a2fc7f94fcd49756f43a5abb1618899a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a2fc7f94fcd49756f43a5abb1618899a_JaffaCakes118
Size

1.6MB
MD5

a2fc7f94fcd49756f43a5abb1618899a
SHA1

28e3a577b911bd7dc5aaecd0e914458ae62bdcd7
SHA256

6a8f024d789bf88bbdd2df901119496668d255634ef8d5ad1c335365ccacb33d
SHA512

5dee967019325ad49b1e0e3593269940a432f0a63861e8defbfa76cce12c51e0c9fea3be71379086aacf549be204ff0a8c631a3430b7c089fd5b8a6278135d93
SSDEEP

49152:upjR8r8r8GJUakG2QPUD2LIXEy6khz9yiUMBe0X:UF8r8rrJUakG/PUSMEOhz9yiUMBes

Score

1^/10

Malware Config

Signatures

Files

a2fc7f94fcd49756f43a5abb1618899a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

83cfcd8439a1cb185c23ac380f5bba41

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/02/2020, 00:00

Not After

20/03/2023, 12:00

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/02/2020, 00:00

Not After

20/03/2023, 12:00

Subject

CN=Beijing Kingsoft Security software Co.\,Ltd,OU=IT,O=Beijing Kingsoft Security software Co.\,Ltd,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

97:9b:7b:f2:4a:ce:b1:79:94:24:43:a8:27:27:50:22:24:f8:af:db:46:76:19:b8:76:24:e3:ba:bc:75:49:b1
Signer

Actual PE Digest

97:9b:7b:f2:4a:ce:b1:79:94:24:43:a8:27:27:50:22:24:f8:af:db:46:76:19:b8:76:24:e3:ba:bc:75:49:b1

Digest Algorithm

sha256

PE Digest Matches

true

67:c1:78:3e:7f:3f:e9:10:e2:ee:7f:8b:1f:fe:85:78:ce:eb:e6:88
Signer

Actual PE Digest

67:c1:78:3e:7f:3f:e9:10:e2:ee:7f:8b:1f:fe:85:78:ce:eb:e6:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\kinstuiofficial.pdb

Imports

kernel32

ProcessIdToSessionId
GetSystemInfo
InterlockedCompareExchange
MoveFileW
GetLogicalDriveStringsW
QueryDosDeviceW
GetTempPathW
CopyFileW
GetTempFileNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
FlushFileBuffers
FileTimeToSystemTime
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetUserDefaultLangID
GetComputerNameA
GetStdHandle
WaitForMultipleObjects
VirtualFree
VirtualAlloc
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
CreateEventW
SetEvent
lstrcpyW
lstrcatW
SetFileAttributesW
DeviceIoControl
CreateFileA
LoadLibraryA
OpenMutexW
OpenEventW
OpenSemaphoreW
GetCurrentProcessId
ExpandEnvironmentStringsW
CreateProcessW
GetSystemTime
SetUnhandledExceptionFilter
FormatMessageA
ExpandEnvironmentStringsA
LocalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetFullPathNameA
GetDriveTypeA
GetCurrentDirectoryA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetStartupInfoW
VirtualQuery
GetModuleHandleA
VirtualProtect
GetFileType
SetStdHandle
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetThreadLocale
GetLocaleInfoA
GetACP
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
LocalAlloc
OpenProcess
GetSystemDirectoryW
RemoveDirectoryW
FindClose
GetTickCount
SetEndOfFile
WriteFile
CreateDirectoryW
GetFileAttributesW
SetFilePointer
GetCurrentThread
SetThreadPriority
InterlockedDecrement
InterlockedIncrement
MapViewOfFileEx
lstrcmpiW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryExW
DeleteCriticalSection
MapViewOfFile
CreateFileMappingW
CreateThread
UnmapViewOfFile
WaitForSingleObject
Sleep
TerminateThread
GetDiskFreeSpaceExW
GetDriveTypeW
MoveFileExW
DeleteFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
FindResourceW
FlushInstructionCache
CreateFileW
FreeLibrary
GetFileSize
LoadLibraryW
WideCharToMultiByte
ReadFile
lstrlenW
GetModuleFileNameW
GetLastError
InterlockedExchange
OutputDebugStringW
GetLocalTime
RaiseException
GetPrivateProfileStringW
CloseHandle
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
SetLastError
FreeResource
InitializeCriticalSection
lstrlenA
GetModuleHandleW
FindResourceExW
MultiByteToWideChar
GetProcAddress
LoadResource
GetVersionExW
GetPrivateProfileIntW
LockResource
GetWindowsDirectoryW
GetCurrentThreadId
SizeofResource
SleepEx
FindFirstFileA

user32

LoadBitmapW
CharNextW
FindWindowExW
UpdateWindow
AttachThreadInput
CharUpperW
CharLowerW
EndPaint
GetDlgItem
SetActiveWindow
IsRectEmpty
EqualRect
CallWindowProcW
SetWindowTextW
UnregisterClassA
BringWindowToTop
DestroyWindow
SetCursor
GetParent
GetForegroundWindow
PostThreadMessageW
GetWindowTextW
GetNextDlgTabItem
RegisterClassExW
ClientToScreen
GetWindow
DrawIconEx
PeekMessageW
GetWindowRect
SystemParametersInfoW
SetWindowPos
MonitorFromWindow
OffsetRect
GetWindowLongW
TranslateMessage
GetMonitorInfoW
IntersectRect
GetClientRect
UpdateLayeredWindow
SetWindowLongW
DispatchMessageW
MapWindowPoints
FindWindowW
DrawFrameControl
RegisterWindowMessageW
GetKeyState
WindowFromPoint
GetClassInfoExW
GetScrollPos
CopyRect
SetCapture
DestroyIcon
ReleaseCapture
SetRect
GetCursorPos
ScreenToClient
IsWindow
DefWindowProcW
IsWindowVisible
LoadImageW
PtInRect
SetForegroundWindow
LoadIconW
InvalidateRect
MoveWindow
InflateRect
CreateWindowExW
GetActiveWindow
GetDC
DrawTextW
GetDesktopWindow
ReleaseDC
GetDlgCtrlID
IsWindowEnabled
EnableWindow
GetFocus
SetRectEmpty
PostMessageW
IsChild
SendMessageW
GetWindowThreadProcessId
SetFocus
BeginPaint
LoadCursorW
GetMessageW
ShowWindow
IsDialogMessageW
SetTimer
GetWindowTextLengthW
SetWindowRgn
KillTimer

gdi32

LineTo
CombineRgn
DeleteDC
BitBlt
Rectangle
RectInRegion
CreateCompatibleBitmap
GetViewportOrgEx
DeleteObject
CreateBitmap
SetViewportOrgEx
StretchBlt
SelectObject
SetTextColor
SaveDC
CreateCompatibleDC
MoveToEx
ExtSelectClipRgn
CreateDIBSection
GetStockObject
OffsetRgn
CreatePen
GetObjectW
SetBkColor
RestoreDC
SetBkMode
ExtTextOutW
GetTextColor
SelectClipRgn
TextOutW
CreateRoundRectRgn
CreateRectRgnIndirect
GetDeviceCaps
GetClipRgn
CreateFontIndirectW
RoundRect
GetCurrentObject
SetStretchBltMode
GetTextMetricsW
CreateFontW
CreateRectRgn
GetTextExtentPoint32W

advapi32

RegSetValueExW
RegOpenKeyW
RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegDeleteValueW

shell32

SHGetFolderPathW
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHFileOperationW
ShellExecuteW

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CoTaskMemRealloc
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
VarUI4FromStr
SysStringLen
VariantInit
VariantCopy
VariantClear
SysAllocString

shlwapi

PathAppendW
PathFindExtensionW
PathFindFileNameW
StrToIntW
StrToIntA
PathAddBackslashW
PathRemoveFileSpecW
PathFileExistsW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipLoadImageFromStream
GdipGetImagePixelFormat
GdipCloneBitmapArea
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipImageRotateFlip
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipGetFontCollectionFamilyList
GdipCreateLineBrushI
GdipCloneFontFamily
GdipDrawImagePointsRectI
GdipCloneImage
GdiplusStartup
GdipCreateBitmapFromScan0
GdipTranslateWorldTransform
GdipDrawLine
GdiplusShutdown
GdipDeleteFontFamily
GdipFillRectangleI
GdipDrawRectangleI
GdipSetStringFormatTrimming
GdipFree
GdipLoadImageFromFile
GdipRotateWorldTransform
GdipGetImageGraphicsContext
GdipDrawImageRectRect
GdipSetSmoothingMode
GdipDrawLinesI
GdipDisposeImage
GdipDeleteFont
GdipSetPenMode
GdipSetPixelOffsetMode
GdipGetImageHeight
GdipGetFamily
GdipSetPenStartCap
GdipGetImageWidth
GdipSetPenEndCap
GdipCreateSolidFill
GdipSetInterpolationMode
GdipDrawString
GdipDeletePen
GdipDeleteGraphics
GdipAddPathStringI
GdipDrawImageRectI
GdipCreatePen1
GdipCreateFromHDC
GdipGetFontSize
GdipFillPath
GdipAddPathPieI
GdipCloneBrush
GdipCreateStringFormat
GdipGraphicsClear
GdipSetTextRenderingHint
GdipDeleteStringFormat
GdipDrawImageI
GdipAddPathRectangleI
GdipDeleteBrush
GdipSetStringFormatAlign
GdipCreateImageAttributes
GdipCreateFont
GdipNewPrivateFontCollection
GdipDisposeImageAttributes
GdipDrawPath
GdipMeasureString
GdipDeletePrivateFontCollection
GdipSetCompositingQuality
GdipSetClipPath
GdipClosePathFigure
GdipCreateFontFromLogfontW
GdipDrawImageRectRectI
GdipAddPathArcI
GdipPrivateAddFontFile
GdipSetImageAttributesColorMatrix
GdipSetPenDashStyle
GdipSetStringFormatLineAlign
GdipDeletePath
GdipGetFontCollectionFamilyCount
GdipFillRectangle
GdipSetStringFormatFlags
GdipCreatePath
GdipAlloc
GdipResetWorldTransform

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

rasapi32

RasEnumConnectionsW

iphlpapi

IcmpSendEcho
IcmpCloseHandle
IcmpCreateFile
GetAdaptersInfo

Sections

.text
Size: 732KB - Virtual size: 728KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 548KB - Virtual size: 547KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83cfcd8439a1cb185c23ac380f5bba41

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

97:9b:7b:f2:4a:ce:b1:79:94:24:43:a8:27:27:50:22:24:f8:af:db:46:76:19:b8:76:24:e3:ba:bc:75:49:b1Signer

67:c1:78:3e:7f:3f:e9:10:e2:ee:7f:8b:1f:fe:85:78:ce:eb:e6:88Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wtsapi32

psapi

rasapi32

iphlpapi

Sections

.text Size: 732KB - Virtual size: 728KB

.rdata Size: 156KB - Virtual size: 152KB

.data Size: 28KB - Virtual size: 46KB

.rsrc Size: 548KB - Virtual size: 547KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

0f:07:a9:cf:a6:a7:15:67:67:f0:5e:17:b7:51:c5:c5
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

97:9b:7b:f2:4a:ce:b1:79:94:24:43:a8:27:27:50:22:24:f8:af:db:46:76:19:b8:76:24:e3:ba:bc:75:49:b1
Signer

67:c1:78:3e:7f:3f:e9:10:e2:ee:7f:8b:1f:fe:85:78:ce:eb:e6:88
Signer

.text
Size: 732KB - Virtual size: 728KB

.rdata
Size: 156KB - Virtual size: 152KB

.data
Size: 28KB - Virtual size: 46KB

.rsrc
Size: 548KB - Virtual size: 547KB