09077f1be3d6d6f8304809a6c26b4e7d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

09077f1be3d6d6f8304809a6c26b4e7d_JaffaCakes118
Size

980KB
MD5

09077f1be3d6d6f8304809a6c26b4e7d
SHA1

37481138b5964559740640480f391cd2eb838332
SHA256

c44e63248bf14a093be094f0837d63f3ccff228f9e4f07549c24069e1247735d
SHA512

c187b8439f42f9486cc5e7ce2f0571421d368a39237c80eda88561b3ba797db6e50877934f72ce83a889d0141902748790336681f59367dd84f7cb14206f7dec
SSDEEP

12288:1+geiiIrCrnGSxWyhVbeGqobcEGvXFPkyB7t7L6T0lysFPLNK:1+geipmqWXeGq79fB57L6TeLI

Score

1^/10

Malware Config

Signatures

Files

09077f1be3d6d6f8304809a6c26b4e7d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2ca3f8b0253980e393df05bd3d7151d4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c2:65:15:86:23:af:2f:b6:7a:1c:68:01:fa:ed:b6:b4:92:6b:16:10
Signer

Actual PE Digest

c2:65:15:86:23:af:2f:b6:7a:1c:68:01:fa:ed:b6:b4:92:6b:16:10

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\vqq_debug\release\pdb\QQPYFace.pdb

Imports

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

kernel32

OpenMutexW
CreateMutexW
GetStdHandle
WideCharToMultiByte
WriteConsoleW
DeleteCriticalSection
InitializeCriticalSection
GetFileAttributesW
FindNextFileW
MulDiv
GetTickCount
GlobalLock
GlobalUnlock
GetFullPathNameW
SetEndOfFile
GetFileType
CreateDirectoryW
GetCPInfo
IsDBCSLeadByte
ReleaseMutex
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
HeapCreate
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
GetLocalTime
TlsGetValue
LCMapStringW
LCMapStringA
ExitProcess
GetModuleHandleA
LocalFree
GetStartupInfoW
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
SetHandleCount
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
ProcessIdToSessionId
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetCurrentDirectoryA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
RaiseException
MapViewOfFileEx
SetLastError
UnmapViewOfFile
FlushInstructionCache
GetCurrentProcess
LeaveCriticalSection
GetFileSize
EnterCriticalSection
FindClose
FindFirstFileW
InterlockedDecrement
InterlockedIncrement
GlobalFree
GlobalAlloc
lstrlenW
DeviceIoControl
GetDriveTypeW
GetLogicalDrives
CopyFileW
GetVersionExW
VirtualQueryEx
WritePrivateProfileStringW
CreateFileA
ReadProcessMemory
SetUnhandledExceptionFilter
FreeLibrary
VirtualQuery
GetCurrentThread
GetThreadSelectorEntry
GetProcAddress
GetCurrentProcessId
DeleteFileW
LoadLibraryW
GetModuleFileNameA
OpenFileMappingW
MapViewOfFile
GetCommandLineW
GetLongPathNameW
GetModuleFileNameW
MultiByteToWideChar
TerminateThread
WaitForSingleObject
CreateThread
GetCurrentThreadId
SetFilePointer
WriteFile
SystemTimeToFileTime
RtlUnwind
CreateFileMappingW
FindResourceW
GetLastError
CloseHandle
CreateFileW
ReadFile
Sleep
FindResourceExW
LoadResource
LockResource
SizeofResource
GetDriveTypeA
TlsAlloc

user32

GetPropW
GetWindow
MonitorFromPoint
GetMonitorInfoW
FillRect
SetPropW
ShowScrollBar
GetParent
ScrollWindow
SetScrollPos
OffsetRect
SetClipboardData
GetDesktopWindow
RedrawWindow
UnregisterClassA
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
UnregisterClassW
GetClassInfoExW
WindowFromPoint
SystemParametersInfoW
SetForegroundWindow
IsIconic
IsWindowVisible
ShowWindow
SetWindowRgn
CreateDialogParamW
GetCapture
MoveWindow
GetWindowLongW
GetDlgItem
SetWindowTextW
RegisterClipboardFormatW
GetClipboardData
LoadImageW
LoadIconW
DestroyIcon
SendMessageW
ShowCursor
DestroyWindow
CopyRect
LoadBitmapW
SetWindowPos
EnableWindow
IsWindow
CreateWindowExW
SetCursor
ClientToScreen
PtInRect
ScreenToClient
GetWindowRect
EndPaint
GetDC
GetClientRect
DrawTextW
BeginPaint
PostQuitMessage
KillTimer
SetWindowLongW
SendInput
GetMessageExtraInfo
SetTimer
EnumClipboardFormats
ReleaseDC
UpdateWindow
CloseClipboard
InvalidateRect
GetCursorPos
EmptyClipboard
TrackMouseEvent
OpenClipboard
LoadCursorW
SetScrollInfo
RegisterClassExW

gdi32

GetDIBits
SetStretchBltMode
SetDIBitsToDevice
SaveDC
RestoreDC
GetClipBox
CreateFontIndirectW
GetDeviceCaps
StretchBlt
GetObjectW
GetStockObject
CreateRoundRectRgn
SetTextColor
SetBkMode
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
ExtTextOutW
LineTo
SetBkColor
MoveToEx
DeleteDC
DeleteObject
CreateSolidBrush
BitBlt
CreatePen
CreateDIBSection

advapi32

LookupAccountNameW
LookupAccountSidW
OpenProcessToken
ConvertSidToStringSidW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
GetTokenInformation
GetSecurityInfo
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
IsTextUnicode
RegSetValueExW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW

ole32

StgOpenStorageOnILockBytes
StgOpenStorage
StgCreateDocfile
CoTaskMemFree
CoUninitialize
CoCreateGuid
CoInitialize
CreateILockBytesOnHGlobal

shlwapi

PathRemoveFileSpecW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

socket
htons
closesocket
WSAStartup
sendto
WSACleanup
gethostbyname

netapi32

Netbios
NetApiBufferFree
NetWkstaTransportEnum

Sections

.text
Size: 640KB - Virtual size: 637KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 36KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ca3f8b0253980e393df05bd3d7151d4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

c2:65:15:86:23:af:2f:b6:7a:1c:68:01:fa:ed:b6:b4:92:6b:16:10Signer

Headers

File Characteristics

PDB Paths

Imports

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

version

ws2_32

netapi32

Sections

.text Size: 640KB - Virtual size: 637KB

.rdata Size: 148KB - Virtual size: 147KB

.data Size: 36KB - Virtual size: 54KB

.rsrc Size: 144KB - Virtual size: 143KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

c2:65:15:86:23:af:2f:b6:7a:1c:68:01:fa:ed:b6:b4:92:6b:16:10
Signer

.text
Size: 640KB - Virtual size: 637KB

.rdata
Size: 148KB - Virtual size: 147KB

.data
Size: 36KB - Virtual size: 54KB

.rsrc
Size: 144KB - Virtual size: 143KB