8bf403152d79ac75f5e3388be1fcddbd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
8bf403152d79ac75f5e3388be1fcddbd_JaffaCakes118
Size 1.8MB
Sample240601-12y1tsha89
SHA256 7595c1888f316cc1a12ff50a0b6e74a15ba4fb4772c567d005722d0d0e00d5fa
MD5 8bf403152d79ac75f5e3388be1fcddbd
SHA1 db50d8b2f01919c591cc61ee57a437ea7a352508
SHA512 18f6814df2a4d9e12e035b835147cb9e22282512fe5a37e605227e840dd565978ac006457f5f5d5e99384bdb6722ff4f3be500a756095aa58005b15f7e34f318
SSDEEP 49152:gwKkhgxIUNXH3OCd8wPc24TaidQTkMUE0:gwKkhydMV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

8bf403152d79ac75f5e3388be1fcddbd_JaffaCakes118

.dll 1.8MB

8bf403152d79ac75f5e3388be1fcddbd_JaffaCakes118

IMPHASH 91e520d770d97bc950eca0d411f7bc2c
SHA256 7595c1888f316cc1a12ff50a0b6e74a15ba4fb4772c567d005722d0d0e00d5fa
MD5 8bf403152d79ac75f5e3388be1fcddbd
SHA1 db50d8b2f01919c591cc61ee57a437ea7a352508
SHA512 18f6814df2a4d9e12e035b835147cb9e22282512fe5a37e605227e840dd565978ac006457f5f5d5e99384bdb6722ff4f3be500a756095aa58005b15f7e34f318
SSDEEP 49152:gwKkhgxIUNXH3OCd8wPc24TaidQTkMUE0:gwKkhydMV
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

Digest

62:75:88:5c:63:26:b0:a8:89:b7:a9:68:69:bb:82:4e:b7:f0:4f:3d:f8:5f:c7:a6:e5:77:ea:e9:c0:43:7b:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Sep 9, 2019

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

ab:35:61:6b:62:4b:cf:9e:35:6b:ab:98:3f:d2:d6:9f:c0:22:c3:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Sep 9, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

968604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\vmagent_new\bin\joblist\378635\out\Release\safemon64.pdb

kernel32

FindResourceA LoadResource SizeofResource IsDBCSLeadByte LoadLibraryExA GetCommandLineW GetComputerNameW GetTempPathW CreateDirectoryA SetEndOfFile VirtualQuery IsDebuggerPresent GetSystemDirectoryA lstrcpyA GetModuleFileNameW GetProcessId GetThreadId GetThreadContext MapViewOfFile UnmapViewOfFile QueryFullProcessImageNameA DuplicateHandle IsBadStringPtrW LoadLibraryW VirtualQueryEx QueryDosDeviceW GetFileSizeEx GetPrivateProfileSectionA CreateEventA SetEvent WaitForMultipleObjects VirtualFree VirtualAlloc lstrcpynW lstrcmpA FreeResource GlobalAlloc GlobalLock LockResource GlobalUnlock MulDiv lstrcmpW ResetEvent OpenFileMappingA GetProcessHeap HeapFree HeapAlloc GlobalSize CreateEventW CreateFileW GetTickCount SetLastError FlushInstructionCache GetCurrentProcess GetCurrentThreadId lstrcmpiW CreateThread RaiseException lstrcmpiA WriteFile GetFileSize ReadFile CreateFileA GetPrivateProfileIntA GetLastError Thread32First SetThreadContext GetVersionExW GetPrivateProfileIntW IsBadWritePtr ResumeThread SuspendThread GetThreadPriority VirtualProtectEx SetThreadPriority SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoW InitializeCriticalSectionAndSpinCount IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetTimeZoneInformation GetStringTypeW GetStringTypeA IsValidCodePage GetOEMCP GetACP HeapDestroy HeapCreate HeapSetInformation GetStdHandle ExitProcess HeapSize FlsAlloc GetCurrentThread FlsFree FlsGetValue DecodePointer EncodePointer GetCPInfo LCMapStringW LCMapStringA RtlUnwindEx RtlPcToFileHeader GetCommandLineA FlsSetValue HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess ReleaseMutex HeapWalk HeapLock GetStartupInfoW VirtualProtect WaitForSingleObject CreateRemoteThread OutputDebugStringW GetModuleFileNameA ReadProcessMemory OpenProcess GetSystemInfo GetPrivateProfileStringA SetFilePointer GetVersionExA LocalAlloc LoadLibraryA FreeLibrary Sleep GetSystemDirectoryW LocalFree GetLongPathNameW CreateToolhelp32Snapshot SearchPathW CloseHandle GetCurrentProcessId GetPrivateProfileStringW WideCharToMultiByte lstrlenW lstrcpynA OutputDebugStringA DebugBreak GetModuleHandleA IsBadReadPtr GetModuleHandleW TlsGetValue TlsFree InitializeCriticalSection TlsAlloc TlsSetValue GetProcAddress MultiByteToWideChar lstrlenA EnterCriticalSection LeaveCriticalSection OpenThread HeapUnlock CreateMutexW GetSystemTime FormatMessageW SetFilePointerEx LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime GetModuleHandleExW DeviceIoControl InterlockedPopEntrySList InterlockedPushEntrySList DeleteCriticalSection Thread32Next

user32

GetWindowLongA InvalidateRect SetTimer IsWindowEnabled RegisterClassExA DestroyWindow ShowWindow KillTimer SetWindowPos SetWindowLongA GetMessageA TranslateMessage DispatchMessageA DefWindowProcA RegisterClassA CreateWindowExA MoveWindow GetClientRect GetParent LoadStringA CallWindowProcA GetClassNameW FindWindowA EnumChildWindows IsWindow SetWindowLongPtrA GetWindowRect SetRect LoadBitmapA UnhookWinEvent GetWindowLongPtrA EndPaint BeginPaint LoadCursorA SetWinEventHook GetClassNameA GetWindowTextA CharNextA GetClassInfoExA SendMessageA CreateWindowExW RegisterClassW PostQuitMessage FindWindowW RegisterWindowMessageA GetWindowTextLengthA SetWindowTextA GetFocus SetFocus GetDlgItem GetSysColor RedrawWindow CreateAcceleratorTableA ClientToScreen SetCapture ReleaseCapture FillRect InvalidateRgn DestroyAcceleratorTable SendMessageTimeoutW GetWindow IsRectEmpty IsWindowVisible GetDesktopWindow SetCursor PtInRect ScreenToClient DrawTextW InflateRect SetWindowRgn IsChild EndDialog DialogBoxParamA PeekMessageA UnregisterClassA GetCursorPos GetSystemMetrics GetWindowTextW FindWindowExW PostMessageA SendMessageTimeoutA LoadImageA wsprintfW wsprintfA ReleaseDC GetDC

gdi32

CombineRgn CreatePolygonRgn CreateRectRgn CreateFontIndirectA LineTo MoveToEx SetTextColor GetStockObject CreateDIBSection SetStretchBltMode CreatePen GetDeviceCaps BitBlt CreateCompatibleBitmap SetViewportOrgEx ExtTextOutA SetBkColor StretchBlt SetBkMode DeleteDC GetObjectA SelectObject CreateCompatibleDC DeleteObject CreateSolidBrush

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW IsValidSid SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl InitializeSecurityDescriptor SetSecurityInfo GetSecurityDescriptorSacl RegQueryValueExA RegQueryValueExW RegOpenKeyExW ConvertSidToStringSidA LookupAccountNameW RegDeleteValueA RegQueryInfoKeyA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegSetValueExA RegCloseKey RegOpenKeyW OpenProcessToken RegEnumKeyExW GetTokenInformation ConvertSidToStringSidW

shell32

SHGetSpecialFolderPathA ShellExecuteW SHGetPathFromIDListW CommandLineToArgvW SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetFolderPathW

ole32

CoCreateInstance StringFromCLSID CoUninitialize CoTaskMemFree CoTaskMemAlloc CoInitialize GetHGlobalFromStream OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning OleUninitialize CreateStreamOnHGlobal StringFromGUID2 CoTaskMemRealloc OleRun

oleaut32

GetErrorInfo VariantClear VariantInit SysFreeString DispCallFunc SysStringLen LoadTypeLi VarUI4FromStr LoadRegTypeLi SysAllocString SysStringByteLen SysAllocStringByteLen UnRegisterTypeLi OleCreateFontIndirect SysAllocStringLen

shlwapi

SHGetValueW StrCmpNIA PathFindFileNameA PathRemoveFileSpecA StrChrA UrlGetPartA PathGetArgsW PathFindExtensionW PathMatchSpecW PathAppendA StrCmpNW PathUnquoteSpacesA StrStrW StrToIntExW SHSetValueW UrlGetPartW SHSetValueA SHDeleteKeyA UrlUnescapeA PathRemoveExtensionA PathRemoveExtensionW wnsprintfW StrDupA StrDupW StrChrW StrCmpW PathFileExistsA PathFileExistsW PathAppendW PathCombineW StrStrIA StrStrIW StrCpyNW StrCmpNIW StrCmpIW PathFindFileNameW PathCombineA StrTrimA SHGetValueA

oleacc

AccessibleObjectFromPoint AccessibleObjectFromEvent

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

getpeername ntohl WSAGetLastError

imagehlp

ImageNtHeader ImageDirectoryEntryToDataEx ImageDirectoryEntryToData

psapi

GetModuleInformation

netapi32

NetApiBufferFree NetWkstaUserGetInfo

DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer IsTraystupidRealRunning cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc safemon_115 safemoninit

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

329KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

216KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.share

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8bf403152d79ac75f5e3388be1fcddbd_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

oleacc

version

ws2_32

imagehlp

psapi

netapi32

generic