259959bcf5eb84152d0797be06287e39_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

259959bcf5eb84152d0797be06287e39_JaffaCakes118
Size

754KB
MD5

259959bcf5eb84152d0797be06287e39
SHA1

ad5dd9ecb2f2b6e64449b335014bb95411d5dbb7
SHA256

86726c75fe6473aef8ec9228e83aa59b12885031fe2aee6b5bd4be99401acc86
SHA512

e13e9eb52e90343bc3241ca9c564619b6f04ed40fab6bc2150fcc3ddd4619bd7ce218ac1f0d2b4ea8a6b530a72eb3e59cd92190cab84c4b1a32f677442a83a55
SSDEEP

12288:kIM3VP7HyrzEBf8V/eaC8W4ah2Ig4COeVgiTLRavoDKw5ie2:kvVLyrzEBf8deaC8o2Ig4CzhTLRav9p

Score

1^/10

Malware Config

Signatures

Files

259959bcf5eb84152d0797be06287e39_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

4e37e2ffbd35d63c4d78bd455882d145

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2011, 00:00

Not After

14/03/2014, 23:59

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9a:7e:00:c8:c6:c1:7e:cc:77:d0:20:1a:8a:6f:f0:8b:bf:96:2d:d8
Signer

Actual PE Digest

9a:7e:00:c8:c6:c1:7e:cc:77:d0:20:1a:8a:6f:f0:8b:bf:96:2d:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
GetFileSize
GetCurrentProcessId
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
ReadFile
GetTimeZoneInformation
GetCurrentProcess
WaitForSingleObject
OutputDebugStringW
WriteFile
DeleteFileW
GetCurrentThreadId
SetLastError
FlushInstructionCache
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
ReleaseMutex
CreateDirectoryW
GetShortPathNameW
GetTempPathW
SetFilePointer
GetTickCount
CreateEventW
SetEvent
CreateProcessW
MoveFileExW
LoadLibraryExW
GlobalUnlock
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetFileAttributesA
CreateProcessA
GetExitCodeProcess
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetFullPathNameW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GlobalLock
GlobalAlloc
GetCurrentDirectoryA
GetFullPathNameA
Process32NextW
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesW
SetHandleCount
LCMapStringA
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
RtlUnwind
GetDriveTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
GetConsoleMode
GetConsoleCP
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
GetCommandLineA
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
FindResourceA
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileAttributesExW
CompareFileTime
FileTimeToSystemTime
GetVersion
GetSystemInfo
GetVersionExW
GetTempFileNameW
GlobalFree
ReleaseSemaphore
ResumeThread
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
GetSystemDefaultLCID
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
SetErrorMode
lstrlenA
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
FindResourceExW
WideCharToMultiByte
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
GetProcAddress
GetThreadLocale
GetLastError
SetThreadLocale
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
GetStartupInfoA
InterlockedIncrement
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
FlushFileBuffers
CreateThread

psapi

EnumProcesses
GetProcessImageFileNameW

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
socket
gethostname
ioctlsocket
getaddrinfo
freeaddrinfo
select
__WSAFDIsSet
WSASetLastError
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

IsWindow
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
GetCursor
ReleaseCapture
TrackPopupMenu
GetCursorPos
PostMessageW
PostQuitMessage
KillTimer
SetTimer
UnregisterClassA
BeginPaint
DestroyMenu
NotifyWinEvent
FindWindowW
GetParent
GetAncestor
SetFocus
CreateDialogParamW
LoadImageW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SystemParametersInfoW
SetWindowsHookExW
DrawTextW
ScreenToClient
SetMenuItemInfoW
IsWindowVisible
SetForegroundWindow
SetCursor
ClientToScreen
GetWindowRect
SendDlgItemMessageW
EnableMenuItem
GetSystemMenu
EnableWindow
SetDlgItemTextW
MessageBoxW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetDesktopWindow
CharNextW
FillRect
InvalidateRect
GetAsyncKeyState
EndPaint
DrawFocusRect
GetForegroundWindow
ReleaseDC
GetDC
GetSysColorBrush
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
SetWindowPos
MoveWindow
GetClientRect
SetWindowTextW
SendMessageW
LoadIconW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetDlgItem
ShowWindow
EnumWindows
EnumChildWindows
GetWindowTextW
GetWindowTextLengthW

gdi32

CreateSolidBrush
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32W
SelectObject
CreateDIBSection
SetBkMode
SetTextColor
CreateFontIndirectW
GetObjectW
DeleteObject
DeleteDC
GetDeviceCaps
GetStockObject
GdiFlush

advapi32

RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
RegDeleteValueA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
DuplicateTokenEx
GetUserNameW
RegEnumKeyW

shell32

Shell_NotifyIconW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitializeEx
CoSetProxyBlanket
CoUninitialize
CLSIDFromProgID
CoInitialize
CoCreateGuid
StringFromGUID2
CoTaskMemRealloc
CoInitializeSecurity
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantClear
VariantChangeType
LoadRegTypeLi
SysFreeString
SysAllocStringLen
VariantInit
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString

comctl32

InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW
InternetGetConnectedStateExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
OCPRD404CanLeaveOfferPage
OCPRD404CleanupProduct
OCPRD404Detach
OCPRD404FindGuidAndRunDialog
OCPRD404FindGuidAndRunDialogA
OCPRD404GetAsyncOfferStatus
OCPRD404GetBannerInfo
OCPRD404GetBannerInfoW
OCPRD404GetMsg
OCPRD404GetNoCandy
OCPRD404GetOfferState
OCPRD404GetOfferType
OCPRD404Init2A
OCPRD404Init2W
OCPRD404InnoAdjust
OCPRD404InnoRestore
OCPRD404InstallShieldAdjust
OCPRD404LoadOpenCandyDLL
OCPRD404LogDevModeMessage
OCPRD404LogDevModeMessageW
OCPRD404NSISAdjust
OCPRD404PreInit
OCPRD404PrepareDownload
OCPRD404RunDialog
OCPRD404SetClientAdvancedOptions
OCPRD404SetClientAdvancedOptionsW
OCPRD404SetCmdLineValues
OCPRD404SetCmdLineValuesW
OCPRD404SetCustomBrushColor
OCPRD404SetCustomBrushColorW
OCPRD404SetNoCandy
OCPRD404SetOCOfferEnabled
OCPRD404SetOfferData
OCPRD404SetOfferLocation
OCPRD404SetUseDefaultColorBkGrnd
OCPRD404Shutdown
OCPRD404SignalProductFailed
OCPRD404SignalProductInstalled
OCPRD404StartDLMgr2Download
OCPRD404StartDLMgr2DownloadRunasAdmin
_OCPRD404DLMgr2Check@16
_OCPRD404Display@16
_OCPRD404DownloadMgr2RecycleOffer@12
_OCPRD404MgrCheck@16
_OCPRD404MgrExec@16
_OCPRD404RestartDll@16
_OCPRD404RestartDllAsAdmin@16
_OCPRD404RunOpenCandyDLL@16

Sections

.text
Size: 508KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e37e2ffbd35d63c4d78bd455882d145

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

9a:7e:00:c8:c6:c1:7e:cc:77:d0:20:1a:8a:6f:f0:8b:bf:96:2d:d8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

psapi

ws2_32

msimg32

shlwapi

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

version

urlmon

wininet

Exports

Exports

Sections

.text Size: 508KB - Virtual size: 508KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 9KB - Virtual size: 19KB

.rsrc Size: 38KB - Virtual size: 38KB

.reloc Size: 31KB - Virtual size: 30KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

9a:7e:00:c8:c6:c1:7e:cc:77:d0:20:1a:8a:6f:f0:8b:bf:96:2d:d8
Signer

.text
Size: 508KB - Virtual size: 508KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 31KB - Virtual size: 30KB