8a42e836131fa2ba1fd7b3d6f66f053d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
8a42e836131fa2ba1fd7b3d6f66f053d_JaffaCakes118
Size 4.1MB
Sample240601-m2fycsae5w
SHA256 0f26bd9872ac6d503ac68a65b344a34011782938689bd72d82b2ce3def0a21be
MD5 8a42e836131fa2ba1fd7b3d6f66f053d
SHA1 eefc7e72763cf3202f17f47faae59373210814c0
SHA512 370d14135f7b25fb52329bad1bd6714f3295aa0ce92f2fe998b9a7133b57b3da44088d8769a01d00cc60a6381a029b3c38b54b0a033f01040e613be5c1b66306
SSDEEP 98304:3p6dtD707IBWLC59hNFno7VnZQ6P7qBSgTWJQ1anJG:It70eWuno5OEg6i6JG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

8a42e836131fa2ba1fd7b3d6f66f053d_JaffaCakes118

.exe 4.1MB

8a42e836131fa2ba1fd7b3d6f66f053d_JaffaCakes118

IMPHASH a50bec68e419bb4916bc0822aa974c91
SHA256 0f26bd9872ac6d503ac68a65b344a34011782938689bd72d82b2ce3def0a21be
MD5 8a42e836131fa2ba1fd7b3d6f66f053d
SHA1 eefc7e72763cf3202f17f47faae59373210814c0
SHA512 370d14135f7b25fb52329bad1bd6714f3295aa0ce92f2fe998b9a7133b57b3da44088d8769a01d00cc60a6381a029b3c38b54b0a033f01040e613be5c1b66306
SSDEEP 98304:3p6dtD707IBWLC59hNFno7VnZQ6P7qBSgTWJQ1anJG:It70eWuno5OEg6i6JG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

ec:38:37:c8:81:bd:7c:d6:5d:5b:7e:fd:18:1f:5b:6b:ab:75:bb:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Sogou Information Service Co.\, Ltd.,OU=Search business Division,O=Beijing Sogou Information Service Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jan 12, 2016

CN=Beijing Sogou Information Service Co.\, Ltd.,OU=Search business Division,O=Beijing Sogou Information Service Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Beijing Sogou Information Service Co.\, Ltd.,OU=Search business Division,O=Beijing Sogou Information Service Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

70:4e:e7:9f:85:6a:67:01:6f:01:25:41:a7:5f:64:46

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2015 - Aug 12, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

287468

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\workspace-wangbi\gamedownloader\Install\SEGameInstaller\Bin\Release\segame_install.pdb

shell32

ShellExecuteExW SHFileOperationW CommandLineToArgvW ExtractIconExA ord155 SHGetFolderLocation SHGetPathFromIDListW SHGetFolderPathW ShellExecuteW

wininet

InternetReadFile InternetOpenA HttpAddRequestHeadersA HttpEndRequestW HttpOpenRequestA HttpAddRequestHeadersW InternetCrackUrlA InternetWriteFile InternetCloseHandle HttpSendRequestExW InternetConnectA HttpSendRequestA HttpOpenRequestW HttpQueryInfoW InternetOpenW InternetReadFileExW InternetConnectW InternetSetStatusCallbackW

kernel32

InitializeCriticalSection DeleteCriticalSection QueryPerformanceCounter GetModuleHandleW GlobalFree GlobalAlloc HeapReAlloc CopyFileA lstrcatA GetSystemDirectoryA lstrcpyA DeviceIoControl CreateFileA LocalFree LocalAlloc LoadLibraryA GetVersionExW GetProcessHeap HeapFree HeapAlloc FreeLibrary ReadFile GetLastError CreateFileMappingW GetFileSizeEx CreateFileW GetCommandLineW FindNextFileW FindClose FindFirstFileW DeleteFileW GetCurrentThreadId CreateEventW EnterCriticalSection SetLastError RaiseException FlushInstructionCache LeaveCriticalSection WaitForSingleObject GetCurrentProcess CreateThread CloseHandle OpenEventW LockResource GetProcessTimes GlobalMemoryStatus FileTimeToDosDateTime GetShortPathNameW RemoveDirectoryW ResumeThread SetThreadContext GetThreadContext SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA MoveFileA GetLocaleInfoW InitializeCriticalSectionAndSpinCount IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeA FlushFileBuffers GetConsoleMode GetProcAddress GetTempPathW lstrlenW MultiByteToWideChar SizeofResource CopyFileW Sleep LoadLibraryW WideCharToMultiByte GetTickCount SetEvent CreateDirectoryW LoadResource FindResourceW FindResourceExW lstrlenA GetDiskFreeSpaceExW MoveFileExW SetFilePointerEx MoveFileW OpenFileMappingW HeapDestroy HeapSize InterlockedCompareExchange IsProcessorFeaturePresent InterlockedExchange UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW Module32NextW GetFileTime GetSystemInfo Module32FirstW GlobalMemoryStatusEx GetLogicalDriveStringsW SystemTimeToTzSpecificLocalTime InterlockedDecrement FreeEnvironmentStringsW HeapCreate IsValidCodePage GetOEMCP GetACP GetModuleFileNameA ExitProcess TlsFree TlsSetValue TlsAlloc InterlockedIncrement FileTimeToLocalFileTime TlsGetValue GetStringTypeW FileTimeToSystemTime GetUserDefaultLangID GetComputerNameW GetSystemDefaultLangID LCMapStringW LCMapStringA RtlUnwind GetSystemTimeAsFileTime GetCPInfo VirtualQuery GetStartupInfoW GetFileSize GetDriveTypeW LoadLibraryExW WriteFile OpenProcess TerminateProcess GetLocalTime ExpandEnvironmentStringsW SetFileAttributesW CreateProcessW VirtualFree ReadProcessMemory GetExitCodeProcess GetModuleFileNameW VirtualAlloc Process32FirstW WaitForMultipleObjects Process32NextW VirtualProtect CreateToolhelp32Snapshot GetCurrentProcessId SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo SetUnhandledExceptionFilter MapViewOfFile UnmapViewOfFile SetFilePointer

user32

CopyRect SetTimer KillTimer PeekMessageW GetMessageW DispatchMessageW FindWindowW GetSystemMetrics GetIconInfo MessageBoxW GetActiveWindow ShowWindow SetWindowLongW TranslateMessage GetClassInfoExW DestroyWindow UnregisterClassW RegisterClassExW CreateWindowExW CallWindowProcW DefWindowProcW UpdateLayeredWindow SetCapture TrackMouseEvent GetUpdateRect GetCapture RedrawWindow ReleaseCapture IsWindowVisible GetKeyState WindowFromPoint DrawEdge GetCursorPos DrawTextW LoadCursorW MonitorFromWindow SetCursor DrawFocusRect OffsetRect IntersectRect InvalidateRect GetSysColor EqualRect UpdateWindow EnableMenuItem LoadImageW GetSystemMenu GetDesktopWindow ReleaseDC PtInRect GetWindowDC MoveWindow GetWindowTextW InflateRect GetDC SubtractRect GetWindowTextLengthW ClientToScreen SetRectEmpty wsprintfW EnableWindow CreateIconFromResourceEx UnregisterClassA GetClassNameW DrawIconEx GetWindowThreadProcessId EnumChildWindows EnumWindows IsRectEmpty wsprintfA IsCharAlphaNumericW ScreenToClient FillRect LoadIconW EndPaint DrawIcon BeginPaint DestroyIcon PostMessageW SendMessageW GetWindowRect GetClientRect BringWindowToTop GetWindowLongW SystemParametersInfoW GetDlgItem EndDialog SetWindowPos MapWindowPoints SetWindowTextW GetWindow PostQuitMessage GetParent SetFocus IsWindow DialogBoxParamW

gdi32

GetBitmapBits RoundRect CreateFontIndirectW SetBrushOrgEx CreateRectRgn CreatePatternBrush CreateFontW DeleteObject DeleteDC GetClipBox CreateSolidBrush TextOutW GetObjectW CreateCompatibleDC SelectObject SetBkMode StretchBlt SetTextColor BitBlt GetStockObject ExtSelectClipRgn CreateRectRgnIndirect SelectClipRgn SetViewportOrgEx RestoreDC GetTextColor SaveDC ExtTextOutW CreateCompatibleBitmap SetBkColor CreateDIBSection GetTextExtentPoint32W GetViewportOrgEx

ole32

CoUninitialize CreateStreamOnHGlobal CoInitialize CoCreateInstance

oleaut32

SysAllocString SysStringLen SysFreeString

psapi

GetModuleFileNameExW EnumProcessModules EnumProcesses GetModuleBaseNameW GetModuleInformation

shlwapi

StrCpyW SHGetValueW SHGetValueA PathCanonicalizeW PathFileExistsW StrCmpIW SHCopyKeyW SHDeleteValueW SHDeleteKeyW SHSetValueA SHSetValueW

msimg32

AlphaBlend

userenv

UnloadUserProfile

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

ws2_32

WSAStartup

advapi32

LookupAccountNameW CheckTokenMembership FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor CloseEventLog ConvertSidToStringSidW ReadEventLogW GetUserNameW OpenEventLogW RegCreateKeyExW GetLengthSid IsValidSid LookupAccountSidW EqualSid CopySid GetTokenInformation RegOpenKeyExW SetEntriesInAclW AllocateAndInitializeSid SetNamedSecurityInfoW RegSetValueExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyW RegQueryValueExW RegCreateKeyW OpenProcessToken

urlmon

URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

8a42e836131fa2ba1fd7b3d6f66f053d_JaffaCakes118

shell32

wininet

kernel32

user32

gdi32

ole32

oleaut32

psapi

shlwapi

msimg32

userenv

version

ws2_32

advapi32

urlmon

generic