a511033bf05d2a20bc697b17dd169900_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a511033bf05d2a20bc697b17dd169900_JaffaCakes118
Size 122KB
Sample240613-mffepsyekm
SHA256 156da220cbc3a1d7cb011eb871654b884c2dddfd71ab251bc97a03bde771de46
MD5 a511033bf05d2a20bc697b17dd169900
SHA1 5f31ef4b7d27d167f2dde18dedd80f606760a800
SHA512 e38d0b4b4a58725079d41b21e35815f182813c8417bb9863934821c7c124d4749fa6d64eb4b74d9557f3e2248afc945ce1119497f77333f63193677097872ad6
SSDEEP 3072:KTWVNqUc+jdTd9jZNVTUakEmdu5g0+EoH+6PDc4+fNYvUgHutm5M:NNqUd/ZN9Nmg+a6PAbfNYvUJm5M
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a511033bf05d2a20bc697b17dd169900_JaffaCakes118

.dll 122KB

a511033bf05d2a20bc697b17dd169900_JaffaCakes118

IMPHASH e1e0ab579616080f8e860dc93e5e8738
SHA256 156da220cbc3a1d7cb011eb871654b884c2dddfd71ab251bc97a03bde771de46
MD5 a511033bf05d2a20bc697b17dd169900
SHA1 5f31ef4b7d27d167f2dde18dedd80f606760a800
SHA512 e38d0b4b4a58725079d41b21e35815f182813c8417bb9863934821c7c124d4749fa6d64eb4b74d9557f3e2248afc945ce1119497f77333f63193677097872ad6
SSDEEP 3072:KTWVNqUc+jdTd9jZNVTUakEmdu5g0+EoH+6PDc4+fNYvUgHutm5M:NNqUd/ZN9Nmg+a6PAbfNYvUJm5M
MD5 SHA1 SHA512 SSDEEP

Digest

8e:46:3d:ba:fc:91:cc:82:b8:d7:20:36:cf:63:e9:07:88:a5:7e:6a:7b:50:d3:bb:41:a1:d1:f1:b3:9d:b0:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Chains

Aug 30, 2019

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

82:4a:00:fe:4e:a4:5f:6b:f9:f4:6a:9c:2b:07:da:f1:ec:4f:ef:ca

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Chains

Aug 30, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Serial Number

0d:70:a1:7d:75:6f:ec:88:85:9a:29:46:be:d7:69:44

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2019 - May 8, 2020

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,L=Shanghai,C=CN

Serial Number

01:40:74:8d:43:58:a1:47:81:d6:a9:c3:07:b3:aa:9c

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2019 - May 8, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

76507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\trunk_code_for_safecenter\Rhino\Safe\Bin\Win32\Release\pdb\LuaBizBasic.pdb

lua51

lua_touserdata lua_pushboolean lua_newuserdata lua_insert lua_gettop lua_pushstring lua_pushcclosure lua_rawset lua_tolstring

kernel32

EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent IsDebuggerPresent DecodePointer GetCurrentThreadId FindNextFileW FindClose GetFileAttributesW GetCurrentProcess LoadLibraryW FreeLibrary GetProcAddress GetModuleHandleW InterlockedExchangeAdd FindFirstFileW MultiByteToWideChar DeleteCriticalSection

msvcp120

?_Winerror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@_W@std@@2V0locale@2@A ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?id@?$collate@_W@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ??_7facet@locale@std@@6B@ _Wcscoll _Wcsxfrm ??_7_Facet_base@std@@6B@ ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z ?tolower@?$ctype@_W@std@@QBE_W_W@Z ?is@?$ctype@_W@std@@QBE_NF_W@Z ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??Bid@locale@std@@QAEIXZ ??1_Facet_base@std@@UAE@XZ ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ?_Syserror_map@std@@YAPBDH@Z

msvcr120

??_V@YAXPAX@Z realloc strchr free ??0exception@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ ??2@YAPAXI@Z ??3@YAXPAX@Z _purecall memmove ?terminate@@YAXXZ wcschr towlower wcsstr towupper _wtoi __clean_type_info_names_internal _except_handler4_common __crtTerminateProcess __crtUnhandledException _crt_debugger_hook _initterm_e _initterm memset _amsg_exit __CppXcptFilter ??1type_info@@UAE@XZ _onexit __dllonexit _unlock _lock ??0bad_cast@std@@QAE@ABV01@@Z _CxxThrowException __CxxFrameHandler3 memcpy _calloc_crt _malloc_crt

Sharing

General

Malware Config

Signatures

File Explorer

a511033bf05d2a20bc697b17dd169900_JaffaCakes118

PE Signature issue

lua51

kernel32

msvcp120

msvcr120

generic