8fb3abc6625785bc85fc5a4ac4d874b8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8fb3abc6625785bc85fc5a4ac4d874b8_JaffaCakes118
Size

1.5MB
MD5

8fb3abc6625785bc85fc5a4ac4d874b8
SHA1

4d2415e60ca32713531fce6750a8f8a59a8fab82
SHA256

7399991b79bcf08e9622490d4be450af1bdc17a6826f648d2434ad7bf06abd5a
SHA512

9e10de74574b493ff613a567f162e89202d3f231e12f592c2939f176c2784e5695208c2df5f9bcf43b0e6cd624b80d3628765281eebaa78e21a7b3d218960c06
SSDEEP

24576:6QXvoul8eO1Pm5k+S5NbqXWOdBxadM7ZGbQhDrjjP1BniGv3up/j2gW/:hfouyr5Nbw1h9tG0h/GE+p/j2b/

Score

1^/10

Malware Config

Signatures

Files

8fb3abc6625785bc85fc5a4ac4d874b8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b7015fd7841514a45ceed860b824786d

Code Sign

5b:32:d2:7a:2e:b6:b4:cf:47:4f:83:97:38:12:9c:46
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/10/2017, 00:00

Not After

10/10/2019, 23:59

Subject

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:7b:68:fb:e4:74:c7:69:f8:4e:87:90:2a:7a:f2:85
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

10/10/2017, 00:00

Not After

10/10/2019, 23:59

Subject

CN=北京布丁跳跳科技有限公司,OU=IT,O=北京布丁跳跳科技有限公司,L=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

29:ad:1f:2f:bf:18:10:ac:f3:60:a0:7a:51:0f:a0:e4:4d:43:10:7e:60:ba:2f:35:19:11:12:3a:2a:c0:cb:f1
Signer

Actual PE Digest

29:ad:1f:2f:bf:18:10:ac:f3:60:a0:7a:51:0f:a0:e4:4d:43:10:7e:60:ba:2f:35:19:11:12:3a:2a:c0:cb:f1

Digest Algorithm

sha256

PE Digest Matches

true

a6:67:aa:a6:6e:54:9a:d9:cb:9b:df:17:64:3d:b9:63:27:8e:e8:09
Signer

Actual PE Digest

a6:67:aa:a6:6e:54:9a:d9:cb:9b:df:17:64:3d:b9:63:27:8e:e8:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Program Files (x86)\gssoft\gswb\3.2.1.0826\SCWordSvcHost.pdb

Imports

kernel32

GlobalFree
CreateToolhelp32Snapshot
InterlockedDecrement
Process32FirstW
DeleteFileW
Process32NextW
CreateDirectoryW
FindFirstFileW
MultiByteToWideChar
FindNextFileW
FindClose
WideCharToMultiByte
FormatMessageW
GetTickCount
lstrcmpiW
GetVersionExW
GetTempPathW
WaitForSingleObject
DeviceIoControl
SetPriorityClass
OutputDebugStringA
CreateFileA
CreateMutexW
ReleaseMutex
lstrcpyW
GetLongPathNameW
LoadLibraryExW
GetSystemDirectoryW
GetCurrentThreadId
lstrlenW
CreateThread
MoveFileW
VirtualAlloc
VirtualFree
VirtualProtect
IsBadReadPtr
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentDirectoryA
GetFullPathNameA
SetConsoleMode
ReadConsoleInputA
GetFileInformationByHandle
ExitThread
GetDriveTypeA
FileTimeToLocalFileTime
WriteFile
GlobalAlloc
GetCurrentProcess
FileTimeToSystemTime
GetLastError
FlushConsoleInputBuffer
GlobalMemoryStatus
FindFirstFileA
GetVersion
ExpandEnvironmentStringsW
WaitForMultipleObjects
PeekNamedPipe
GetSystemDirectoryA
SleepEx
SetEnvironmentVariableA
GetVolumeInformationW
ReadFile
GetFileSize
CreateFileW
CloseHandle
GetCurrentProcessId
OpenProcess
GetModuleHandleW
LoadResource
GetPrivateProfileIntW
FindResourceExW
FindResourceW
SizeofResource
LockResource
GetProcAddress
LoadLibraryW
FreeLibrary
Sleep
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleFileNameW
CompareStringW
CompareStringA
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
SetConsoleCtrlHandler
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
SetFilePointer
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
InterlockedIncrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
GetVersionExA
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate

user32

wsprintfW
GetDesktopWindow
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
UnregisterClassA

advapi32

RevertToSelf
RegOpenKeyExW
RegSetValueExW
RegOpenKeyW
SetSecurityDescriptorDacl
RegEnumKeyW
InitializeSecurityDescriptor
DuplicateTokenEx
RegCloseKey
RegCreateKeyExW
OpenProcessToken
RegQueryValueExW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
ImpersonateLoggedOnUser

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize

shlwapi

PathFileExistsW

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

netapi32

NetApiBufferFree
NetWkstaGetInfo

ws2_32

socket
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
inet_addr
WSAGetLastError
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
sendto
recvfrom
accept
listen
__WSAFDIsSet
select
ioctlsocket
gethostname
shutdown
WSAStartup
closesocket
WSACleanup
gethostbyname

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 296KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7015fd7841514a45ceed860b824786d

Code Sign

5b:32:d2:7a:2e:b6:b4:cf:47:4f:83:97:38:12:9c:46Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

17:7b:68:fb:e4:74:c7:69:f8:4e:87:90:2a:7a:f2:85Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

29:ad:1f:2f:bf:18:10:ac:f3:60:a0:7a:51:0f:a0:e4:4d:43:10:7e:60:ba:2f:35:19:11:12:3a:2a:c0:cb:f1Signer

a6:67:aa:a6:6e:54:9a:d9:cb:9b:df:17:64:3d:b9:63:27:8e:e8:09Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

urlmon

iphlpapi

netapi32

ws2_32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 296KB - Virtual size: 294KB

.data Size: 44KB - Virtual size: 67KB

.rsrc Size: 32KB - Virtual size: 31KB

5b:32:d2:7a:2e:b6:b4:cf:47:4f:83:97:38:12:9c:46
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

17:7b:68:fb:e4:74:c7:69:f8:4e:87:90:2a:7a:f2:85
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

29:ad:1f:2f:bf:18:10:ac:f3:60:a0:7a:51:0f:a0:e4:4d:43:10:7e:60:ba:2f:35:19:11:12:3a:2a:c0:cb:f1
Signer

a6:67:aa:a6:6e:54:9a:d9:cb:9b:df:17:64:3d:b9:63:27:8e:e8:09
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 296KB - Virtual size: 294KB

.data
Size: 44KB - Virtual size: 67KB

.rsrc
Size: 32KB - Virtual size: 31KB