0f225c700f5cb5915c65a6bd5a8728c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0f225c700f5cb5915c65a6bd5a8728c7_JaffaCakes118
Size

1.3MB
MD5

0f225c700f5cb5915c65a6bd5a8728c7
SHA1

8c5770d9794439ea6a44960096b3dec1c618785e
SHA256

b21bb7767ff267e0476f54e53c3861ff6a2f812e9d20267f760bbd289314681d
SHA512

e35572007efede662c6be4c99d89729e361ee59fc369c33357118361a5d87ed9c3adc4368310e5d0c49897de217f90d92ff2236c642ccce01a7c7e68f53d7603
SSDEEP

24576:xDag7K9uuKPmihN+ALG2UmD9MlMlMlusAvO:QhJLaDS2U69MlMlMluo

Score

1^/10

Malware Config

Signatures

Files

0f225c700f5cb5915c65a6bd5a8728c7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3775e09956d5cd3611aa7d603a79067d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:57:34:6b:75:53:24:5d:37:eb:d1:f8:4a:52:b3:a3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/12/2009, 00:00

Not After

11/12/2011, 23:59

Subject

CN=Logitech,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Control Devices,O=Logitech,L=FREMONT,ST=CALIFORNIA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9b:82:7d:dc:4f:26:2c:88:5c:3c:16:ed:a4:12:97:84:16:ba:3a:ba
Signer

Actual PE Digest

9b:82:7d:dc:4f:26:2c:88:5c:3c:16:ed:a4:12:97:84:16:ba:3a:ba

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Build\LU\LU_2.10\2.10.38\Sources\LuUpdater\release\LogitechUpdate.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
InterlockedIncrement
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
ExitThread
RaiseException
ExitProcess
SetStdHandle
GetFileType
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
FreeResource
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
VirtualAlloc
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
LocalAlloc
GetFileTime
GetFileAttributesW
SetFileAttributesW
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
SetFilePointer
GetThreadLocale
DeleteFileW
MoveFileW
GlobalAddAtomW
GlobalDeleteAtom
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
SetThreadAffinityMask
GetDiskFreeSpaceExW
GetSystemPowerStatus
QueryPerformanceFrequency
TerminateThread
GetLocaleInfoW
CompareStringA
InterlockedExchange
lstrcmpW
GetModuleHandleA
InterlockedDecrement
lstrlenA
lstrcmpA
MulDiv
SuspendThread
SetThreadPriority
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
OutputDebugStringW
GlobalLock
GlobalUnlock
CopyFileW
Sleep
VerifyVersionInfoW
VerSetConditionMask
GetSystemInfo
GetModuleHandleW
GlobalAlloc
SetEnvironmentVariableW
GetCurrentProcess
GetCurrentThread
IsBadWritePtr
GlobalFree
LocalFree
GetVersionExW
IsBadCodePtr
FreeLibrary
GetProcAddress
LoadLibraryW
GetTickCount
lstrlenW
CreateThread
ReadFile
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
PeekNamedPipe
FlushFileBuffers
WriteFile
WaitNamedPipeW
CreateFileW
CreateMutexW
ResumeThread
ReleaseMutex
FormatMessageW
SetWaitableTimer
CancelWaitableTimer
CreateWaitableTimerW
GetModuleFileNameW
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
InitializeCriticalSection
ResetEvent
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
LoadResource
LockResource
SizeofResource
SetLastError
GetHandleInformation
GetLastError
WaitForMultipleObjectsEx
SetEvent
OpenEventW
FindResourceW
WaitForSingleObject
WaitForMultipleObjects
CreateEventW
GetCurrentThreadId
GetExitCodeProcess
CloseHandle
GetStartupInfoA
InterlockedCompareExchange

user32

DestroyMenu
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetTopWindow
DestroyWindow
GetMessageTime
MapWindowPoints
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
DefWindowProcW
SystemParametersInfoA
GetWindowPlacement
CharUpperW
GetWindowTextLengthW
GetWindowTextW
SetFocus
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
GetWindow
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
MessageBoxW
GetSysColor
EndPaint
ClientToScreen
GrayStringW
TabbedTextOutW
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
GetMenuState
CheckMenuItem
SetWindowsHookExW
UnregisterClassA
wsprintfW
AttachThreadInput
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
GetKeyState
PeekMessageW
ValidateRect
DrawIcon
IsIconic
TrackPopupMenu
SetMenuDefaultItem
AppendMenuW
CreatePopupMenu
PostQuitMessage
SetActiveWindow
SetWindowLongW
CallWindowProcW
GetCursorPos
ScreenToClient
GetMessagePos
DestroyCursor
ReleaseDC
GetDC
SetCursor
LoadCursorW
FrameRect
GetSysColorBrush
UnregisterClassW
FillRect
DrawTextExW
SetForegroundWindow
SetWindowPos
CopyRect
GetDesktopWindow
IsRectEmpty
BringWindowToTop
IsWindowVisible
InvalidateRect
OffsetRect
SystemParametersInfoW
EnableMenuItem
EnableWindow
GetSystemMenu
GetMenu
GetWindowLongW
AdjustWindowRectEx
GetParent
GetClientRect
LoadIconW
InflateRect
GetSystemMetrics
MonitorFromPoint
SetRect
GetWindowRect
PtInRect
DrawTextW
GetForegroundWindow
FindWindowW
PostThreadMessageW
SendMessageW
IsWindow
SetTimer
KillTimer
PostMessageW
BeginPaint

gdi32

SetWindowExtEx
ScaleWindowExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetTextExtentExPointW
GetObjectW
CreateFontW
GetClipBox
SetMapMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
CreateBrushIndirect
GetTextExtentPoint32W
GetStockObject
SetBkMode
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
SetTextColor
DeleteObject
CreateSolidBrush
CombineRgn
CreateRectRgnIndirect
FillRgn
DeleteDC
GetDeviceCaps
SetViewportExtEx
SetViewportOrgEx

msimg32

GradientFill

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

CryptAcquireContextW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
CryptReleaseContext
CryptVerifySignatureW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptImportKey
SetFileSecurityW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
RegFlushKey
RegCreateKeyExW
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHCreateDirectoryExW
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
PathFindExtensionW
PathCanonicalizeW

ole32

CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoUninitialize
StringFromGUID2

oleaut32

VariantClear
VariantChangeType
VariantInit

gdiplus

GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipFree
GdipGetImageHeight
GdipGetImageWidth
GdiplusStartup
GdipCreateBitmapFromStreamICM
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageI
GdipAlloc

wininet

InternetOpenUrlW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
HttpQueryInfoW
InternetGetConnectedState
InternetCheckConnectionW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetQueryOptionW
InternetSetOptionExW
InternetQueryDataAvailable

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

msi

ord96
ord72
ord232
ord8

Sections

.text
Size: 695KB - Virtual size: 694KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3775e09956d5cd3611aa7d603a79067d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

59:57:34:6b:75:53:24:5d:37:eb:d1:f8:4a:52:b3:a3Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

9b:82:7d:dc:4f:26:2c:88:5c:3c:16:ed:a4:12:97:84:16:ba:3a:baSigner

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

wininet

setupapi

msi

Sections

.text Size: 695KB - Virtual size: 694KB

.rdata Size: 278KB - Virtual size: 278KB

.data Size: 15KB - Virtual size: 41KB

.rsrc Size: 165KB - Virtual size: 165KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

59:57:34:6b:75:53:24:5d:37:eb:d1:f8:4a:52:b3:a3
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

9b:82:7d:dc:4f:26:2c:88:5c:3c:16:ed:a4:12:97:84:16:ba:3a:ba
Signer

.text
Size: 695KB - Virtual size: 694KB

.rdata
Size: 278KB - Virtual size: 278KB

.data
Size: 15KB - Virtual size: 41KB

.rsrc
Size: 165KB - Virtual size: 165KB