884d439df383f7780cd9793e81c6b245_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

884d439df383f7780cd9793e81c6b245_JaffaCakes118
Size

4.9MB
MD5

884d439df383f7780cd9793e81c6b245
SHA1

de4658097a59ca7db7e234d4140741f8cd8ba9f9
SHA256

af00e6ab10de72b3c81ec79ee999ebf2af8e7d01105856ecc6ce0e1da53a9f06
SHA512

9b6952906b7daf90bedb572b0f8eb619f5e45655e9308faeecb0230ebc835380bf9b4f570619679a1d7bc7c462e2b629b623fb49106efecff9f2fcedd2d30eb0
SSDEEP

98304:/ntm2k4QTYEusna8E/yEPGOWij1yRjdwLwQjrPCpiWHCeHhPd8GK2:/ntZ5VEujqoD1yZdwLLjraIWHJZd8GH

Score

1^/10

Malware Config

Signatures

Files

884d439df383f7780cd9793e81c6b245_JaffaCakes118
.gz
kernel.dll
.dll windows:6 windows x86 arch:x86

a4706038220250eb1d407023333ba241

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/03/2016, 00:00

Not After

16/03/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:f1:9a:19:7f:79:a4:2c:76:8f:0f:54
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2019, 10:15

Not After

15/11/2022, 09:38

Subject

CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:87:3f:8a:a3:03:35:4b:51:78:90:4a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

14/11/2019, 12:05

Not After

14/11/2022, 12:05

Subject

CN=Beijing Baidu Netcom Science and Technology Co.\,Ltd,O=Beijing Baidu Netcom Science and Technology Co.\,Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e0:70:0d:df:4f:74:c4:b6:1c:8e:19:d5:ef:48:a3:1f:55:bf:c8:4b:ba:2c:df:98:08:da:c6:3e:34:52:29:69
Signer

Actual PE Digest

e0:70:0d:df:4f:74:c4:b6:1c:8e:19:d5:ef:48:a3:1f:55:bf:c8:4b:ba:2c:df:98:08:da:c6:3e:34:52:29:69

Digest Algorithm

sha256

PE Digest Matches

true

19:9b:cf:f3:ea:9b:79:8b:5d:33:28:a5:d9:5e:74:d6:f9:22:57:a3
Signer

Actual PE Digest

19:9b:cf:f3:ea:9b:79:8b:5d:33:28:a5:d9:5e:74:d6:f9:22:57:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

iphlpapi

NotifyAddrChange

kernel32

GetVersionExW
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

GetProcessWindowStation
CharUpperBuffW

advapi32

CryptGenRandom
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

SHGetFolderPathA

ws2_32

htons

sensapi

IsNetworkAlive

shlwapi

PathRemoveFileSpecW

mswsock

AcceptEx

wtsapi32

WTSSendMessageW

Exports

Exports

GetParam
SetParam
SetSpeepLimit
SetTrySpeedup
SyncGetParam
SyncSetParam
add_rapid_upload_file
control_task
create_p2sp_task
create_p2sp_task2
get_p2p_httpserver_port
get_sdk_version
get_tasks_info
set_p2p_file
yunp2p_init
yunp2p_unit

Sections

.text
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 875KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 29B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4706038220250eb1d407023333ba241

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

19:f1:9a:19:7f:79:a4:2c:76:8f:0f:54Certificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

76:87:3f:8a:a3:03:35:4b:51:78:90:4aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

e0:70:0d:df:4f:74:c4:b6:1c:8e:19:d5:ef:48:a3:1f:55:bf:c8:4b:ba:2c:df:98:08:da:c6:3e:34:52:29:69Signer

19:9b:cf:f3:ea:9b:79:8b:5d:33:28:a5:d9:5e:74:d6:f9:22:57:a3Signer

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

kernel32

user32

advapi32

shell32

ws2_32

sensapi

shlwapi

mswsock

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 4.7MB

.rdata Size: - Virtual size: 875KB

.data Size: - Virtual size: 182KB

.tls Size: 512B - Virtual size: 29B

.gfids Size: - Virtual size: 4KB

.vmp0 Size: - Virtual size: 3.8MB

.vmp1 Size: 5.0MB - Virtual size: 5.0MB

.reloc Size: 512B - Virtual size: 264B

.rsrc Size: 1KB - Virtual size: 1KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

19:f1:9a:19:7f:79:a4:2c:76:8f:0f:54
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

76:87:3f:8a:a3:03:35:4b:51:78:90:4a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

e0:70:0d:df:4f:74:c4:b6:1c:8e:19:d5:ef:48:a3:1f:55:bf:c8:4b:ba:2c:df:98:08:da:c6:3e:34:52:29:69
Signer

19:9b:cf:f3:ea:9b:79:8b:5d:33:28:a5:d9:5e:74:d6:f9:22:57:a3
Signer

.text
Size: - Virtual size: 4.7MB

.rdata
Size: - Virtual size: 875KB

.data
Size: - Virtual size: 182KB

.tls
Size: 512B - Virtual size: 29B

.gfids
Size: - Virtual size: 4KB

.vmp0
Size: - Virtual size: 3.8MB

.vmp1
Size: 5.0MB - Virtual size: 5.0MB

.reloc
Size: 512B - Virtual size: 264B

.rsrc
Size: 1KB - Virtual size: 1KB