7852f9657b47109c9dd8d10441956826_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7852f9657b47109c9dd8d10441956826_JaffaCakes118
Size

1.9MB
MD5

7852f9657b47109c9dd8d10441956826
SHA1

0333bf7f88a40b76103a5961aa8bbe3872eb6810
SHA256

e967c67216537b0e3baae72036bac0b7d70262c3fac8fb4b157f22ff18ddc0fa
SHA512

33dc24fd50c6fe3dc7d8e16229d16da2c6cf4bd5919f456e2a5a12de996acc05e7baab9ee30330c887c130edbbf1b925987f9df9ae1973a83a7f330c35f44640
SSDEEP

49152:FFp2PXoT0PulwzzzzzrR2ECTAziqxWrbzzzzzkzzzzz2O:Hp2Po0BzzzzzrpCTNrbzzzzzkzzzzzB

Score

1^/10

Malware Config

Signatures

Files

7852f9657b47109c9dd8d10441956826_JaffaCakes118
.dll windows:4 windows x86 arch:x86

efb336b578483064656b2b5aad4f4653

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

09/06/2015, 00:00

Not After

07/09/2018, 23:59

Subject

CN=Beijing Rising Information Technology Corporation Limited,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:80:02:ca:f3:61:6b:ee:ee:4c:04:5b:d6:99:78:d7
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31/12/2015, 00:00

Not After

07/09/2018, 23:59

Subject

CN=Beijing Rising Information Technology Corporation Limited,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:21:16:c0:09:98:dc:c6:8f:a2:7d:25:c3:86:36:a8:83:bb
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:e7:bb:2a:b4:c5:85:f0:be:cd:4e:7d:58:ef:0c:07:9f:20:1e:51:f4:bb:e3:fd:8c:d1:dd:0c:1d:5f:4e:c2
Signer

Actual PE Digest

3a:e7:bb:2a:b4:c5:85:f0:be:cd:4e:7d:58:ef:0c:07:9f:20:1e:51:f4:bb:e3:fd:8c:d1:dd:0c:1d:5f:4e:c2

Digest Algorithm

sha256

PE Digest Matches

true

29:4a:08:31:ce:05:56:11:bb:07:ea:48:96:8d:0f:e5:db:d2:8f:f5
Signer

Actual PE Digest

29:4a:08:31:ce:05:56:11:bb:07:ea:48:96:8d:0f:e5:db:d2:8f:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\DistributedAutoLink\Temp\CompileOutputDir\RapSetup.pdb

Imports

kernel32

WideCharToMultiByte
lstrlenW
lstrlenA
WritePrivateProfileStringA
lstrcmpiA
GetModuleHandleA
CreateDirectoryA
lstrcpynA
SetLastError
InterlockedIncrement
MoveFileA
FlushFileBuffers
WriteFile
SetEndOfFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
DeleteFileA
SetFileAttributesA
FileTimeToSystemTime
FindClose
FindFirstFileA
lstrcatA
lstrcpyA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetFileSize
GetFileAttributesA
OutputDebugStringA
GetTickCount
MultiByteToWideChar
GetSystemTimeAsFileTime
CreateEventA
CreateSemaphoreA
ReleaseSemaphore
GetVersion
ReleaseMutex
WaitForSingleObject
CreateMutexA
lstrcmpA
VirtualProtect
lstrcmpiW
FindNextFileA
GetExitCodeProcess
CreateProcessA
GetStartupInfoA
GetSystemInfo
SetEvent
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
CompareStringA
CompareStringW
GetWindowsDirectoryA
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetThreadLocale
GetCommandLineA
ExitProcess
SetCurrentDirectoryA
GetCurrentDirectoryA
GetShortPathNameA
GetTempPathA
OpenMutexA
MoveFileExA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
ReadFile
CopyFileA
WaitForMultipleObjects
OpenEventA
LoadLibraryW
InterlockedCompareExchange
EnterCriticalSection
LeaveCriticalSection
AreFileApisANSI
UnlockFile
LockFile
GetFileAttributesW
DeleteFileW
QueryPerformanceCounter
GetSystemTime
LockFileEx
GetTempPathW
FormatMessageA
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
RemoveDirectoryA
HeapAlloc
RtlUnwind
SetEnvironmentVariableA
GetLocaleInfoW
SetConsoleCtrlHandler
SetStdHandle
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
IsBadCodePtr
IsBadReadPtr
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
VirtualAlloc
FreeEnvironmentStringsA
GetFileType
GetStdHandle
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
GetModuleFileNameA
GetLocalTime
CreateFileA
SuspendThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetUnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSection
RaiseException
InterlockedDecrement
LoadLibraryA
GetProcAddress
FreeLibrary
GetLastError
LocalFree
LocalAlloc
CreateFileW
DeviceIoControl
CloseHandle
Sleep
GetStringTypeExW
CreateThread
SetHandleCount
GetDriveTypeA
GetTimeZoneInformation
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
IsBadWritePtr
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
TlsGetValue
VirtualQuery
HeapReAlloc
GetOEMCP
GetCPInfo
TlsAlloc
GetCurrentThread
TlsFree
TlsSetValue
HeapFree

user32

CharLowerA
CharUpperW
GetSystemMetrics
EnumChildWindows
GetDlgCtrlID
GetClassNameA
SetWindowTextA
FindWindowA
CharUpperA
SendMessageA
CharNextA
LoadStringA
IsWindow
MessageBoxA
SystemParametersInfoA
PostQuitMessage
wsprintfA
UnregisterClassA
CharLowerBuffW
CharLowerBuffA
CharLowerW

advapi32

RegEnumValueA
RegOpenCurrentUser
RegCreateKeyExA
RegRestoreKeyA
RegSaveKeyA
RegEnumKeyA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA

shell32

ShellExecuteA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteExA

ole32

CoTaskMemFree
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoInitialize
CoSetProxyBlanket
CoCreateInstance
CoTaskMemAlloc

oleaut32

SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
VarBstrCat
SysStringLen
SysAllocStringLen
VariantInit
VariantClear
SysFreeString
SysAllocString
CreateErrorInfo
GetErrorInfo
SetErrorInfo
SafeArrayDestroy

ws2_32

ntohl

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

shlwapi

PathRemoveExtensionA
PathFileExistsA
PathMakeSystemFolderA
StrStrIA
PathSkipRootA
PathRemoveFileSpecA

wininet

InternetOpenA
InternetSetOptionA
InternetReadFile
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetCloseHandle
InternetAttemptConnect
InternetCrackUrlA
HttpQueryInfoA
HttpSendRequestA

rpcrt4

UuidCreate

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

CreateInstance

Sections

.text
Size: 856KB - Virtual size: 855KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 876KB - Virtual size: 874KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

efb336b578483064656b2b5aad4f4653

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2dCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

48:80:02:ca:f3:61:6b:ee:ee:4c:04:5b:d6:99:78:d7Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

11:21:16:c0:09:98:dc:c6:8f:a2:7d:25:c3:86:36:a8:83:bbCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

3a:e7:bb:2a:b4:c5:85:f0:be:cd:4e:7d:58:ef:0c:07:9f:20:1e:51:f4:bb:e3:fd:8c:d1:dd:0c:1d:5f:4e:c2Signer

29:4a:08:31:ce:05:56:11:bb:07:ea:48:96:8d:0f:e5:db:d2:8f:f5Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

setupapi

shlwapi

wininet

rpcrt4

iphlpapi

version

Exports

Exports

Sections

.text Size: 856KB - Virtual size: 855KB

.rdata Size: 116KB - Virtual size: 115KB

.data Size: 20KB - Virtual size: 24KB

.rsrc Size: 876KB - Virtual size: 874KB

.reloc Size: 40KB - Virtual size: 39KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

32:2a:78:ca:b1:00:b4:b6:d9:a0:cc:66:c1:6b:80:2d
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

48:80:02:ca:f3:61:6b:ee:ee:4c:04:5b:d6:99:78:d7
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

11:21:16:c0:09:98:dc:c6:8f:a2:7d:25:c3:86:36:a8:83:bb
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

3a:e7:bb:2a:b4:c5:85:f0:be:cd:4e:7d:58:ef:0c:07:9f:20:1e:51:f4:bb:e3:fd:8c:d1:dd:0c:1d:5f:4e:c2
Signer

29:4a:08:31:ce:05:56:11:bb:07:ea:48:96:8d:0f:e5:db:d2:8f:f5
Signer

.text
Size: 856KB - Virtual size: 855KB

.rdata
Size: 116KB - Virtual size: 115KB

.data
Size: 20KB - Virtual size: 24KB

.rsrc
Size: 876KB - Virtual size: 874KB

.reloc
Size: 40KB - Virtual size: 39KB