777fff98770694aa58eed4927b6b4579_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

777fff98770694aa58eed4927b6b4579_JaffaCakes118
Size

8.5MB
MD5

777fff98770694aa58eed4927b6b4579
SHA1

21e86b8519c9cb919c558262f9ed40ffa5d3df28
SHA256

beeda18a38c484c5dc34f24cc1fa6ad953093888b6ca66bf904a7ad939445e3b
SHA512

be23b80c16a77ffecf637822ddfa64926594365b620b813eb8cc191c2795e011167e840ea2ed6f1758c3c06329ca25792d1170a5b2a65540de4013c9b063a721
SSDEEP

98304:dV9n6JTDyHqSnG7kZy6Gu0Z06H/uf+flX95MlLwxcBGJDgB:ZnOXyuqy6GTZ06HGWhvbxo0Dy

Score

1^/10

Malware Config

Signatures

Files

777fff98770694aa58eed4927b6b4579_JaffaCakes118
.exe windows:5 windows x86 arch:x86

155a74a731dc0facbc71d47a766e41e1

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-08-2015 00:00

Not After

26-09-2017 23:59

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SGTool.pdb

Imports

imm32

ImmGetIMEFileNameW
ImmDisableIME
ImmDestroyContext
ImmAssociateContext
ImmGetHotKey
ImmInstallIMEW
ImmSetHotKey

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

InternetOpenW
InternetOpenUrlW
InternetErrorDlg
HttpAddRequestHeadersW
InternetReadFile
InternetQueryOptionW
InternetSetOptionW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetWriteFile
InternetConnectA
HttpSendRequestExW
HttpEndRequestW
HttpOpenRequestA
InternetCrackUrlA
InternetCloseHandle
InternetQueryDataAvailable
InternetCanonicalizeUrlW
InternetSetCookieW
InternetGetConnectedState

kernel32

GetExitCodeThread
WaitForSingleObjectEx
GlobalAddAtomW
LoadLibraryA
GetSystemDirectoryA
GetLocaleInfoW
lstrcmpW
EnumSystemLocalesW
MoveFileExW
WriteProfileStringW
GetACP
SetWaitableTimer
RaiseException
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
LocalFree
GetTempPathW
CloseHandle
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
Process32NextW
SuspendThread
GetThreadContext
SetThreadContext
SetEnvironmentVariableA
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
LCMapStringA
GetCurrentDirectoryA
GetFullPathNameA
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
HeapCreate
GetDriveTypeW
GetFileInformationByHandle
GetDateFormatA
GetTimeFormatA
GetFullPathNameW
GetCPInfo
FindFirstFileA
GetDriveTypeA
ExitProcess
UnhandledExceptionFilter
RtlUnwind
HeapSize
HeapDestroy
IsProcessorFeaturePresent
SwitchToThread
GetModuleHandleA
WriteFileEx
ReadFileEx
DisconnectNamedPipe
GetOverlappedResult
WaitForMultipleObjectsEx
CreateNamedPipeW
ConnectNamedPipe
GetWindowsDirectoryW
OpenFileMappingA
CreateFileMappingA
GlobalReAlloc
GetWindowsDirectoryA
CompareStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GlobalHandle
IsDebuggerPresent
lstrcatW
VirtualQuery
TlsFree
TlsAlloc
FlushFileBuffers
GetFileAttributesExW
QueryDosDeviceW
GetLogicalDriveStringsW
GetProcessId
CreateProcessW
DuplicateHandle
FormatMessageW
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
GetFileAttributesW
CopyFileA
lstrcatA
lstrcpyA
DeviceIoControl
LocalAlloc
RemoveDirectoryW
CreateDirectoryW
SetFileTime
GetFileTime
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleFileNameA
CreateFileMappingW
IsBadReadPtr
ExitThread
GetSystemTimeAsFileTime
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
MoveFileW
SetNamedPipeHandleState
WaitNamedPipeW
CreateIoCompletionPort
TransactNamedPipe
GetQueuedCompletionStatus
LCMapStringW
Process32FirstW
GetCurrentProcessId
TerminateProcess
OpenProcess
GetSystemDirectoryW
GlobalFree
GlobalAlloc
GetCommandLineW
GetCurrentThreadId
GetFileSize
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryW
ResetEvent
SetEvent
WaitForSingleObject
CreateEventW
OpenEventW
GlobalLock
GlobalUnlock
SetEndOfFile
MulDiv
WaitForMultipleObjects
GetSystemInfo
GetExitCodeProcess
SetFilePointer
FindResourceExW
GlobalMemoryStatusEx
GetTimeZoneInformation
SetUnhandledExceptionFilter
lstrcpyW
lstrcpynW
lstrcpynA
ResumeThread
HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree
SetFileAttributesW
CopyFileW
GetSystemDefaultLangID
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateMutexW
InterlockedExchange
InterlockedCompareExchange
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
CreateThread
TerminateThread
GetTickCount
OpenMutexW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
LockResource
GetVersionExW
GetCurrentThread
GetStartupInfoW
WideCharToMultiByte
GetStdHandle
SetFilePointerEx
ReadFile
WriteFile
GetFileType
GetFileSizeEx
CreateFileA
GetLocalTime
SystemTimeToFileTime
FormatMessageA
SetLastError
FlushInstructionCache
lstrlenA
OutputDebugStringW
DebugBreak
Sleep

user32

CloseClipboard
RemoveMenu
GetSystemMenu
EndDialog
GetDlgItem
DialogBoxParamW
GetKeyboardLayoutList
UnloadKeyboardLayout
DestroyWindow
DrawTextW
PostQuitMessage
InvalidateRect
SetWindowLongW
UnregisterHotKey
ShowWindow
EndPaint
BeginPaint
DefWindowProcW
LoadIconW
LoadCursorW
UnregisterClassA
EnumWindows
GetScrollInfo
SetScrollInfo
AdjustWindowRectEx
LoadKeyboardLayoutW
GetMenuItemID
MenuItemFromPoint
GetMenuItemRect
GetCursor
mouse_event
MsgWaitForMultipleObjectsEx
IsCharAlphaNumericW
GetLastInputInfo
WindowFromPoint
wsprintfA
SetWindowTextW
UpdateLayeredWindow
IsDlgButtonChecked
SetTimer
SetFocus
SendMessageW
SendInput
OpenClipboard
EmptyClipboard
CharNextW
MessageBoxW
ActivateKeyboardLayout
RegisterClassExW
SetWindowPos
RegisterHotKey
ExitWindowsEx
RegisterClipboardFormatW
SetClipboardData
CloseWindow
BringWindowToTop
CreateWindowExW
GetWindowTextLengthW
SetCursorPos
SetPropW
IsIconic
keybd_event
VkKeyScanW
UnhookWindowsHookEx
UnregisterClassW
GetAsyncKeyState
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ClipCursor
DestroyCursor
SystemParametersInfoW
LoadMenuW
LoadAcceleratorsW
wsprintfW
CharLowerW
MessageBeep
TrackPopupMenuEx
GetMenuItemCount
LoadStringA
SetMenuDefaultItem
GetMenuItemInfoW
DrawIcon
TranslateAcceleratorW
LoadBitmapW
GetClassInfoExW
LoadStringW
TrackMouseEvent
CallWindowProcW
CheckDlgButton
GetWindowDC
ScrollWindow
GetPropW
NotifyWinEvent
SendMessageTimeoutW
EnumThreadWindows
GetWindowTextW
IsWindowEnabled
CreatePopupMenu
AppendMenuW
SetMenuItemInfoW
DestroyMenu
InflateRect
FillRect
EnumChildWindows
RedrawWindow
SetCursor
AttachThreadInput
GetKeyState
PostThreadMessageW
GetClassLongW
SetClassLongW
MonitorFromRect
IntersectRect
SubtractRect
ScreenToClient
PtInRect
SetLayeredWindowAttributes
DestroyIcon
GetDesktopWindow
GetWindowThreadProcessId
SetWindowRgn
GetClassNameW
OffsetRect
GetCursorPos
RegisterWindowMessageW
ClientToScreen
SetCapture
ReleaseCapture
MoveWindow
SetRect
GetDC
ReleaseDC
GetForegroundWindow
SetForegroundWindow
IsRectEmpty
MonitorFromPoint
CopyRect
SetRectEmpty
CreateDialogParamW
IsDialogMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetSystemMetrics
LoadImageW
FindWindowExW
wvsprintfW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
IsWindow
KillTimer
IsWindowVisible
GetWindowRect
GetWindowLongW
GetClientRect
GetFocus
PostMessageW
EnableWindow
FindWindowW

gdi32

CreateFontIndirectW
GetTextExtentPointW
CreateDIBSection
SetTextCharacterExtra
GetFontData
StretchDIBits
SetViewportOrgEx
CreateRectRgn
CombineRgn
CreatePolygonRgn
EnumFontFamiliesExW
OffsetRgn
RestoreDC
FillPath
EndPath
SaveDC
AngleArc
BeginPath
SelectClipRgn
GetClipRgn
GetCharABCWidthsFloatW
ExtCreateRegion
GetObjectW
DeleteObject
Rectangle
CreatePen
SelectObject
CreateSolidBrush
GetStockObject
SetBkMode
SetTextColor
CreateCompatibleDC
DeleteDC
GetDeviceCaps
RemoveFontResourceW
AddFontResourceW
SetStretchBltMode
StretchBlt
SetPixel
CreateDCW
GetPixel
GetFontUnicodeRanges
GetTextMetricsW
DPtoLP
SetMapMode
GetTextExtentExPointW
GetTextExtentPoint32W
MoveToEx
LineTo
CreateCompatibleBitmap
BitBlt

comdlg32

GetOpenFileNameW
ChooseColorW
GetSaveFileNameW

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorSacl
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
CryptGetKeyParam
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
OpenProcessToken
RegQueryValueExW
RegFlushKey
ConvertSidToStringSidW
LookupAccountNameW
RegEnumKeyW
RegEnumValueW
RegUnLoadKeyW
RegOpenKeyW
RegLoadKeyW
RegCreateKeyW
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHFileOperationW
ShellExecuteExW
ShellExecuteW
ExtractIconW
SHChangeNotify
CommandLineToArgvW

ole32

OleSetContainedObject
CreateStreamOnHGlobal
CoInitializeEx
CoInitializeSecurity
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleCreate

oleaut32

SysStringByteLen
VarUI4FromStr
SysStringLen
SysAllocString
VariantInit
SysFreeString
SysAllocStringByteLen
VariantChangeType
VariantClear
VariantCopy

ws2_32

inet_addr
inet_ntoa
gethostname
WSAGetLastError
connect
socket
sendto
recvfrom
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSASetLastError
setsockopt
closesocket
recv
send
getsockname
bind
getsockopt
gethostbyname
accept
listen
__WSAFDIsSet
select
ioctlsocket
getpeername
shutdown
WSACleanup
WSAStartup

wldap32

ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46
ord22

psapi

GetModuleInformation
GetModuleFileNameExW
GetProcessMemoryInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

StrStrIW
wnsprintfA
SHDeleteKeyW
StrCSpnW
StrToIntW
PathFileExistsW
StrCmpIW

msimg32

GradientFill
TransparentBlt
AlphaBlend

oleacc

LresultFromObject
AccessibleObjectFromWindow

Sections

.text
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 330KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 395KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

155a74a731dc0facbc71d47a766e41e1

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

wtsapi32

comctl32

userenv

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

wldap32

psapi

version

shlwapi

msimg32

oleacc

Sections

.text Size: 5.4MB - Virtual size: 5.4MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 330KB - Virtual size: 1.3MB

.rsrc Size: 1.0MB - Virtual size: 1.0MB

.reloc Size: 395KB - Virtual size: 395KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 5.4MB - Virtual size: 5.4MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 330KB - Virtual size: 1.3MB

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

.reloc
Size: 395KB - Virtual size: 395KB