b067e3c91de0864b0656d90111a2a4e9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
b067e3c91de0864b0656d90111a2a4e9_JaffaCakes118
Size 4.4MB
Sample240615-2ach7a1brn
SHA256 0b188c90a780bde97bc49097b1cf5d24c9fa2c74ba6dee7f3609edceaa9bbcc7
MD5 b067e3c91de0864b0656d90111a2a4e9
SHA1 c5f8fcda7183a6ecb8ef15e225284c39cf7b2c6a
SHA512 8e673939b9d2fbfb652b4d6d25e22ede90380d66057878851182c2a67c0334ac59f42ff22afb38a78165cbd1e858a2af9b4b6252821e3e6242a5407d500f0da4
SSDEEP 98304:khOx/3z85tCuMSL4yBqAgMYQYikxzeR6b/r6w16/6qZV8Nlwbv2z:khOx/3z8bq5hxBufyqSOS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

b067e3c91de0864b0656d90111a2a4e9_JaffaCakes118

.exe 4.4MB

b067e3c91de0864b0656d90111a2a4e9_JaffaCakes118

IMPHASH 82bc8ef44f4fcba5c073f4942a3ba4da
SHA256 0b188c90a780bde97bc49097b1cf5d24c9fa2c74ba6dee7f3609edceaa9bbcc7
MD5 b067e3c91de0864b0656d90111a2a4e9
SHA1 c5f8fcda7183a6ecb8ef15e225284c39cf7b2c6a
SHA512 8e673939b9d2fbfb652b4d6d25e22ede90380d66057878851182c2a67c0334ac59f42ff22afb38a78165cbd1e858a2af9b4b6252821e3e6242a5407d500f0da4
SSDEEP 98304:khOx/3z85tCuMSL4yBqAgMYQYikxzeR6b/r6w16/6qZV8Nlwbv2z:khOx/3z8bq5hxBufyqSOS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

78:c8:51:d4:f3:03:03:a8:01:62:43:45:74:ee:a3:c0:e0:43:0b:62:0e:c0:68:f1:5c:ab:67:a6:6f:84:61:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jul 9, 2019

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

7f:2e:ae:46:1e:78:8b:56:c8:35:b4:1a:aa:9b:3c:7b:dc:f7:83:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jul 9, 2019

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 28, 2018 - Feb 1, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

542753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\pcgame\GameDownloader\Release\GameDownloader.pdb

kernel32

SetPriorityClass VerifyVersionInfoW GetTimeFormatA CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleFileNameA lstrcmpA lstrcmpiA WriteFile GetFileTime SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA GetLocalTime InterlockedIncrement InterlockedDecrement LoadLibraryExW CreateMutexW GetPrivateProfileIntW WritePrivateProfileStringW GetTempPathW GlobalReAlloc SetLastError InitializeCriticalSection MulDiv lstrcmpW GetDiskFreeSpaceA GetSystemDirectoryW GetSystemInfo IsDebuggerPresent EncodePointer FindResourceW CreateProcessW GetFileSize Sleep LeaveCriticalSection EnterCriticalSection SetThreadPriority GetCurrentThreadId GetCurrentThread GlobalMemoryStatusEx FreeLibrary InterlockedExchange VerSetConditionMask GetVolumeInformationW MoveFileExW CopyFileW FindNextFileW FindFirstFileW DeleteFileW SetFileAttributesW CreateFileW RemoveDirectoryW CreateDirectoryW GetDiskFreeSpaceExW GetDriveTypeW OutputDebugStringW GetModuleHandleW GetModuleFileNameW GetLogicalDriveStringsW GetTickCount FindClose WriteConsoleW OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetTimeZoneInformation SetConsoleCtrlHandler FlushFileBuffers SetStdHandle GetFullPathNameA GetFullPathNameW GetCurrentDirectoryW SetCurrentDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetConsoleMode FreeLibraryAndExitThread ResumeThread ExitThread GetACP GetStdHandle PeekNamedPipe GetFileType VirtualQuery VirtualProtect SystemTimeToTzSpecificLocalTime FindFirstFileExW GetFileAttributesExW DeviceIoControl ReadFile WaitForMultipleObjects WaitForSingleObject SuspendThread TerminateThread CreateThread TerminateProcess GetCurrentProcessId GetLongPathNameW GlobalUnlock GlobalLock GlobalAlloc GetFileAttributesW WideCharToMultiByte MultiByteToWideChar GetVersionExW LoadLibraryW lstrcmpiW CloseHandle SizeofResource LoadResource GetCurrentProcess OpenProcess GetProcAddress LockResource lstrlenW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy FindResourceExW GetModuleHandleExW ExitProcess InterlockedFlushSList RtlUnwind CreateSemaphoreW ReleaseSemaphore GetExitCodeThread GlobalFree FileTimeToSystemTime FileTimeToLocalFileTime GetExitCodeProcess GetVersion GetPrivateProfileStringW GetNativeSystemInfo LocalFree ReleaseMutex OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx SetEndOfFile GetFileSizeEx SystemTimeToFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW FormatMessageW CreateEventW SwitchToThread TlsAlloc TlsGetValue WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue DecodePointer

user32

GetWindowTextLengthW GetLastActivePopup CreateWindowExW CreateDialogIndirectParamW EnumDisplaySettingsExW EnumDisplayDevicesW LoadStringW SetWindowLongW GetWindowTextW UnregisterClassW SetForegroundWindow UpdateWindow SetTimer MessageBoxW IsWindow GetDesktopWindow FindWindowExW GetWindowThreadProcessId RegisterClassW FindWindowW PostQuitMessage GetCapture IsIconic IsWindowVisible ShowWindow SendMessageW ExitWindowsEx GetParent GetWindowRect GetSystemMetrics EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetForegroundWindow PostMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW DestroyWindow CharNextW UpdateLayeredWindow GetKeyState AdjustWindowRectEx IsWindowUnicode GetMonitorInfoW MonitorFromWindow GetClassLongW MapWindowPoints DialogBoxIndirectParamW IsZoomed GetIconInfo GetDlgItemTextW SetCursor GetCursorPos DestroyCursor SystemParametersInfoW DestroyIcon LoadImageW SetWindowPos RegisterWindowMessageW CallWindowProcW LoadIconW EndDialog IsDialogMessageW LoadCursorW GetWindow GetClassNameW GetWindowLongW FillRect GetSysColor ScreenToClient ClientToScreen GetClientRect SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus GetDlgItem MoveWindow IsChild GetClassInfoExW RegisterClassExW CreateIconIndirect

gdi32

CreateCompatibleBitmap BitBlt GetStockObject CreateFontIndirectW GetObjectW SetDIBColorTable CreateDIBSection SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateBitmap CreateDIBitmap GetDIBits CreateDCW CreateICW CreatePen CreateRectRgn GetDeviceCaps Ellipse GetClipBox GetClipRgn GetTextExtentPointW GetViewportOrgEx LineTo PatBlt RectVisible RoundRect OffsetViewportOrgEx ExtSelectClipRgn SetBkMode SetTextColor SetTextAlign MoveToEx ExtTextOutW DPtoLP LPtoDP SetWindowOrgEx ExcludeClipRect SetViewportOrgEx CreateSolidBrush CreateRectRgnIndirect SelectClipRgn

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegDeleteKeyW RegQueryInfoKeyW OpenThreadToken ImpersonateSelf RegSetValueExW RegSaveKeyW RegRestoreKeyW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegQueryValueExA RegCreateKeyExW RegCloseKey DuplicateTokenEx LookupPrivilegeValueW GetSidSubAuthorityCount GetSidSubAuthority AdjustTokenPrivileges GetTokenInformation OpenProcessToken

shell32

SHBrowseForFolderW ord165 SHGetPathFromIDListW ShellExecuteW SHFileOperationW ord680 Shell_NotifyIconW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CoUninitialize CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString CoGetClassObject CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoSetProxyBlanket CoInitialize

oleaut32

DispCallFunc LoadRegTypeLi LoadTypeLi SysStringLen SysAllocStringLen VarUI4FromStr OleCreateFontIndirect SysAllocString VariantClear VariantInit GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysStringByteLen VarBstrCmp SysFreeString SysAllocStringByteLen

shlwapi

PathMatchSpecW PathFileExistsW UrlUnescapeW SHGetValueW StrCmpNIW StrStrW StrStrIW StrCmpIW PathAddBackslashW PathAppendW PathBuildRootW PathCanonicalizeW PathCombineW PathFindExtensionW PathGetDriveNumberW PathIsDirectoryW PathIsRootW SHSetValueW PathRemoveExtensionW PathRemoveFileSpecW PathRemoveFileSpecA PathIsUNCW PathIsNetworkPathW StrToIntExW SHGetValueA

wininet

InternetOpenW InternetCanonicalizeUrlW InternetCrackUrlW InternetOpenUrlW InternetConnectW HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetSetOptionW InternetQueryDataAvailable InternetSetFilePointer InternetReadFile InternetCloseHandle

comctl32

InitCommonControlsEx

gdiplus

GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipSaveImageToFile GdipBitmapGetPixel GdipAlloc GdipFree GdipGetImageEncodersSize GdiplusShutdown GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipCreateBitmapFromHBITMAP GdiplusStartup GdipDrawImageI GdipGetImagePaletteSize GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipGetImageEncoders GdipDeleteGraphics GdipBitmapUnlockBits

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

psapi

EnumProcessModules GetModuleFileNameExW EnumProcesses

rpcrt4

RpcStringFreeW UuidToStringW

urlmon

CoInternetSetFeatureEnabled UrlMkGetSessionOption CoInternetIsFeatureEnabled

netapi32

Netbios

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

b067e3c91de0864b0656d90111a2a4e9_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

comctl32

gdiplus

version

psapi

rpcrt4

urlmon

netapi32

wintrust

crypt32

generic