9fbb684036fbb7df667d74c10a2a6958_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

9fbb684036fbb7df667d74c10a2a6958_JaffaCakes118
Size

8.8MB
MD5

9fbb684036fbb7df667d74c10a2a6958
SHA1

85d601c7744e4fd453d16250388d45162efce6ea
SHA256

7c3765263f2172377ff8fe1b90248652e67212b48f2b55d1d48733accad6e048
SHA512

826407306f7d2dc5c83f1b326ceb20fbd5796ebed540593803c341baeee665f8a30f6339574ad379568943634b199ba5132f69c8f644762590353dd4c798189b
SSDEEP

98304:kBaKgm/hgKpmHjA5LUEyHWD93FfD83l9VCs8JDSGJKW:pKFZgJU5YEyHuVg3xBuDSg7

Score

1^/10

Malware Config

Signatures

Files

9fbb684036fbb7df667d74c10a2a6958_JaffaCakes118
.exe windows:5 windows x86 arch:x86

77f86e92c5f9648b0c9f1ff901e824a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ce
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30-09-2015 00:00

Not After

28-09-2018 23:59

Subject

CN=Sogou.com,OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:43:3b:78:fc:51:95:b6:c7:98:ee:23:ea:92:66:41:82:74:9c:03
Signer

Actual PE Digest

89:43:3b:78:fc:51:95:b6:c7:98:ee:23:ea:92:66:41:82:74:9c:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_8_0_NewKernel\Bin\SogouPdb\SogouInput\SGTool.pdb

Imports

imm32

ImmGetIMEFileNameW
ImmInstallIMEW
ImmDestroyContext
ImmAssociateContext
ImmGetHotKey
ImmDisableIME
ImmSetHotKey

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wininet

InternetCloseHandle
InternetOpenUrlW
InternetSetOptionW
InternetOpenW
InternetQueryOptionW
InternetErrorDlg
HttpAddRequestHeadersW
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetGetConnectedState
InternetWriteFile
InternetConnectA
HttpSendRequestExW
HttpEndRequestW
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlW
InternetSetCookieW

kernel32

GetExitCodeThread
WaitForSingleObjectEx
GetExitCodeProcess
GlobalAddAtomW
LoadLibraryA
GetSystemDirectoryA
GetLocaleInfoW
lstrcmpW
EnumSystemLocalesW
MoveFileExW
WriteProfileStringW
GetACP
SetWaitableTimer
RaiseException
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
LocalFree
GetTempPathW
CloseHandle
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
SuspendThread
GetThreadContext
SetThreadContext
SetEnvironmentVariableA
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
LCMapStringA
GetCurrentDirectoryA
GetFullPathNameA
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
HeapCreate
GetFileInformationByHandle
GetDateFormatA
GetTimeFormatA
GetFullPathNameW
GetCPInfo
GetDriveTypeW
FindFirstFileA
GetDriveTypeA
ExitProcess
UnhandledExceptionFilter
RtlUnwind
HeapSize
HeapDestroy
IsProcessorFeaturePresent
SwitchToThread
GetModuleHandleA
WriteFileEx
ReadFileEx
DisconnectNamedPipe
GetOverlappedResult
WaitForMultipleObjectsEx
CreateNamedPipeW
ConnectNamedPipe
GetWindowsDirectoryW
OpenFileMappingA
CreateFileMappingA
GlobalReAlloc
GetWindowsDirectoryA
CompareStringW
MoveFileW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
PeekNamedPipe
SleepEx
SetNamedPipeHandleState
CreateIoCompletionPort
TransactNamedPipe
GetQueuedCompletionStatus
GlobalHandle
LCMapStringW
IsDebuggerPresent
lstrcatW
VirtualQuery
TlsFree
TlsAlloc
FlushFileBuffers
GetFileAttributesExW
QueryDosDeviceW
GetLogicalDriveStringsW
GetProcessId
CreateProcessW
DuplicateHandle
FormatMessageW
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
WaitNamedPipeW
GetFileAttributesW
CopyFileA
lstrcatA
lstrcpyA
DeviceIoControl
LocalAlloc
RemoveDirectoryW
CreateDirectoryW
SetFileTime
GetFileTime
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleFileNameA
CreateFileMappingW
IsBadReadPtr
ExitThread
GetSystemTimeAsFileTime
GetCurrentProcess
Process32NextW
Process32FirstW
GetCurrentProcessId
TerminateProcess
OpenProcess
GetSystemDirectoryW
GlobalFree
GlobalAlloc
GetCommandLineW
GetCurrentThreadId
GetFileSize
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
LoadLibraryW
ResetEvent
SetEvent
WaitForSingleObject
CreateEventW
OpenEventW
GlobalLock
GlobalUnlock
FindResourceExW
SetEndOfFile
MulDiv
WaitForMultipleObjects
GetSystemInfo
SetFilePointer
GlobalMemoryStatusEx
GetTimeZoneInformation
SetUnhandledExceptionFilter
lstrcpyW
lstrcpynW
lstrcpynA
ResumeThread
HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree
SetFileAttributesW
CopyFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateMutexW
InterlockedExchange
InterlockedCompareExchange
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
CreateThread
TerminateThread
GetTickCount
OpenMutexW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
LockResource
GetCurrentThread
GetVersionExW
GetStartupInfoW
WideCharToMultiByte
GetStdHandle
SetFilePointerEx
ReadFile
WriteFile
GetFileType
GetFileSizeEx
CreateFileA
GetLocalTime
SystemTimeToFileTime
FormatMessageA
SetLastError
FlushInstructionCache
lstrlenA
OutputDebugStringW
DebugBreak
Sleep

user32

SetTimer
EmptyClipboard
TrackMouseEvent
LoadIconW
RemoveMenu
GetSystemMenu
EnumWindows
EndDialog
GetDlgItem
DialogBoxParamW
GetKeyboardLayoutList
UnloadKeyboardLayout
DestroyWindow
DrawTextW
GetWindowDC
InvalidateRect
SetWindowLongW
VkKeyScanW
CreateWindowExW
ShowWindow
SetFocus
BeginPaint
DefWindowProcW
UnregisterClassA
GetScrollInfo
SetScrollInfo
CheckDlgButton
AdjustWindowRectEx
LoadKeyboardLayoutW
GetMenuItemID
MenuItemFromPoint
GetMenuItemRect
GetCursor
mouse_event
MsgWaitForMultipleObjectsEx
IsCharAlphaNumericW
GetLastInputInfo
WindowFromPoint
wsprintfA
RegisterClassExW
LoadCursorW
SetWindowTextW
IsDlgButtonChecked
SendMessageW
SendInput
OpenClipboard
CharNextW
MessageBoxW
ActivateKeyboardLayout
EndPaint
SetWindowPos
UpdateLayeredWindow
GetWindowTextLengthW
CloseClipboard
RegisterClipboardFormatW
UnregisterHotKey
RegisterHotKey
ExitWindowsEx
CloseWindow
SetClipboardData
SetCursorPos
IsIconic
BringWindowToTop
keybd_event
PostQuitMessage
SetPropW
UnhookWindowsHookEx
UnregisterClassW
GetAsyncKeyState
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ClipCursor
DestroyCursor
SystemParametersInfoW
LoadMenuW
LoadAcceleratorsW
wsprintfW
CharLowerW
MessageBeep
TrackPopupMenuEx
GetMenuItemCount
LoadStringA
SetMenuDefaultItem
GetMenuItemInfoW
CallWindowProcW
DrawIcon
TranslateAcceleratorW
LoadBitmapW
GetClassInfoExW
LoadStringW
GetPropW
NotifyWinEvent
SendMessageTimeoutW
EnumThreadWindows
GetWindowTextW
IsWindowEnabled
CreatePopupMenu
AppendMenuW
SetMenuItemInfoW
DestroyMenu
InflateRect
FillRect
EnumChildWindows
RedrawWindow
SetCursor
AttachThreadInput
GetKeyState
PostThreadMessageW
GetClassLongW
SetClassLongW
MonitorFromRect
IntersectRect
SubtractRect
ScreenToClient
PtInRect
SetLayeredWindowAttributes
GetDesktopWindow
GetWindowThreadProcessId
SetWindowRgn
GetClassNameW
OffsetRect
RegisterWindowMessageW
ClientToScreen
SetRect
GetDC
ReleaseDC
GetForegroundWindow
SetForegroundWindow
CopyRect
SetRectEmpty
ReleaseCapture
SetCapture
GetCursorPos
MoveWindow
IsRectEmpty
MonitorFromPoint
DestroyIcon
CreateDialogParamW
IsDialogMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetSystemMetrics
LoadImageW
FindWindowExW
wvsprintfW
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
IsWindow
KillTimer
IsWindowVisible
GetWindowRect
GetWindowLongW
GetClientRect
GetFocus
PostMessageW
EnableWindow
FindWindowW

gdi32

CreateFontIndirectW
GetTextExtentPointW
SetTextCharacterExtra
CreateDIBSection
GetFontData
StretchDIBits
EnumFontFamiliesExW
SetViewportOrgEx
OffsetRgn
CombineRgn
RestoreDC
SaveDC
CreateRectRgn
SelectClipRgn
GetClipRgn
GetCharABCWidthsFloatW
ExtCreateRegion
GetObjectW
DeleteObject
Rectangle
CreatePen
SelectObject
CreateSolidBrush
GetStockObject
SetBkMode
SetTextColor
CreateCompatibleDC
DeleteDC
GetDeviceCaps
RemoveFontResourceW
AddFontResourceW
SetStretchBltMode
StretchBlt
SetPixel
CreateDCW
GetPixel
GetFontUnicodeRanges
GetTextMetricsW
DPtoLP
SetMapMode
GetTextExtentExPointW
GetTextExtentPoint32W
MoveToEx
LineTo
CreateCompatibleBitmap
BitBlt

comdlg32

ChooseColorW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityDescriptorSacl
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
CryptGetKeyParam
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
OpenProcessToken
RegQueryValueExW
RegFlushKey
ConvertSidToStringSidW
LookupAccountNameW
RegEnumKeyW
RegEnumValueW
RegUnLoadKeyW
RegOpenKeyW
RegLoadKeyW
RegCreateKeyW
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid

shell32

ShellExecuteExW
SHFileOperationW
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW
ExtractIconW
Shell_NotifyIconW
SHChangeNotify

ole32

OleSetContainedObject
CreateStreamOnHGlobal
CoInitializeEx
CoInitializeSecurity
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleCreate

oleaut32

SysStringLen
VarUI4FromStr
SysAllocString
VariantInit
VariantCopy
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantClear
SysFreeString

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
GetModuleInformation

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

accept
listen
__WSAFDIsSet
select
send
getsockname
bind
shutdown
closesocket
getsockopt
getpeername
setsockopt
connect
socket
sendto
recvfrom
WSAStartup
gethostbyname
gethostname
inet_ntoa
inet_addr
WSAGetLastError
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSASetLastError
WSACleanup
ioctlsocket
recv

wldap32

ord41
ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord22
ord46

shlwapi

wnsprintfA
StrStrIW
SHDeleteKeyW
StrCSpnW
StrToIntW
PathFileExistsW
StrCmpIW

msimg32

TransparentBlt
GradientFill
AlphaBlend

oleacc

LresultFromObject
AccessibleObjectFromWindow

Sections

.text
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 387KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

77f86e92c5f9648b0c9f1ff901e824a7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ceCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

89:43:3b:78:fc:51:95:b6:c7:98:ee:23:ea:92:66:41:82:74:9c:03Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

wtsapi32

comctl32

userenv

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

psapi

version

ws2_32

wldap32

shlwapi

msimg32

oleacc

Sections

.text Size: 5.3MB - Virtual size: 5.3MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 387KB - Virtual size: 1.4MB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 392KB - Virtual size: 391KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ce
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

89:43:3b:78:fc:51:95:b6:c7:98:ee:23:ea:92:66:41:82:74:9c:03
Signer

.text
Size: 5.3MB - Virtual size: 5.3MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 387KB - Virtual size: 1.4MB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 392KB - Virtual size: 391KB