link@@YAXPEAD@Z
?lum_sdk_set_txt_color@@YAXPEAD@Z
?lum_sdk_set_txt_culture@@YAXPEAD@Z
?lum_sdk_set_txt_type@@YAXW4txt_type_t@@@Z
?lum_sdk_uninit@@YAXXZ
dotnet45_cleanup
dotnet45_download
dotnet45_init
dotnet45_install_exec
dotnet45_install_res
dotnet45_verify
lum_sdk_check_supported
lum_sdk_clear_choice_c
lum_sdk_get_choice_c
lum_sdk_get_hwnd_c
lum_sdk_init_autorun_c
lum_sdk_init_c
lum_sdk_init_monitor_c
lum_sdk_init_ui_c
lum_sdk_init_wait_c
lum_sdk_is_supported2_c
lum_sdk_is_supported_c
lum_sdk_run_c
lum_sdk_run_wait_c
lum_sdk_set_app_name_c
lum_sdk_set_bg_color_c
lum_sdk_set_btn_color_c
lum_sdk_set_choice_change_cb_c
lum_sdk_set_dlg_pos_c
lum_sdk_set_dlg_pos_type_c
lum_sdk_set_dlg_size_c
lum_sdk_set_dlg_type_c
lum_sdk_set_logo_link_c
lum_sdk_set_not_peer_txt_c
lum_sdk_set_parent_c
lum_sdk_set_peer_txt_c
lum_sdk_set_position_c
lum_sdk_set_size_c
lum_sdk_set_style_c
lum_sdk_set_tos_link_c
lum_sdk_set_txt_color_c
lum_sdk_set_txt_culture_c
lum_sdk_set_txt_type_c
lum_sdk_uninit_c

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4221e73c37baf75f4aee38d107e1f6a

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

b8:7a:c8:94:8f:da:8d:43:88:ad:86:db:20:b8:0e:e4Certificate

Extended Key Usages

Key Usages

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35Certificate

Extended Key Usages

Key Usages

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

9d:7f:9f:90:c9:55:43:fa:cd:8c:da:63:fb:4f:43:29:92:9f:5b:c3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shlwapi

winhttp

shell32

kernel32

Exports

Exports

Sections

.text Size: 169KB - Virtual size: 169KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 6KB - Virtual size: 17KB

.pdata Size: 9KB - Virtual size: 9KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 2KB - Virtual size: 1KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

b8:7a:c8:94:8f:da:8d:43:88:ad:86:db:20:b8:0e:e4
Certificate

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35
Certificate

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

9d:7f:9f:90:c9:55:43:fa:cd:8c:da:63:fb:4f:43:29:92:9f:5b:c3
Signer

.text
Size: 169KB - Virtual size: 169KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 6KB - Virtual size: 17KB

.pdata
Size: 9KB - Virtual size: 9KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 2KB - Virtual size: 1KB