4a8303e7cd444cf3742261937604de9a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4a8303e7cd444cf3742261937604de9a_JaffaCakes118
Size

484KB
MD5

4a8303e7cd444cf3742261937604de9a
SHA1

3f6978132dac5d0c58b60c9537395b23f9d363aa
SHA256

98f0cb78e9bee8a397a3cbe0349f58bb91735bdd1a2f7075be982c8cad5645eb
SHA512

c2f55b78d6f6b5f93cb4f7407e1d334da2ab2cc1ca7e49ae9361da99c5ec38bc7224b36783331ec1a3960a98aa7ae61c568c30df3853540e7c6149e0fb6b9dcf
SSDEEP

12288:/PRFYcP84rGkEFzfVXLvf41rQxEgTSE+rdcU3ELq4FvS0nYY6:HR//yzfVXLEy1HWELxP6

Score

1^/10

Malware Config

Signatures

Files

4a8303e7cd444cf3742261937604de9a_JaffaCakes118
.rar
hwmonitor-pro_1.11-32bits/HWMonitorPro.exe
.exe windows:4 windows x86 arch:x86

e5eef170a93209a82a7b6f34b2203b0a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:f2:5a:23:90:6d:e1:bb:fa:2c:46:06:7e:ba:0d:dd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

02/02/2009, 00:00

Not After

07/02/2012, 23:59

Subject

CN=CPUID,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CPUID,L=DUNKERQUE,ST=NORD,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:17:19:49:f9:a7:ca:57:ec:57:fe:e8:82:3d:12:2e:5c:59:3f:0c
Signer

Actual PE Digest

06:17:19:49:f9:a7:ca:57:ec:57:fe:e8:82:3d:12:2e:5c:59:3f:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\cpuid\applications\hwmonitorpro\vc2005\release\HWMonitorPro.pdb

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeGetTime

advapi32

RegOpenKeyExA
CloseServiceHandle
CreateServiceA
RegOpenKeyExW
RegQueryValueW
RegCloseKey
RegQueryValueExA
RegCreateKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
GetFileSecurityW
SetFileSecurityW
RegEnumKeyW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyW
RegSetValueW
OpenSCManagerA
ControlService
StartServiceA
OpenServiceA
DeleteService

ws2_32

shutdown
closesocket
WSAGetLastError
gethostbyname
WSAStartup
WSACleanup
socket
htons
bind
listen
WSAAsyncSelect
connect
send
accept
recv
htonl

kernel32

InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GetFileAttributesW
GetTempFileNameW
GetFullPathNameW
GetDiskFreeSpaceW
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
InterlockedIncrement
lstrlenA
GetThreadLocale
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
MoveFileW
GetStringTypeExW
lstrcmpiW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
FindClose
FindFirstFileW
GetVolumeInformationW
GetShortPathNameW
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetErrorMode
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
VirtualAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetVersionExW
GetTempPathW
WideCharToMultiByte
MultiByteToWideChar
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentDirectoryW
SetCurrentDirectoryW
SetThreadPriority
GetComputerNameW
DeleteFileW
HeapSize
FileTimeToSystemTime
InterlockedDecrement
CreateMutexW
GetLastError
WaitForSingleObject
CloseHandle
ReleaseMutex
Sleep
GetModuleHandleW
ExitThread
GetModuleFileNameW
CreateThread
GlobalAlloc
GlobalFree
GetLocalTime
SystemTimeToFileTime
CreateFileW
GetFileTime
ReadFile
SetFileTime
GetVersion
GlobalGetAtomNameW
GetCurrentProcessId
FormatMessageW
GlobalLock
GlobalUnlock
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
WriteFile
lstrcmpW
LocalAlloc
LocalFree
CreateEventA
GetOverlappedResult
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
WriteConsoleA
GetProcessAffinityMask
GetCurrentThread
GetSystemInfo
GetTempPathA
GetModuleHandleA
FindResourceA
GetWindowsDirectoryA
DeleteFileA
RemoveDirectoryA
GetComputerNameA
CreateFileA
DeviceIoControl
GetCurrentDirectoryA
GetModuleFileNameA
CreateDirectoryA
CreateMutexA
GetVersionExA
GetCurrentProcess
LoadLibraryA
WinExec
lstrlenW
lstrcatW
lstrcpyW
SetLastError
CreateDirectoryW
GetExitCodeProcess
CreateProcessW
MulDiv
SetFilePointer

user32

ReuseDDElParam
UnpackDDElParam
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
ValidateRect
TranslateMessage
GetMessageW
PostQuitMessage
ShowOwnedPopups
GetMenuItemInfoW
SystemParametersInfoW
IsZoomed
LoadCursorW
UnregisterClassW
DeleteMenu
SetParent
CharUpperW
SetRect
WindowFromPoint
GetDCEx
LockWindowUpdate
SetCapture
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetMenuState
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
DestroyMenu
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenu
GetKeyState
SetScrollPos
GetScrollPos
IsWindowVisible
GetMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
SetScrollInfo
GetDlgCtrlID
CallWindowProcW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetSysColorBrush
CreateIconIndirect
CreateCursor
GetSystemMetrics
SetCursor
DrawFocusRect
SetWindowLongW
GetActiveWindow
ReleaseCapture
LoadAcceleratorsW
InsertMenuItemW
SetRectEmpty
BringWindowToTop
SetMenu
GetDesktopWindow
TranslateAcceleratorW
GetWindowThreadProcessId
GetMenuStringW
InsertMenuW
CallNextHookEx
GetSysColor
SetForegroundWindow
GetCursorPos
KillTimer
IsRectEmpty
CopyRect
SetTimer
DestroyIcon
LoadMenuW
LoadIconW
AppendMenuW
CreatePopupMenu
ModifyMenuW
EnableMenuItem
GetSubMenu
InflateRect
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
UpdateWindow
LoadBitmapW
GetWindowRect
IsWindow
PostMessageW
InvalidateRect
PtInRect
GetWindowLongW
EnableWindow
SendMessageW
ReleaseDC
GetClientRect
GetDC
ClientToScreen
GetParent
UnregisterClassA
DefWindowProcW

gdi32

DeleteObject
CreateRectRgnIndirect
CreateDIBSection
SelectObject
Polyline
GetObjectW
CreateBitmap
GetPixel
GetStockObject
CreateFontIndirectW
CreateRectRgn
SelectClipRgn
SetTextColor
SetBkMode
PatBlt
SetTextAlign
TextOutW
DeleteDC
GetClipBox
SetBkColor
SaveDC
RestoreDC
SetMapMode
ExcludeClipRect
CreateFontW
LineTo
MoveToEx
PtVisible
RectVisible
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
CreatePatternBrush
GetDeviceCaps
CreatePen
CreateSolidBrush
SetRectRgn
CombineRgn
GetTextMetricsW
GetBkColor
BitBlt
GetTextExtentPoint32W
CreateCompatibleBitmap
IntersectClipRect
CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

shell32

Shell_NotifyIconW
DragFinish
DragQueryFileW
ExtractIconW
SHGetFileInfoW
ShellExecuteW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathRemoveFileSpecW
PathIsUNCW

ole32

StringFromGUID2
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx

oleaut32

SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantInit
VariantClear
VariantChangeType

Sections

.text
Size: 976KB - Virtual size: 974KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
hwmonitor-pro_1.11-32bits/注册信息.txt

Sharing

General

Malware Config

Signatures

Files

e5eef170a93209a82a7b6f34b2203b0a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

29:f2:5a:23:90:6d:e1:bb:fa:2c:46:06:7e:ba:0d:ddCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

06:17:19:49:f9:a7:ca:57:ec:57:fe:e8:82:3d:12:2e:5c:59:3f:0cSigner

Headers

File Characteristics

PDB Paths

Imports

version

winmm

advapi32

ws2_32

kernel32

user32

gdi32

comdlg32

winspool.drv

shell32

shlwapi

ole32

oleaut32

Sections

.text Size: 976KB - Virtual size: 974KB

.rdata Size: 208KB - Virtual size: 206KB

.data Size: 88KB - Virtual size: 107KB

.rsrc Size: 200KB - Virtual size: 199KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

29:f2:5a:23:90:6d:e1:bb:fa:2c:46:06:7e:ba:0d:dd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

06:17:19:49:f9:a7:ca:57:ec:57:fe:e8:82:3d:12:2e:5c:59:3f:0c
Signer

.text
Size: 976KB - Virtual size: 974KB

.rdata
Size: 208KB - Virtual size: 206KB

.data
Size: 88KB - Virtual size: 107KB

.rsrc
Size: 200KB - Virtual size: 199KB