26626c8a4031f423180ff2d5e17d5320_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

26626c8a4031f423180ff2d5e17d5320_JaffaCakes118
Size

567KB
MD5

26626c8a4031f423180ff2d5e17d5320
SHA1

ecc471daf02b3212d05262909fe7bbf4b75eaabc
SHA256

62496456494fe1f71d88d1a4c4aadef1bc2e18550d17bbc4a8ba6e16af2ab49e
SHA512

7c238af72cd8d661f5843103b0384a06958faf0d3ee042ce39d65a8379ef38676962f4ce2e2479946ddfbc078afb9694166f3ba62f24442e6e815ae0b022ded4
SSDEEP

3072:r2n07n0ATdBi/Eq8p9/w4Rpl+a1WP1ifLXsOo+Z9X2GQ84+QwG+fJvkjhIIDkwFS:rzi/Eq8pR/ou9XRbQwGeHBIzm

Score

1^/10

Malware Config

Signatures

Files

26626c8a4031f423180ff2d5e17d5320_JaffaCakes118
.dll windows:6 windows x86 arch:x86

2027312e2a8d78a0ee6c6771a7c7fcde

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:e7:15
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

01/01/2014, 07:00

Not After

30/05/2031, 07:00

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:ac:03:7a:a8:1d:63:fd
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

28/06/2017, 23:20

Not After

25/08/2020, 17:00

Subject

CN=Foxit Software Incorporated,O=Foxit Software Incorporated,L=Fremont,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:d3:78:fa:a7:c5:e8:06:19:5e:ad:08:f5:30:40:06:2e:c9:4c:46
Signer

Actual PE Digest

bf:d3:78:fa:a7:c5:e8:06:19:5e:ad:08:f5:30:40:06:2e:c9:4c:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Jenkins\workspace\Persion_Editor_Plugin_9.6\Starship\9.6-release-fxnet-per\librel\pdb\plugins\CommentsSummary.pdb

Imports

mfc140u

ord7654
ord6129
ord6490
ord4219
ord1066
ord9126
ord2385
ord6751
ord12348
ord14604
ord12405
ord14657
ord2224
ord997
ord1474
ord3696
ord3697
ord5533
ord8776
ord5422
ord14234
ord4477
ord5425
ord13471
ord3833
ord9139
ord6531
ord3404
ord3403
ord458
ord10472
ord11396
ord11015
ord9040
ord1111
ord12172
ord9210
ord2760
ord13752
ord6218
ord12131
ord7493
ord6497
ord3147
ord4222
ord8744
ord2993
ord3872
ord1722
ord9128
ord2256
ord6499
ord11014
ord9039
ord5962
ord365
ord4091
ord6825
ord3246
ord3362
ord13901
ord1433
ord1045
ord5586
ord4715
ord995
ord6349
ord14668
ord6350
ord14669
ord6348
ord14667
ord11982
ord11983
ord2034
ord4090
ord9398
ord12541
ord12542
ord3265
ord3372
ord3371
ord4974
ord5019
ord4942
ord4954
ord4960
ord4966
ord4936
ord12258
ord12262
ord3145
ord2378
ord296
ord6220
ord3164
ord486
ord1744
ord1770
ord1756
ord1777
ord5003
ord4948
ord5013
ord4997
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord12168
ord4886
ord1002
ord8773
ord4881
ord1412
ord12641
ord13256
ord928
ord2383
ord266
ord265
ord8470
ord7653
ord1472
ord8386
ord12247
ord10433
ord12928
ord12865
ord4589
ord7997
ord8324
ord5357
ord2486
ord14589
ord7922
ord14595
ord4152
ord12947
ord7941
ord14466
ord12531
ord8000
ord6860
ord3852
ord5918
ord12239
ord8217
ord12251
ord12219
ord4092
ord5249
ord5549
ord5760
ord9350
ord5525
ord5763
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10250
ord9209
ord1052
ord324
ord2246
ord4735
ord2886
ord1144
ord13756
ord3305
ord3302
ord10255
ord8210
ord2761
ord1476
ord14785
ord10285
ord10287
ord503
ord1511
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord12089
ord3838
ord11936
ord14588
ord8965
ord12220
ord6978
ord11002
ord9256
ord3266
ord7820
ord13878
ord1070
ord3849
ord1514
ord325
ord1053
ord2365
ord2408
ord2411
ord2376
ord2410
ord485
ord2268
ord2374
ord2184
ord2300
ord2399
ord1513

kernel32

SizeofResource
FindResourceW
LoadResource
SetLastError
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
DeleteFileW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
LockResource
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
OutputDebugStringA
OutputDebugStringW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
DecodePointer
CreateEventW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent

user32

InvalidateRect
DrawFocusRect
FillRect
GetSystemMetrics
InflateRect
LoadBitmapW
UnregisterClassW
EnableWindow
CopyRect
SendMessageW
DrawFrameControl
GetFocus

gdi32

DeleteObject
CreateSolidBrush
GetObjectW
GetBitmapBits
CreateBitmap
GetDeviceCaps
CreateCompatibleBitmap

advapi32

RegSetValueExW
RegQueryValueExW
RegOpenKeyW
RegCreateKeyExW
RegCloseKey

oleaut32

SysFreeString

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

vcruntime140

memcpy
memset
memmove
_CxxThrowException
memchr
strchr
__std_terminate
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

malloc
_recalloc
free

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo
_errno

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-convert-l1-1-0

_wtoi
_itow_s

Exports

Exports

PlugInMain

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2027312e2a8d78a0ee6c6771a7c7fcde

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:e7:15Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

36:ac:03:7a:a8:1d:63:fdCertificate

Extended Key Usages

Key Usages

bf:d3:78:fa:a7:c5:e8:06:19:5e:ad:08:f5:30:40:06:2e:c9:4c:46Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc140u

kernel32

user32

gdi32

advapi32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 143KB

.rdata Size: 38KB - Virtual size: 38KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 362KB - Virtual size: 361KB

.reloc Size: 13KB - Virtual size: 13KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:e7:15
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

36:ac:03:7a:a8:1d:63:fd
Certificate

bf:d3:78:fa:a7:c5:e8:06:19:5e:ad:08:f5:30:40:06:2e:c9:4c:46
Signer

.text
Size: 144KB - Virtual size: 143KB

.rdata
Size: 38KB - Virtual size: 38KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 362KB - Virtual size: 361KB

.reloc
Size: 13KB - Virtual size: 13KB