ac180e73493ea29eb0e9d98e7537336d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ac180e73493ea29eb0e9d98e7537336d_JaffaCakes118
Size 2.3MB
Sample240614-3wplbavfnn
SHA256 6ee124ac926cf440901714c3a47cf9baa3e85052ac2c8530b7139fb09fbed854
MD5 ac180e73493ea29eb0e9d98e7537336d
SHA1 ec6ef66cb90ace5eaea68dc60928047b53562e36
SHA512 cb20da659768e00f1aedb085dd8a410ba556c3d9ae9425dfc876fb2617e6f25c98989ee07c3d40a5cecf7abd587cb68a0dd3c29138b929cddf09956c7fe8a345
SSDEEP 49152:qTEFVxVbtrlYI9xq0oL4nnWKEtStHbPC6SAExuYJ8NGBKCUTjxLdTp4JCFth:VVbtrKI9xFo0nPEWC3VxuYWGMF2q
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

ac180e73493ea29eb0e9d98e7537336d_JaffaCakes118

.exe 2.3MB

ac180e73493ea29eb0e9d98e7537336d_JaffaCakes118

IMPHASH 6f64bae6b9a63a634034ab6e00dd5fdf
SHA256 6ee124ac926cf440901714c3a47cf9baa3e85052ac2c8530b7139fb09fbed854
MD5 ac180e73493ea29eb0e9d98e7537336d
SHA1 ec6ef66cb90ace5eaea68dc60928047b53562e36
SHA512 cb20da659768e00f1aedb085dd8a410ba556c3d9ae9425dfc876fb2617e6f25c98989ee07c3d40a5cecf7abd587cb68a0dd3c29138b929cddf09956c7fe8a345
SSDEEP 49152:qTEFVxVbtrlYI9xq0oL4nnWKEtStHbPC6SAExuYJ8NGBKCUTjxLdTp4JCFth:VVbtrKI9xFo0nPEWC3VxuYWGMF2q
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

cb:45:1d:79:9c:28:8f:dc:2a:68:ed:d2:b6:ad:96:2c:84:9a:6c:c4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Chains

Jan 5, 2016

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

1f:d2:d3:0e:26:0f:c2:89:cf:af:11:51:8f:2c:d3:6f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2015 - Feb 6, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

1073538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

J:\TFSProjects\PCMaster\Hao123\bin\Hao123Downloader.pdb

kernel32

lstrcatW lstrcmpiW GetVersionExW MoveFileExW CreateProcessW FileTimeToLocalFileTime Module32NextW Module32FirstW GetFileTime WriteProcessMemory VirtualProtect FindNextFileW FindClose GetStartupInfoW InterlockedDecrement GetFileSizeEx lstrcmpW DeviceIoControl MoveFileW SetFileAttributesW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives IsBadCodePtr FileTimeToDosDateTime SetLastError FindFirstFileW GetComputerNameW GetVolumeInformationW GetSystemDirectoryW GetTempFileNameW GetNumberFormatW GetLocaleInfoW GlobalMemoryStatusEx FreeResource MoveFileA WritePrivateProfileStringW CopyFileW GetCommandLineW GetCurrentThreadId GetLocalTime SetUnhandledExceptionFilter GetPrivateProfileStringW lstrcmpiA SetEvent UnlockFileEx WaitForMultipleObjects InterlockedIncrement TerminateThread GetExitCodeThread ResumeThread CreateDirectoryW CreateSemaphoreW ReleaseSemaphore LocalFileTimeToFileTime GetCurrentDirectoryW SetFileTime GetFileInformationByHandle lstrcpynW lstrcmpA lstrlenA LoadLibraryExW UnmapViewOfFile WriteFile WaitForSingleObject LoadLibraryExA BeginUpdateResourceW BeginUpdateResourceA EndUpdateResourceW UnlockFile UpdateResourceW InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection AreFileApisANSI CreateFileA CreateFileW CreateFileMappingA CreateFileMappingW OutputDebugStringA OutputDebugStringW QueryPerformanceFrequency FileTimeToSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime GetSystemTimeAsFileTime QueryPerformanceCounter WideCharToMultiByte GetWindowsDirectoryW GetModuleFileNameW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetProcessHeap HeapAlloc LocalAlloc HeapFree IsBadReadPtr FreeLibrary GetLastError LocalFree lstrcpyW CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle ExpandEnvironmentStringsW lstrlenW GetFileAttributesW LeaveCriticalSection EnterCriticalSection LoadLibraryW GetModuleHandleW GetProcAddress GetCurrentProcess MultiByteToWideChar CreateMutexW DeleteFileA DeleteFileW FlushFileBuffers FormatMessageA FormatMessageW GetCurrentProcessId GetDiskFreeSpaceA GetDiskFreeSpaceW GetFileAttributesA GetFileAttributesExW GetFileSize GetFullPathNameA GetFullPathNameW GetSystemInfo GetSystemTime GetTempPathA GetTempPathW GetTickCount GetVersionExA HeapCreate HeapDestroy HeapReAlloc HeapSize HeapValidate LoadLibraryA LockFile LockFileEx MapViewOfFile ReadFile SetEndOfFile SetFilePointer GetUserDefaultUILanguage Sleep CreateEventW MulDiv IsBadStringPtrW SetEnvironmentVariableA CompareStringW WriteConsoleW SetStdHandle SetConsoleCtrlHandler GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA SetHandleCount GetConsoleMode GetConsoleCP SetCurrentDirectoryW GetFileType PeekNamedPipe GetTimeZoneInformation IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FatalAppExitA ExitProcess GetStdHandle IsProcessorFeaturePresent GetStringTypeW GetCurrentThread TlsFree TlsSetValue TlsGetValue HeapQueryInformation TlsAlloc FindResourceExW FindResourceW LoadResource LockResource SizeofResource OpenEventW RaiseException IsValidCodePage GetOEMCP GetACP TerminateProcess IsDebuggerPresent UnhandledExceptionFilter GetCPInfo LCMapStringW HeapSetInformation GetCommandLineA CreateThread ExitThread FindFirstFileExW RtlUnwind InitializeCriticalSectionAndSpinCount InterlockedExchange EncodePointer DecodePointer

user32

GetFocus PostMessageW GetDesktopWindow MessageBoxW PtInRect IntersectRect OffsetRect SetCursor LoadCursorW GetSystemMetrics CharNextW SetTimer wsprintfW SetWindowLongW GetWindowLongW PostQuitMessage DispatchMessageW TranslateMessage PeekMessageW DestroyWindow IsZoomed ScreenToClient GetWindowRect InflateRect UnionRect DefWindowProcW IsWindow SetWindowPos MapWindowPoints GetClientRect GetMonitorInfoW MonitorFromWindow GetWindow GetParent SendMessageW LoadImageW CallWindowProcW GetPropW SetPropW AdjustWindowRectEx GetMenu EnumChildWindows IsWindowVisible FindWindowExW ShowWindow RegisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW UpdateLayeredWindow InvalidateRect SetCapture ReleaseCapture SystemParametersInfoW GetDC SetWindowRgn SetFocus GetKeyState GetClassNameW GetCursorPos IsRectEmpty EndPaint BeginPaint GetUpdateRect ReleaseDC GetMessageW EnableWindow DrawFocusRect DrawTextW DrawIconEx CharPrevW SetRect IsIconic UpdateWindow DestroyIcon GetIconInfo KillTimer CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor DestroyMenu TrackPopupMenu EnableMenuItem AppendMenuW CreatePopupMenu GetCaretPos GetWindowTextW GetWindowTextLengthW SetWindowTextW FillRect InvalidateRgn MoveWindow CreateAcceleratorTableW

advapi32

CryptGetHashParam RegCreateKeyExW RegSetValueExW RegCloseKey RegQueryValueExW RegOpenKeyExW LookupAccountNameW DuplicateTokenEx ConvertStringSidToSidW SetTokenInformation RegDeleteValueW AllocateAndInitializeSid FreeSid LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW SaferCreateLevel SaferComputeTokenFromLevel SaferCloseLevel RegEnumValueW CryptAcquireContextW CryptCreateHash CryptHashData RegEnumKeyExW CryptDestroyHash CryptReleaseContext OpenProcessToken ConvertSidToStringSidW GetTokenInformation GetLengthSid CopySid IsValidSid GetNamedSecurityInfoW BuildExplicitAccessWithNameW DeleteAce SetEntriesInAclW SetNamedSecurityInfoW RegFlushKey

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW ShellExecuteW SHGetMalloc

ole32

CoCreateInstance CoInitializeEx CoInitialize OleLockRunning CLSIDFromString CLSIDFromProgID StgCreateDocfile CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes OleSetContainedObject OleCreateStaticFromData OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal OleUninitialize OleInitialize CoSetProxyBlanket CoUninitialize

oleaut32

VariantClear VariantInit SysAllocString GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString

shlwapi

PathFindFileNameW StrStrIA PathFindExtensionW PathFileExistsA PathAppendW PathFileExistsW PathAppendA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle InternetCheckConnectionW InternetGetCookieW InternetGetCookieExW HttpSendRequestW InternetSetCookieW InternetReadFile InternetOpenUrlW InternetOpenW HttpEndRequestW InternetWriteFile HttpSendRequestExW HttpOpenRequestW InternetConnectW GetUrlCacheEntryInfoW HttpQueryInfoW InternetSetOptionW

psapi

GetModuleInformation

winhttp

WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpCrackUrl WinHttpReadData WinHttpOpenRequest WinHttpConnect WinHttpSetTimeouts WinHttpOpen

crypt32

CertGetNameStringW CertFindCertificateInStore CryptDecodeObject CryptMsgGetParam CryptProtectData CryptQueryObject

winmm

timeBeginPeriod timeEndPeriod timeGetTime

urlmon

URLDownloadToFileW ObtainUserAgentString

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wintrust

WinVerifyTrust

dbghelp

MiniDumpWriteDump

gdi32

CreateSolidBrush GetTextMetricsW SelectObject DeleteObject CreateFontIndirectW CreateRoundRectRgn SetWindowOrgEx RestoreDC BitBlt SaveDC CreateCompatibleDC DeleteDC OffsetRgn PtInRegion SelectClipRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox CombineRgn StretchBlt SetStretchBltMode GetDIBits GetObjectW CreateRectRgn GetBitmapBits CreateDIBSection LineTo MoveToEx CreatePen Rectangle GetStockObject RoundRect GetTextExtentPoint32W SetBkMode SetTextColor GdiFlush TextOutW GetCharABCWidthsW SetBkColor GetDeviceCaps SetBitmapBits CreateCompatibleBitmap CreatePatternBrush CreateDCW SetDIBColorTable

comctl32

ord17 _TrackMouseEvent

gdiplus

GdipCreateFromHDC GdipSaveGraphics GdipDrawImageI GdipRotateWorldTransform GdipTranslateWorldTransform GdipGetImageGraphicsContext GdipGetImageEncoders GdipGetImageEncodersSize GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipSaveImageToStream GdipSaveImageToFile GdiplusStartup GdiplusShutdown GdipCreateImageAttributes GdipDisposeImageAttributes GdipDeleteBrush GdipFree GdipAlloc GdipCreatePen1 GdipDeletePen GdipCreateStringFormat GdipDeleteStringFormat GdipCreatePath GdipDeletePath GdipDeleteGraphics GdipDeleteFont GdipGetImageWidth GdipDrawImageRectI GdipSetImageAttributesColorMatrix GdipSetImageAttributesColorKeys GdipSetImageAttributesWrapMode GdipCreateSolidFill GdipSetPenDashStyle GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatHotkeyPrefix GdipSetStringFormatTrimming GdipAddPathLineI GdipAddPathArcI GdipGetImageHeight GdipReleaseDC GdipSetTextRenderingHint GdipSetInterpolationMode GdipSetSmoothingMode GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipDrawString GdipMeasureString GdipDrawImageRectRectI GdipCreateFontFromDC GdipCloneBrush GdipGraphicsClear GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipCloneImage GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

397KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

142KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ac180e73493ea29eb0e9d98e7537336d_JaffaCakes118

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

iphlpapi

wininet

psapi

winhttp

crypt32

winmm

urlmon

userenv

wintrust

dbghelp

gdi32

comctl32

gdiplus

imm32

generic