a38c0710a794d5d8522bfd5fbcdc8af5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a38c0710a794d5d8522bfd5fbcdc8af5_JaffaCakes118
Size 2.5MB
Sample240613-c265fa1fjh
SHA256 1ddf8f29557931ae108c03db9744f87487b5193a74d427900efa6a0e8f84f6ba
MD5 a38c0710a794d5d8522bfd5fbcdc8af5
SHA1 3aff19c51265a5c05280374b149fb7e0db4710ed
SHA512 69b457ed0f1af482d863ad7ed897d7c49c19fbdfe448381c36f5fd4b38e7cec767df1b8dff1021c476a74062b4f85c812adc4b69351daa83c0b008a9153d2a17
SSDEEP 49152:XafgZLr9twJ7H6yn9GOc6NrSWcB9xNixcXJv3Z/17y:XIgZHy9c42WcB9xNJZt7y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a38c0710a794d5d8522bfd5fbcdc8af5_JaffaCakes118

.exe 2.5MB

a38c0710a794d5d8522bfd5fbcdc8af5_JaffaCakes118

IMPHASH 6d9c1ce5f99f84693d248e05fc9075a4
SHA256 1ddf8f29557931ae108c03db9744f87487b5193a74d427900efa6a0e8f84f6ba
MD5 a38c0710a794d5d8522bfd5fbcdc8af5
SHA1 3aff19c51265a5c05280374b149fb7e0db4710ed
SHA512 69b457ed0f1af482d863ad7ed897d7c49c19fbdfe448381c36f5fd4b38e7cec767df1b8dff1021c476a74062b4f85c812adc4b69351daa83c0b008a9153d2a17
SSDEEP 49152:XafgZLr9twJ7H6yn9GOc6NrSWcB9xNixcXJv3Z/17y:XIgZHy9c42WcB9xNJZt7y
MD5 SHA1 SHA512 SSDEEP

Digest

e4:6a:41:9f:d0:38:a1:97:a9:f9:db:2f:3a:80:a5:80:a0:1a:85:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jun 13, 2016

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

1f:d2:d3:0e:26:0f:c2:89:cf:af:11:51:8f:2c:d3:6f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2015 - Feb 6, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

208055

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\svn\darkhorse\branches\1.1.9.1077\src\tools\Installer\Release_Hao123\setup_hao123.pdb

shlwapi

PathMatchSpecW PathGetDriveNumberW StrCmpIW PathRemoveFileSpecW SHDeleteKeyW PathRemoveBackslashW PathIsDirectoryW PathAddBackslashW PathCombineW SHSetValueW SHGetValueA SHGetValueW StrStrIW PathFileExistsW PathAppendW PathFindFileNameW SHDeleteValueW PathIsDirectoryEmptyW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

ObtainUserAgentString

psapi

GetModuleFileNameExW EnumProcesses EnumProcessModules

wininet

InternetConnectW InternetSetOptionA HttpOpenRequestW HttpSendRequestExW HttpQueryInfoW FtpGetFileSize InternetOpenA HttpSendRequestW InternetOpenW FtpOpenFileW HttpEndRequestW InternetWriteFile FtpCommandW InternetGetLastResponseInfoW InternetSetOptionW InternetQueryOptionW InternetCrackUrlW InternetCloseHandle InternetSetStatusCallbackW InternetReadFile InternetReadFileExA

kernel32

GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW RaiseException GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection SetErrorMode TerminateProcess GetCommandLineW CreateMutexW CloseHandle GetTempPathW GetLongPathNameW MoveFileExW CreateThread FlushInstructionCache SetLastError Sleep OpenProcess WaitForSingleObject GetTickCount GetComputerNameExW SetEvent CreateEventW LocalFree GetVersionExW GetSystemInfo ResumeThread OpenThread WaitForMultipleObjects GetTempFileNameW DeleteFileW GetDiskFreeSpaceExW GetSystemDirectoryW WinExec SetFileAttributesW RemoveDirectoryW LoadLibraryW InterlockedDecrement IsBadWritePtr GetCurrentProcess lstrlenA CancelWaitableTimer ResetEvent WideCharToMultiByte CreateWaitableTimerW SetWaitableTimer SystemTimeToFileTime CreateFileW SetFilePointer SetEndOfFile SetFileTime ReadFile WriteFile TlsAlloc TlsFree GetLocalTime DebugBreak OutputDebugStringW GlobalAlloc GlobalFree GetVolumeInformationW DeviceIoControl lstrcpynW CreateDirectoryW FindFirstFileW FindNextFileW FindClose CopyFileW MoveFileW CreateProcessW LockResource FreeResource GetCurrentProcessId GetModuleHandleA GetWindowsDirectoryW LocalAlloc VirtualFree VirtualAlloc InterlockedCompareExchange HeapFree GetProcessHeap HeapAlloc LoadLibraryA IsProcessorFeaturePresent GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetCommandLineA GetStartupInfoA RtlUnwind TlsSetValue InterlockedIncrement LCMapStringA LCMapStringW GetCPInfo TlsGetValue lstrlenW GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetLocaleInfoA HeapSize ExitProcess HeapReAlloc HeapCreate GetStdHandle GetModuleFileNameA GetACP GetOEMCP IsValidCodePage SetHandleCount GetFileType GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA IsBadReadPtr InterlockedExchange

user32

UpdateLayeredWindow GetForegroundWindow IsIconic IsZoomed GetAncestor GetDoubleClickTime GetKeyState IsWindowVisible GetWindowTextW GetFocus DrawIconEx DestroyIcon CharLowerW SetCursor ScreenToClient GetCursorPos ReleaseCapture GetCapture SetPropW GetPropW SetRectEmpty PtInRect SetCapture CopyRect IsRectEmpty DrawTextW GetDesktopWindow SystemParametersInfoW FindWindowExW CharUpperW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW KillTimer SendMessageTimeoutW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW PeekMessageW LoadStringW GetSystemMetrics DialogBoxParamW GetActiveWindow MessageBoxW DestroyWindow CharNextW ShowWindow PostMessageW EndDialog LoadIconW SetWindowTextW OffsetRect ReleaseDC GetDC SetWindowRgn EndPaint BeginPaint SetFocus GetWindowLongW MonitorFromWindow GetParent GetClientRect MapWindowPoints SetWindowPos GetMonitorInfoW MonitorFromRect GetWindowRect SetForegroundWindow IsWindow GetWindow SetWindowLongW SetRect SendMessageW UnregisterClassA

gdi32

CreateRectRgn CreateRoundRectRgn CreatePen CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC SetBkMode DeleteObject SelectClipRgn OffsetRgn GetClipRgn GetObjectW CreateFontIndirectW SetTextColor CreatePatternBrush GetTextMetricsW CreateDIBSection GetRgnBox CombineRgn LineTo MoveToEx

advapi32

CryptDestroyHash RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueExW OpenProcessToken GetTokenInformation CryptAcquireContextW CryptCreateHash CryptReleaseContext CryptHashData CryptGetHashParam

shell32

ShellExecuteW ord680 SHBrowseForFolderW ShellExecuteExW SHGetSpecialFolderPathW CommandLineToArgvW SHGetPathFromIDListW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitializeEx CoInitializeSecurity CoCreateGuid StringFromIID CoUninitialize CoInitialize StringFromGUID2 CoSetProxyBlanket

oleaut32

VariantClear SysAllocStringLen SysFreeString SysAllocString VariantInit VarUI4FromStr

comctl32

_TrackMouseEvent

ws2_32

WSAStartup WSACleanup freeaddrinfo getaddrinfo

iphlpapi

GetAdaptersInfo

wintrust

CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle WinVerifyTrust

gdiplus

GdiplusStartup GdiplusShutdown GdipAlloc GdipCloneImage GdipCreateImageAttributes GdipDisposeImageAttributes GdipDisposeImage GdipDrawImageRectRectI GdipDeleteGraphics GdipCreateFromHDC GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromStream GdipFree

Sharing

General

Malware Config

Signatures

File Explorer

a38c0710a794d5d8522bfd5fbcdc8af5_JaffaCakes118

shlwapi

version

urlmon

psapi

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

iphlpapi

wintrust

gdiplus

generic