906d567cc514c0d5279c075b43fb29b0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

906d567cc514c0d5279c075b43fb29b0_JaffaCakes118
Size

10.4MB
MD5

906d567cc514c0d5279c075b43fb29b0
SHA1

009e26f9144bc2f50a91762005280b9ed5608bd9
SHA256

aecc60b3f82e2e39fc6f27dbf838a0e682798b82cf6624c93a1d077675545737
SHA512

05f6064ab0aaed55ee4c7224d7569e9429dbed8b30038c822075d44165c1e0bfcd52a16f043ab675632d83634b28908bf1c9896e62fae4710fe51f4775d4cfb1
SSDEEP

196608:eupqCNceAMhH5sqwH9i9+U2OklPUuQs1k354DLqBUCbMzymBJMU:edMPsqgi9h21lPUuc5o0bm7

Score

1^/10

Malware Config

Signatures

Files

906d567cc514c0d5279c075b43fb29b0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c617344de721d23ac90cbf688fe58d8d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:b6:76:28:b4:ae:fa:95:03:e6:83:a7:cb:de:2b:d7:af:cd:c9:bb
Signer

Actual PE Digest

eb:b6:76:28:b4:ae:fa:95:03:e6:83:a7:cb:de:2b:d7:af:cd:c9:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins_ForIndependent\workspace\Basic\Output\BinFinal\QQPCMgrPacket.pdb

Imports

kernel32

MultiByteToWideChar
FreeResource
lstrlenA
DeleteCriticalSection
UnmapViewOfFile
OpenMutexW
CreateMutexW
LoadLibraryExW
InterlockedIncrement
MapViewOfFileEx
InterlockedDecrement
CreateFileMappingW
lstrcmpiW
SetFilePointer
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
ResetEvent
WaitForMultipleObjects
VirtualFree
VirtualAlloc
GetVersionExW
ReleaseSemaphore
CreateSemaphoreW
GetStdHandle
MoveFileW
GetFullPathNameW
SetEndOfFile
GetSystemInfo
DeviceIoControl
CreatePipe
DuplicateHandle
GetCPInfo
IsDBCSLeadByte
VirtualQuery
ReleaseMutex
GetSystemDefaultLangID
LocalAlloc
GetCurrentProcessId
WideCharToMultiByte
WriteConsoleW
Process32FirstW
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
GetDiskFreeSpaceExW
EnumSystemLocalesA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
QueryPerformanceCounter
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
LCMapStringW
LCMapStringA
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
CreateFileA
LoadLibraryA
GetLocaleInfoW
GetUserDefaultUILanguage
GetLocalTime
LeaveCriticalSection
GetTickCount
CreateToolhelp32Snapshot
GetVersion
QueryDosDeviceW
GetModuleHandleW
GetCurrentProcess
GetModuleFileNameW
GetProcAddress
lstrlenW
LoadLibraryW
GetSystemDirectoryW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryW
FindClose
CreateProcessW
FindNextFileW
OutputDebugStringW
GetLastError
ReadFile
CreateDirectoryW
GetFileAttributesW
GetTempFileNameW
FindResourceExW
GetTempPathW
FreeLibrary
SetLastError
FlushInstructionCache
RaiseException
CopyFileW
WriteFile
HeapFree
InitializeCriticalSection
GetCurrentThreadId
GetProcessHeap
HeapAlloc
GetCommandLineW
lstrcpynW
VirtualAllocEx
WriteProcessMemory
SetUnhandledExceptionFilter
SearchPathW
EnterCriticalSection
SetErrorMode
Sleep
CreateThread
SetEvent
CreateEventW
DeleteFileW
LoadResource
SetFileAttributesW
LockResource
GetFileSize
lstrcmpW
SizeofResource
CreateFileW
FindFirstFileW
Process32NextW
TerminateProcess
FindResourceW
IsValidLocale
OpenProcess
GetConsoleOutputCP
MoveFileExW

user32

LoadStringW
InvalidateRect
MoveWindow
ShowWindow
CreateWindowExW
LoadImageW
UnregisterClassA
GetParent
MessageBoxW
SendMessageW
GetFocus
IsChild
KillTimer
SetTimer
ScreenToClient
GetClassNameW
GetSystemMetrics
mouse_event
GetWindowDC
FindWindowExW
CreateAcceleratorTableW
FillRect
DestroyAcceleratorTable
FrameRect
GetSysColor
InvalidateRgn
GetWindowTextW
LoadIconW
CharUpperW
CharLowerW
CopyImage
SetFocus
RedrawWindow
TrackPopupMenu
CopyRect
SetRect
GetActiveWindow
GetWindowRect
GetDesktopWindow
GetClientRect
GetDlgItem
DrawTextW
DestroyIcon
SetCursor
GetSystemMenu
EqualRect
GetKeyState
DrawFrameControl
OffsetRect
PtInRect
BeginPaint
ClientToScreen
GetMonitorInfoW
GetPropW
MonitorFromWindow
SetPropW
EndPaint
PostThreadMessageW
DrawIconEx
RegisterClassW
CallWindowProcW
SetWindowTextW
ReleaseCapture
PostMessageW
SetCapture
GetDlgCtrlID
IsWindowVisible
GetWindowTextLengthW
SetWindowRgn
RegisterWindowMessageW
DefWindowProcW
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
CharNextW
GetWindowThreadProcessId
GetDC
ReleaseDC
InflateRect
LoadCursorW
DestroyWindow
DispatchMessageW
SetActiveWindow
GetWindowLongW
TranslateMessage
GetMessageW
GetClassInfoExW
IsWindow
SetWindowPos
PeekMessageW
RegisterClassExW
GetWindow
SystemParametersInfoW
SetWindowLongW
MapWindowPoints
EnableWindow
IsWindowEnabled

gdi32

CreateSolidBrush
GetDeviceCaps
ExtSelectClipRgn
SelectClipRgn
CombineRgn
MoveToEx
LineTo
RectInRegion
GetTextExtentPoint32W
SetBkMode
OffsetRgn
CreateRectRgn
TextOutW
RoundRect
RestoreDC
CreateRectRgnIndirect
GetTextMetricsW
CreatePen
Rectangle
CreateFontIndirectW
CreateDIBSection
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
CreateBitmap
StretchBlt
SetBkColor
SetTextColor
SelectObject
DeleteDC
ExtTextOutW
GetObjectW
GetStockObject
DeleteObject
GetClipRgn
SaveDC
GetCurrentObject

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteValueW
IsTextUnicode
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ord680
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CoFreeUnusedLibrariesEx
CoGetClassObject
CreateStreamOnHGlobal
StringFromGUID2
OleUninitialize
OleInitialize
CLSIDFromProgID
OleLockRunning
CoTaskMemAlloc
CoInitialize
CoTaskMemRealloc
CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
CLSIDFromString

oleaut32

VarBstrCmp
SysFreeString
SysAllocString
SysStringLen
OleLoadPicture
SysAllocStringLen
VariantCopy
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringByteLen
VarUI4FromStr
VariantInit
DispCallFunc
VariantClear

shlwapi

PathAddBackslashW
PathAppendW
StrToIntA
PathFileExistsW
PathRemoveBackslashW

comctl32

InitCommonControlsEx
_TrackMouseEvent

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ws2_32

htonl
htons

netapi32

Netbios

Sections

.text
Size: 836KB - Virtual size: 833KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c617344de721d23ac90cbf688fe58d8d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

eb:b6:76:28:b4:ae:fa:95:03:e6:83:a7:cb:de:2b:d7:af:cd:c9:bbSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

ws2_32

netapi32

Sections

.text Size: 836KB - Virtual size: 833KB

.rdata Size: 132KB - Virtual size: 131KB

.data Size: 24KB - Virtual size: 38KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

eb:b6:76:28:b4:ae:fa:95:03:e6:83:a7:cb:de:2b:d7:af:cd:c9:bb
Signer

.text
Size: 836KB - Virtual size: 833KB

.rdata
Size: 132KB - Virtual size: 131KB

.data
Size: 24KB - Virtual size: 38KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB