b2f378b47d90b112e82d8898c6689139_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b2f378b47d90b112e82d8898c6689139_JaffaCakes118
Size

4.1MB
MD5

b2f378b47d90b112e82d8898c6689139
SHA1

03ae70a6252e4ecdf4763d37b72c275428cb3066
SHA256

4f5be7fbce220efa3c4f265d3a1b2af819cf0f27fce448f3adb45d167cc7d90f
SHA512

4911d3944eeb41a6852dd05ea1e1cf9e6c357f6d1a8ee6760e309dd1a1704d73c8e391d3e14b50522f6248eda2d3831704dba8abb09090d24a19afe86d77622e
SSDEEP

98304:QDm3Gd7kmgrpV1BwD/pU9BIiKSNj5zwyp:QDmGkBr314/OHfNPp

Score

1^/10

Malware Config

Signatures

Files

b2f378b47d90b112e82d8898c6689139_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1b29bebecf426faa1870d33084a50696

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:df:09:9e:8d:36:54:43:eb:18:42:b5
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

27/08/2018, 09:38

Not After

27/08/2021, 09:38

Subject

CN=DVDFab Software Inc.,O=DVDFab Software Inc.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:d8:c3:f4:36:09:4d:89:45:8c:c3:d9:73:16:c2:09:ef:74:e0:8e
Signer

Actual PE Digest

ca:d8:c3:f4:36:09:4d:89:45:8c:c3:d9:73:16:c2:09:ef:74:e0:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\setup\Release\DVDFab11_X86_Downloader.pdb

Imports

ws2_32

ioctlsocket
gethostname
WSAEventSelect
WSAGetLastError
WSASocketW
WSACreateEvent
inet_ntoa
gethostbyname
WSACleanup
getaddrinfo
listen
accept
freeaddrinfo
WSAStartup
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
recvfrom
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
sendto
inet_addr

wldap32

ord30
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord301
ord200
ord143
ord79
ord35
ord33

kernel32

GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleCP
GetTickCount
GetPrivateProfileIntW
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExW
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CloseHandle
WideCharToMultiByte
GetLastError
MulDiv
OutputDebugStringW
SetUnhandledExceptionFilter
DeleteFileA
GetModuleFileNameW
GetCommandLineW
LoadLibraryW
VirtualAlloc
VirtualFree
GetModuleHandleA
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventA
CreateSemaphoreA
AreFileApisANSI
MultiByteToWideChar
LoadLibraryExW
GetModuleFileNameA
LocalFree
FormatMessageA
FormatMessageW
GetCurrentProcessId
GetCurrentThreadId
SetLastError
SetFileTime
GetModuleHandleW
GetSystemDirectoryA
GetTempPathA
GetTempPathW
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
CreateDirectoryW
RemoveDirectoryA
RemoveDirectoryW
CreateFileW
SetFileAttributesA
SetFileAttributesW
DeleteFileW
MoveFileA
MoveFileW
FindClose
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetFileAttributesA
GetFileAttributesW
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetFileSize
GetOEMCP
ReadFile
DeviceIoControl
SetFilePointer
CreateFileA
GetFileInformationByHandle
GetDriveTypeW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetCurrentProcess
CompareFileTime
GetTimeZoneInformation
GlobalMemoryStatus
GetSystemInfo
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
WaitForMultipleObjects
GetStdHandle
QueryPerformanceCounter
SetProcessAffinityMask
MapViewOfFile
UnmapViewOfFile
OpenEventA
OpenFileMappingA
GetProcessTimes
SetConsoleCtrlHandler
SetFileApisToOEM
GetConsoleScreenBufferInfo
GetConsoleMode
SetConsoleMode
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiW
Process32NextW
OpenProcess
GetDiskFreeSpaceExA
FindResourceW
SizeofResource
LoadResource
LockResource
GetSystemDefaultLangID
GetLocaleInfoA
ReleaseMutex
CreateMutexW
OutputDebugStringA
GetLocalTime
SystemTimeToFileTime
InitializeCriticalSectionEx
SleepEx
GetTickCount64
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
ExpandEnvironmentStringsA
VerSetConditionMask
VerifyVersionInfoA
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
GetCurrentThread
HeapSize
GetModuleHandleExW
ExitProcess
SetFilePointerEx
HeapReAlloc
RaiseException
RtlUnwind
IsProcessorFeaturePresent
IsDebuggerPresent
HeapAlloc
HeapFree
ExitThread
CreateThread
DecodePointer
EncodePointer
TlsGetValue
TlsSetValue
WriteFile
GetCPInfo
TlsFree
GetStartupInfoW
GetProcessHeap
FlushFileBuffers
GetFileAttributesExW
GetThreadTimes
InitializeSListHead
ReadConsoleW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
SetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
SetEnvironmentVariableA
GetStringTypeW
GetFullPathNameW
FileTimeToSystemTime
SetEndOfFile
TlsAlloc

user32

FindWindowW
MessageBoxW
OffsetRect
CreateWindowExW
SetTimer
SendMessageA
CharUpperA
CharUpperW
CharPrevExA
SetCapture
ClientToScreen
PostMessageW
GetWindowRgn
CharLowerW
GetWindowTextW
SystemParametersInfoW
DefWindowProcW
LoadCursorW
RegisterClassExW
GetWindowLongW
SetWindowLongW
DestroyWindow
EndDialog
ReleaseCapture
GetWindowThreadProcessId
InvalidateRect
LoadIconW
SetWindowTextA
MoveWindow
EnableWindow
KillTimer
wsprintfW
DrawTextA
ReleaseDC
DrawTextW
FillRect
GetClientRect
GetDC
DialogBoxParamW
LoadStringW
SetWindowPos
GetSystemMetrics
GetWindowRect
CreateDialogParamW
ShowWindow
SetWindowTextW
SendMessageW
GetDlgItem
LoadBitmapW

gdi32

CreateRectRgn
CreateDIBSection
CreateFontIndirectW
GetDeviceCaps
DeleteDC
BitBlt
SetTextColor
SetBkMode
CreateSolidBrush
SelectObject
CreateCompatibleDC
SetBitmapBits
CreateCompatibleBitmap
GetBitmapBits
GetObjectW
DeleteObject
PtInRegion

advapi32

SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueA
GetFileSecurityW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
DuplicateTokenEx
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyExA
RegEnumKeyA
RegQueryInfoKeyA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderLocation

ole32

CoCreateInstance
CoCreateGuid
CoTaskMemFree
CoUninitialize
CoInitialize

oleaut32

SysFreeString
VariantCopy
VariantClear
SysAllocStringLen
SysAllocString
SysStringLen

shlwapi

PathRemoveFileSpecW
PathAppendW
PathFileExistsA
PathAppendA
StrCatW
StrRChrW
StrChrW
StrCpyNW
PathFileExistsW
StrCpyW

netapi32

NetApiBufferFree
NetWkstaGetInfo

iphlpapi

GetAdaptersInfo

dbghelp

MiniDumpWriteDump

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b29bebecf426faa1870d33084a50696

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

26:df:09:9e:8d:36:54:43:eb:18:42:b5Certificate

Extended Key Usages

Key Usages

ca:d8:c3:f4:36:09:4d:89:45:8c:c3:d9:73:16:c2:09:ef:74:e0:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

netapi32

iphlpapi

dbghelp

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 332KB - Virtual size: 331KB

.data Size: 23KB - Virtual size: 73KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 65KB - Virtual size: 64KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

26:df:09:9e:8d:36:54:43:eb:18:42:b5
Certificate

ca:d8:c3:f4:36:09:4d:89:45:8c:c3:d9:73:16:c2:09:ef:74:e0:8e
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 332KB - Virtual size: 331KB

.data
Size: 23KB - Virtual size: 73KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 65KB - Virtual size: 64KB