ad88ba730c11a3456e3bedfbb3eaa6dd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ad88ba730c11a3456e3bedfbb3eaa6dd_JaffaCakes118
Size

19.2MB
MD5

ad88ba730c11a3456e3bedfbb3eaa6dd
SHA1

b5c77fe0808502e6b72f1625825676f84502d064
SHA256

15ee5fe6e565c44c7d7a7b7eb1ae7ea8f69822627c901aac76802ecd9dfc9c36
SHA512

f0bbf2f28ee5b70836283844188df1fa0cf91f4834651bef1eb1be6809abc9d87ad6a40c8dead23bf15c5d1aa5b4252304cc6725226d22452e2ba5888d2741e4
SSDEEP

393216:5QQRjQr9fdRdy0KEP+sbW6RpE3V/JpSSAzY9MgCluQRNKGIvSN:yrVdRtbJRK3V/JtAjgGpR2SN

Score

1^/10

Malware Config

Signatures

Files

ad88ba730c11a3456e3bedfbb3eaa6dd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b4aba2474ebf97dad52a7d2f018b59f9

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

de:f3:60:1b:bc:e1:8f:b3:53:ed:08:80:84:02:54:d5:8e:8b:83:13
Signer

Actual PE Digest

de:f3:60:1b:bc:e1:8f:b3:53:ed:08:80:84:02:54:d5:8e:8b:83:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\building\360project\360sd\branches\beta\Build\x86\Setup.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
lstrcatW
FreeLibrary
LoadLibraryW
DeleteFileW
MoveFileExW
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
CreateThread
InitializeCriticalSection
DeleteCriticalSection
LockResource
FindResourceExW
GetModuleFileNameW
SetLastError
LoadLibraryExW
GetCurrentProcessId
TerminateThread
ReadFile
GetStdHandle
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetWindowsDirectoryW
GetSystemDirectoryW
GetShortPathNameW
GetFullPathNameW
GetCurrentDirectoryW
SearchPathW
GetTempFileNameW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
GetFileInformationByHandle
SetEndOfFile
CompareFileTime
FileTimeToSystemTime
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
CreateMutexA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
ExitProcess
Sleep
HeapCreate
FatalAppExitA
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GlobalAlloc
FreeResource
GlobalLock
GlobalUnlock
GlobalFree
IsBadReadPtr
IsBadWritePtr
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
EnumSystemLocalesA
InterlockedCompareExchange
IsValidLocale
GetLocaleInfoW
CreateFileA
SetStdHandle
FlushFileBuffers
ReleaseMutex
CreateDirectoryW
GetLastError
CreateFileW
WriteFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
WideCharToMultiByte
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetTempPathW
MultiByteToWideChar
GetFileAttributesW
ExpandEnvironmentStringsW
GetModuleHandleA
GetProcAddress
FindResourceW
LoadResource
SizeofResource
GetModuleHandleW
GetCurrentThreadId
lstrlenA
OutputDebugStringW
DebugBreak
InterlockedIncrement
lstrcmpiW
GetTickCount
GetDiskFreeSpaceExW
InterlockedDecrement
FlushInstructionCache
lstrcpyW
lstrlenW
CompareStringW
GetCurrentProcess
CloseHandle
LeaveCriticalSection
EnterCriticalSection
RaiseException
QueryPerformanceCounter

user32

UnregisterClassA
EndPaint
ClientToScreen
CharUpperW
BeginPaint
GetSysColor
GetFocus
GetCapture
ReleaseCapture
CharToOemW
PtInRect
SetCursor
FillRect
CallWindowProcW
GetDlgCtrlID
SetFocus
IsWindowEnabled
InvalidateRect
UpdateWindow
DrawFocusRect
CreateDialogParamW
SetRectEmpty
DestroyCursor
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
wsprintfW
LoadImageW
CreateCursor
OffsetRect
CharNextW
GetCursorPos
ExitWindowsEx
GetClassNameW
PostQuitMessage
DrawTextW
LoadStringW
GetWindow
SystemParametersInfoW
MapWindowPoints
IsWindow
SetWindowRgn
AdjustWindowRectEx
IsDialogMessageW
MessageBoxW
GetDlgItem
GetParent
ChildWindowFromPoint
SetDlgItemTextW
GetDlgItemTextW
EnableWindow
KillTimer
SetTimer
ShowWindow
ReleaseDC
GetWindowDC
GetDC
ScreenToClient
GetWindowRect
SetWindowPos
GetMenu
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
PostMessageW
GetWindowLongW
CreateWindowExW
SetWindowLongW
wvsprintfW
DestroyWindow
SendMessageW
GetClientRect
SetCapture

gdi32

SetTextColor
CreateRoundRectRgn
CreateFontIndirectW
DeleteDC
BitBlt
DeleteObject
GetObjectW
SetBkMode
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
StretchBlt
SetStretchBltMode
StretchDIBits
SetDIBitsToDevice
GetDIBits

advapi32

OpenProcessToken
LookupPrivilegeValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyW
GetTokenInformation
AllocateAndInitializeSid
FreeSid
IsValidSid
EqualSid
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
AdjustTokenPrivileges

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHChangeNotify
ShellExecuteW
SHGetPathFromIDListW
SHFileOperationW

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CoTaskMemAlloc
CoInitialize

oleaut32

VariantClear
VarUI4FromStr
SysAllocStringByteLen
SysAllocString
VariantCopy
SysFreeString

shlwapi

PathIsDirectoryW
PathFileExistsW
StrStrIW
StrCmpIW

comctl32

_TrackMouseEvent
ImageList_Destroy
InitCommonControlsEx
ImageList_GetIconSize

setupapi

SetupIterateCabinetW

wininet

InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW

Sections

.text
Size: 461KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18.6MB - Virtual size: 18.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4aba2474ebf97dad52a7d2f018b59f9

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

de:f3:60:1b:bc:e1:8f:b3:53:ed:08:80:84:02:54:d5:8e:8b:83:13Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

setupapi

wininet

Sections

.text Size: 461KB - Virtual size: 461KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 9KB - Virtual size: 17KB

.rsrc Size: 18.6MB - Virtual size: 18.6MB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

de:f3:60:1b:bc:e1:8f:b3:53:ed:08:80:84:02:54:d5:8e:8b:83:13
Signer

.text
Size: 461KB - Virtual size: 461KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 9KB - Virtual size: 17KB

.rsrc
Size: 18.6MB - Virtual size: 18.6MB