6f8b5ff8c8bdf32a9b24b7aa304c0cbb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6f8b5ff8c8bdf32a9b24b7aa304c0cbb_JaffaCakes118
Size

15.7MB
MD5

6f8b5ff8c8bdf32a9b24b7aa304c0cbb
SHA1

62080d19a2d56cc6bd3b3afcf6a7b91c8f859471
SHA256

2a4fabfce3f3247d1d0275478eeca4d6d09360d3238911cb69ea86c9c0a2d06e
SHA512

c0bef95cf056d60df0a9f427db8ce02be0fd6ef509287bb84d9f5315aef4064dd01147b35ee9ff995cdd82f141d328dd12281e5ff0a012b9ed541c3a9bbc1209
SSDEEP

393216:qcoqZpo7jTk+TLbfCxFQ/dnX6EEBq4IRZfIwCfctL0e92:xvm7jTkUL8QgEEB+iNCbw

Score

1^/10

Malware Config

Signatures

Files

6f8b5ff8c8bdf32a9b24b7aa304c0cbb_JaffaCakes118
.rar
wnwb_800_50.exe
.exe windows:4 windows x86 arch:x86

2c11b63efa25efc86391ede66abf5554

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

9f:cf:2b:3a:2c:32:b2:8a:ca:83:da:d0:c3:12:a8:6a
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

26/10/2009, 00:00

Not After

25/10/2012, 23:59

Subject

CN=深圳市世强电脑科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=深圳市世强电脑科技有限公司,L=深圳市,ST=广东省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

81:94:08:d8:d8:60:2a:ba:4e:d8:79:cf:37:e4:75:7b:1f:34:6e:ed
Signer

Actual PE Digest

81:94:08:d8:d8:60:2a:ba:4e:d8:79:cf:37:e4:75:7b:1f:34:6e:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\Wnsoft\WnInstall(wnwg)\WnInstall\Release\WnInstall.pdb

Imports

kernel32

SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
SetStdHandle
DebugBreak
GetEnvironmentStringsW
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InterlockedExchange
UnhandledExceptionFilter
GetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapSize
HeapReAlloc
GetModuleFileNameA
CreateFileA
GetFileType
GetSystemTimeAsFileTime
ExitThread
RtlUnwind
ExitProcess
GetStartupInfoW
GetFileTime
GetFileAttributesW
SetErrorMode
GetCurrentDirectoryW
GetCommandLineW
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
GlobalFlags
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetFullPathNameW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
ReadFile
InterlockedDecrement
GetModuleFileNameW
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
FileTimeToLocalFileTime
FileTimeToSystemTime
MulDiv
lstrcpynW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrlenA
GetModuleHandleA
LoadLibraryA
lstrcmpW
GetVersionExA
GlobalLock
GlobalUnlock
FreeResource
lstrcpyW
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetTickCount
GlobalFree
GlobalAlloc
SetLastError
FormatMessageW
GetVolumeInformationW
GetCommandLineA
lstrlenW
lstrcatW
Sleep
GetCurrentThread
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleW
HeapFree
GetCurrentProcess
LoadLibraryW
GetProcAddress
FreeLibrary
GetTempPathW
CreateThread
GetExitCodeThread
TerminateThread
CopyFileW
MoveFileExW
LocalAlloc
lstrcmpiW
LocalFree
DeviceIoControl
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
GetSystemDirectoryW
RemoveDirectoryW
GetWindowsDirectoryW
SetFileAttributesW
GetExitCodeProcess
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
CreateDirectoryW
GetPrivateProfileStringW
FindFirstFileW
GetFileSize
DeleteFileW
FindNextFileW
FindClose
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
CreateFileW
SetFilePointer
CreateProcessW
WaitForSingleObject
CloseHandle
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP

user32

MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
ReleaseCapture
SetCapture
DestroyMenu
GetSysColorBrush
SetWindowContextHelpId
MapDialogRect
wsprintfW
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
MessageBoxW
GetKeyState
SetForegroundWindow
IsWindowVisible
UpdateWindow
GetMenu
PostMessageW
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetSysColor
AdjustWindowRectEx
EqualRect
RegisterClipboardFormatW
PostThreadMessageW
GetClassInfoW
RegisterClassW
UnregisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
GetWindow
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
ExitWindowsEx
GetFocus
GetDlgItem
GetSystemMetrics
LoadIconW
GetClientRect
IsIconic
DrawIcon
CharUpperW
GetKeyboardLayoutList
LoadCursorW
SetCursor
ClientToScreen
GetWindowRect
SendMessageW
EnableWindow

gdi32

PtVisible
RectVisible
ExtTextOutW
Escape
GetRgnBox
GetTextColor
GetBkColor
GetMapMode
CreateRectRgnIndirect
GetDeviceCaps
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
TextOutW
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
CreateFontW
CreateSolidBrush
GetClipBox
SetTextColor
SetBkColor
GetObjectW
CreateBitmap
SaveDC
RestoreDC
SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyW
RegCreateKeyExW
RegCreateKeyExA
SetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegSetValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW

comctl32

ord17
ImageList_Destroy

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
StgOpenStorageOnILockBytes
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
CoRegisterMessageFilter
OleFlushClipboard

oleaut32

SysAllocStringLen
OleCreateFontIndirect
SysAllocString
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString

imm32

ImmGetIMEFileNameW

cabinet

ord23
ord21
ord22
ord20

Sections

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15.7MB - Virtual size: 15.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

2c11b63efa25efc86391ede66abf5554

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

9f:cf:2b:3a:2c:32:b2:8a:ca:83:da:d0:c3:12:a8:6aCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

81:94:08:d8:d8:60:2a:ba:4e:d8:79:cf:37:e4:75:7b:1f:34:6e:edSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

imm32

cabinet

Sections

.text Size: 340KB - Virtual size: 339KB

.rdata Size: 84KB - Virtual size: 81KB

.data Size: 12KB - Virtual size: 25KB

.rsrc Size: 15.7MB - Virtual size: 15.7MB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

9f:cf:2b:3a:2c:32:b2:8a:ca:83:da:d0:c3:12:a8:6a
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

81:94:08:d8:d8:60:2a:ba:4e:d8:79:cf:37:e4:75:7b:1f:34:6e:ed
Signer

.text
Size: 340KB - Virtual size: 339KB

.rdata
Size: 84KB - Virtual size: 81KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 15.7MB - Virtual size: 15.7MB