0a67cde640d915895aef235e3a2038a9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0a67cde640d915895aef235e3a2038a9_JaffaCakes118
Size

1.6MB
MD5

0a67cde640d915895aef235e3a2038a9
SHA1

713a40c9e2d881b3dd8d8e1af02ff9ad05aed5dc
SHA256

93dfbc11713d4a725d7151f9acade993be077f5a4adcdd3f634149fa4ea5a988
SHA512

346ddeabd0fb30df2dfc6ebcbb3e5670b5c93fd32c61c9c17975958414c76975bae536e3634baed74a8e1a716d31fe612a815f790eef9638335fe1eac03ab3dc
SSDEEP

49152:dEXUDs/lGkSSToauphyCL2QNoykjohesoaJLLr:QUDstGkSSjcyK2QC08sooLH

Score

1^/10

Malware Config

Signatures

Files

0a67cde640d915895aef235e3a2038a9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fa37767aeaed30b5c4f00c42d1cb8887

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

19/04/2010, 00:00

Not After

19/04/2011, 23:59

Subject

CN=Beijing DrawLeader Tech. Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing DrawLeader Tech. Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7
Signer

Actual PE Digest

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCanonicalizeUrlW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetGetConnectedState
InternetOpenW
InternetReadFile

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetProcessHeap
GetConsoleMode
GetConsoleCP
LCMapStringA
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
GetTimeZoneInformation
GetModuleHandleW
InterlockedDecrement
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileStringW
lstrcpyW
CloseHandle
WriteFile
CreateFileW
FindClose
FindFirstFileW
CreateDirectoryW
GetLastError
MoveFileExW
GetFileAttributesW
DeleteFileW
GetModuleFileNameW
WinExec
GetPrivateProfileIntW
SetLastError
MulDiv
lstrlenW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapSize
LocalFree
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
ExitThread
GlobalSize
CopyFileW
GlobalFree
GetSystemTimeAsFileTime
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetStartupInfoW
FindResourceExW
GetFileTime
GetFileSizeEx
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
SetErrorMode
GetTempFileNameW
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
Sleep
GetFileSize
GetCurrentDirectoryW
GetThreadLocale
GlobalGetAtomNameW
GlobalFlags
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateEventW
SuspendThread
GetProcAddress
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
lstrlenA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetCurrentProcessId
WideCharToMultiByte
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
LoadLibraryW
CompareStringW
LoadLibraryA
FreeLibrary
lstrcmpW
GetVersionExA
FreeResource
GetModuleHandleA

user32

GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
CopyAcceleratorTableW
PostThreadMessageW
CopyIcon
SubtractRect
GetUpdateRect
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
FrameRect
TranslateAcceleratorW
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
IsClipboardFormatAvailable
DestroyAcceleratorTable
GetDoubleClickTime
SetCursorPos
SetClassLongW
UpdateLayeredWindow
EnableScrollBar
GetMenuDefaultItem
SetMenuDefaultItem
UnionRect
IsMenu
CharUpperW
GetAsyncKeyState
NotifyWinEvent
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
WaitMessage
WindowFromPoint
DeleteMenu
DestroyMenu
GetMenuItemInfoW
SetWindowContextHelpId
MapDialogRect
LoadCursorW
ShowOwnedPopups
GetMessageW
TranslateMessage
LoadMenuW
ReleaseCapture
GetIconInfo
CopyImage
DestroyIcon
GetNextDlgGroupItem
SetCapture
SystemParametersInfoW
MessageBeep
DrawFocusRect
DrawFrameControl
DrawEdge
SetRect
GetCursorPos
SetParent
LockWindowUpdate
ValidateRect
BringWindowToTop
CreatePopupMenu
SetRectEmpty
GetSysColorBrush
DrawIconEx
SetWindowRgn
IsZoomed
InflateRect
IsRectEmpty
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
RegisterWindowMessageW
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
GetWindowRgn
DestroyCursor
CreateMenu
MapVirtualKeyExW
IsCharLowerW
CharUpperBuffW
GetKeyNameTextW
EndDialog
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
UnregisterClassW
InvalidateRgn
CharNextW
RegisterClipboardFormatW
EnumChildWindows
CreateAcceleratorTableW
GetMenuState
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
FindWindowW
GetSysColor
SetCursor
KillTimer
SetTimer
RedrawWindow
InvalidateRect
UpdateWindow
GetWindowRect
FillRect
OffsetRect
GetWindowLongW
LoadImageW
IsWindow
SetWindowLongW
GetSystemMetrics
LoadIconW
GetParent
GetClientRect
IsIconic
GetSystemMenu
SendMessageW
AppendMenuW
DrawIcon
MessageBoxIndirectW
EnableWindow
DrawStateW

gdi32

SetTextAlign
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
GetDCOrgEx
CreateRectRgnIndirect
CreatePolygonRgn
CreateRoundRectRgn
CombineRgn
GetBkColor
GetTextColor
PatBlt
MoveToEx
GetTextExtentPoint32W
Polyline
RoundRect
Polygon
GetTextMetricsW
CreateEllipticRgn
Ellipse
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
GetMapMode
DPtoLP
SetDIBColorTable
GetDIBits
RealizePalette
StretchBlt
SetPixel
CreatePalette
GetPaletteEntries
OffsetRgn
GetRgnBox
GetNearestPaletteIndex
GetSystemPaletteEntries
ExtFloodFill
SetPaletteEntries
PtInRegion
FrameRgn
SetPixelV
GetWindowOrgEx
FillRgn
GetBoundsRect
LPtoDP
EnumFontFamiliesExW
GetTextFaceW
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CopyMetaFileW
GetDeviceCaps
GetViewportOrgEx
SetViewportOrgEx
GetStockObject
DeleteObject
CreateSolidBrush
BitBlt
Rectangle
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
SetTextColor
CreateFontIndirectW

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW

shell32

SHBrowseForFolderW
DragFinish
DragQueryFileW
SHAppBarMessage
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW

comctl32

ord17
InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleLockRunning
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance
CLSIDFromProgID
CoFreeUnusedLibraries
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleGetClipboard
RevokeDragDrop
CoRegisterMessageFilter
CoRevokeClassObject
CLSIDFromString
OleInitialize
CoLockObjectExternal
RegisterDragDrop
OleDuplicateData
OleUninitialize
CoUninitialize

oleaut32

SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysStringLen
OleCreateFontIndirect
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdiplusStartup
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePalette
GdipCloneImage

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa37767aeaed30b5c4f00c42d1cb8887

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fbCertificate

Extended Key Usages

Key Usages

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7Signer

Headers

DLL Characteristics

File Characteristics

Imports

wininet

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

imm32

winmm

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 283KB - Virtual size: 283KB

.data Size: 24KB - Virtual size: 52KB

.rsrc Size: 90KB - Virtual size: 89KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fb
Certificate

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 283KB - Virtual size: 283KB

.data
Size: 24KB - Virtual size: 52KB

.rsrc
Size: 90KB - Virtual size: 89KB