214eed6e74342512fbd4f4123f3b1617_JaffaCakes118
- SHA256 e17c91f4f5703e89a501c051a88e7c36ac74ac87df9eeffb689e5006444516b9
Static task
static1
Behavioral task
behavioral1
Sample
JiangMinDesktopCleaner.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
JiangMinDesktopCleaner.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 214eed6e74342512fbd4f4123f3b1617_JaffaCakes118
- Size 87KB
- Sample240703-gn455sthrn
- SHA256 e17c91f4f5703e89a501c051a88e7c36ac74ac87df9eeffb689e5006444516b9
- MD5 214eed6e74342512fbd4f4123f3b1617
- SHA1 8775a57ccac8f7678792022cbca30083ef4aafb9
- SHA512 9e54b769ae1b2722a49b65cd86cb2a7fa594c18bc40ceb873852a61d65f609c982466979ee4003d04bfdaa6e0b2eeb3d719374e49c06f3d97957272c3e0abea6
- SSDEEP 1536:pBcrgcF4O8d7Hmamd/auFLb97f0yBMtpe8HO2nw7eBWjpoJ2YXrTPPMM+/T:pyrlFhEGdCuFLEwcsaLrjPMh
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
214eed6e74342512fbd4f4123f3b1617_JaffaCakes118.rar 87KB
-
JiangMinDesktopCleaner.exe.exe 189KB
JiangMinDesktopCleaner.exe
- IMPHASH 9f9c761f66e566a2c33ad673278ddc72
- SHA256 8185e3b4c783777bdfc1bcac2b7a6373e6216341541b1a8b33a12f41e7df0de3
- MD5 145816e24f2ce44bb56231dbc31fa776
- SHA1 7631facbd3672da1b43c3c74ec1acc62e5c81675
- SHA512 f48c2e2b28683a3ed5be3a478205800d937b7f7301c5f0a845612d0501f664896387f1e2730a10f570f3d6d2159a3b5a4b32617f2c102ab3791092064430019f
- SSDEEP 3072:s828FALTNwvdFnbY2aKI0KP00Ygt+Ca8ogbxSnRPe:mwvjb400UC5Ss
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
62:ef:64:64:04:78:a0:c5:07:7d:4c:87:c5:2a:76:30:0f:bf:2b:82
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN
Chains
Feb 5, 2010
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
CN=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Jiangmin New Sci.&Tec. Co. Ltd.,ST=Beijing,C=CN
Serial Number
0a:f9:9d:85:f0:a1:1e:ff:98:4d:ca:48:4e:28:99:a4
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 14, 2007 - Jul 12, 2010
Minor OS version
0
Major OS version
4
Entry point
45059
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
urlmon
URLDownloadToFileW
kernel32
CloseHandle
WaitForSingleObject
CreateProcessW
LocalFree
WriteFile
CreateFileW
SetFileAttributesW
lstrcatW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
Sleep
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetOEMCP
GetCPInfo
ExitProcess
RtlUnwind
IsDebuggerPresent
TerminateProcess
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
CreateThread
ResumeThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsW
LoadLibraryW
GetSystemDirectoryW
lstrcpyW
FindResourceExW
LockResource
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FindResourceW
HeapAlloc
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
CompareStringW
SetLastError
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
GetProcessHeap
HeapFree
InterlockedCompareExchange
RaiseException
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
user32
GetSystemMetrics
GetActiveWindow
DialogBoxParamW
MessageBoxW
PostQuitMessage
IsDialogMessageW
GetDlgItem
LoadImageW
LoadIconW
LoadStringW
GetClassNameW
LoadCursorW
OffsetRect
ReleaseDC
GetDC
EndPaint
BeginPaint
GetSysColor
GetCapture
ReleaseCapture
TrackPopupMenu
GetCursorPos
PtInRect
SetCursor
UnregisterClassA
SetRect
IsWindow
GetDlgCtrlID
SetFocus
SetCapture
IsWindowEnabled
InvalidateRect
UpdateWindow
ScreenToClient
BringWindowToTop
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateWindowExW
DrawStateW
FillRect
DrawTextW
SendMessageW
CreateDialogParamW
DestroyWindow
SetRectEmpty
CharNextW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ShowWindow
SetWindowLongW
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
GetParent
GetWindowLongW
EndDialog
CallWindowProcW
gdi32
GetStockObject
CreateFontIndirectW
DeleteDC
GetObjectW
SetTextColor
SetBkMode
SelectObject
DeleteObject
advapi32
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegSetValueW
RegCreateKeyW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
RegEnumKeyW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyW
shell32
ExtractIconW
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
StrToIntW
StrStrIA
PathFindExtensionW
PathFileExistsW
StrStrIW
comctl32
ImageList_Create
ImageList_ReplaceIcon
_TrackMouseEvent
InitCommonControlsEx
Name
.text
Size
80KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
72KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=109, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=230, id=1, productName=Unmarked objects,
count=63, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,