7913a26585666b58e4b85eb24856ac1f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7913a26585666b58e4b85eb24856ac1f_JaffaCakes118
Size

1.4MB
MD5

7913a26585666b58e4b85eb24856ac1f
SHA1

b2f980dc2557ae01f44d5fc330f1e5f9ab7ebc7c
SHA256

9d5f2ce48ee74adf1a0b7d8559f67aaf4d4908ace9e145895587155175bedeb7
SHA512

7220c1caaa3f44570f6807aa44e672a82da9fc078b1e3dcb63bfd1255818fce2b71e185ce0725a8dca8b9f40ded71bfc726195dcb65a38b566e374cd2e702a7d
SSDEEP

24576:NLDHM9nGbkYpxe3BUAUg4WM0an2JcsoVfVBw6xvOf7YnXaH8Af:RM9mkex1AUuMX2JcsoBVW6v68Af

Score

1^/10

Malware Config

Signatures

Files

7913a26585666b58e4b85eb24856ac1f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5fd3502af2a53c0f8ee5a681a12c1652

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:15:eb:45:51:67:ac:c7:05:9b:15:3c:1e:7c:fe:10
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

20/06/2009, 00:00

Not After

09/07/2012, 23:59

Subject

CN=VINAGAME SOFTWARE SERVICE JOINT STOCK COMPANY,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=VINAGAME SOFTWARE SERVICE JOINT STOCK COMPANY,L=Ho Chi Minh city,ST=Ho Chi Minh city,C=VN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:f4:a8:be:68:e7:17:f2:66:45:c6:2c:63:41:68:7c:63:f0:8f:9f
Signer

Actual PE Digest

cb:f4:a8:be:68:e7:17:f2:66:45:c6:2c:63:41:68:7c:63:f0:8f:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SourceControl\AUS-TOM\JX2\Public\AutoUpdate.pdb

Imports

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
RaiseException
HeapReAlloc
ExitProcess
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStartupInfoW
GetStringTypeA
GetStringTypeW
TerminateProcess
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFileTime
GetFileSizeEx
SetFileTime
SetErrorMode
GetProcessHeap
InterlockedCompareExchange
CreateToolhelp32Snapshot
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
RemoveDirectoryW
GetLocalTime
lstrcpynW
OpenProcess
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
GetFileSize
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapAlloc
GetUserDefaultLCID
HeapFree
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GlobalFlags
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrlenA
GetThreadLocale
FindFirstFileW
FileTimeToLocalFileTime
FindNextFileW
FindClose
GetModuleHandleA
InterlockedDecrement
GlobalAddAtomW
GlobalFindAtomW
LoadLibraryA
GetVersionExA
GetCurrentProcessId
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
lstrcmpW
SetLastError
FormatMessageW
MulDiv
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalFree
LocalAlloc
InterlockedIncrement
MultiByteToWideChar
GetVersionExW
SetFileAttributesW
GlobalMemoryStatus
FreeLibrary
GetDiskFreeSpaceW
GetProcAddress
GetDriveTypeW
GetLogicalDrives
LoadLibraryW
CompareStringW
WinExec
lstrcatW
GetCurrentDirectoryW
Sleep
GlobalFree
GlobalUnlock
FreeResource
GlobalLock
GlobalAlloc
lstrcpyW
GetModuleHandleW
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileAttributesW
DeleteFileW
SystemTimeToFileTime
GetTickCount
MoveFileExW
CopyFileW
WriteFile
WideCharToMultiByte
CreateProcessW
CreateFileW
lstrcmpiW
GetFullPathNameW
lstrlenW
WaitForSingleObject
CreateThread
InterlockedExchange
CreateDirectoryW
SetCurrentDirectoryW
CreateMutexW
LockResource
SizeofResource
LoadResource
FindResourceW
GetLastError
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
CloseHandle

user32

PostThreadMessageW
UnregisterClassW
CharUpperW
GetSysColorBrush
RegisterClipboardFormatW
CharNextW
EndPaint
BeginPaint
GetWindowDC
DestroyMenu
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
MessageBeep
GetNextDlgGroupItem
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetMessageW
DispatchMessageW
TranslateMessage
LoadIconW
CallWindowProcW
GetMenu
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowTextLengthW
GetWindowTextW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
SendDlgItemMessageW
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxW
SetWindowContextHelpId
MapDialogRect
GetMenuState
GetSystemMenu
AppendMenuW
EnumWindows
EnumChildWindows
SendMessageW
SetWindowLongW
GetWindowLongW
SetLayeredWindowAttributes
GetParent
PostMessageW
FindWindowW
GetWindow
GetDlgCtrlID
GetWindowRect
SetWindowRgn
PostQuitMessage
SetTimer
EnableWindow
LoadImageW
GetDC
ReleaseDC
ReleaseCapture
SetWindowPos
UpdateLayeredWindow
GetClientRect
GetDlgItem
GetDlgItemTextW
OffsetRect
DefWindowProcW
LoadCursorW
RegisterClassExW
GetSystemMetrics
FrameRect
InflateRect
InvalidateRect
UpdateWindow
KillTimer
TrackMouseEvent
GetMessagePos
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetFocus
GetDesktopWindow
GetFocus
SetCapture
InvalidateRgn
EqualRect
IntersectRect
SetRect
IsRectEmpty
CopyRect
IsWindowEnabled
IsWindowVisible
CopyAcceleratorTableW
wsprintfW
GrayStringW
DrawTextExW
TabbedTextOutW
RedrawWindow
DrawTextW
WindowFromPoint
ClientToScreen
IsWindow
GetSysColor
SetCursor
PtInRect
ScreenToClient

gdi32

GetTextColor
GetBkColor
SetWindowExtEx
SetWindowOrgEx
GetMapMode
CreatePen
ExtSelectClipRgn
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
MoveToEx
LineTo
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetRgnBox
CreateRectRgnIndirect
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateBrushIndirect
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
SelectObject
CreateRectRgn
CombineRgn
CreateDIBSection
StretchBlt
GetDIBColorTable
SetDIBColorTable
GetObjectW
GetDeviceCaps
GetBitmapBits
SetBitmapBits
CreateCompatibleBitmap
GetStockObject
CreateFontIndirectW
GetTextExtentPoint32W
CreateSolidBrush
ScaleWindowExtEx

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegEnumKeyExW
RegQueryValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey

shell32

SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW

shlwapi

PathAppendW
PathRemoveFileSpecW
StrFormatByteSizeW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
StrChrW
PathFileExistsW

oledlg

OleUIBusyW

ole32

CLSIDFromString
CLSIDFromProgID
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoGetMalloc
CoInitializeEx
CreateStreamOnHGlobal
CoCreateInstance
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysAllocString
VariantInit
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysFreeString
SafeArrayDestroy
SysAllocStringLen
VariantChangeType
OleCreateFontIndirect
VariantCopy

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdiplus

GdipDisposeImage
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateSolidFill
GdipDrawString
GdipDrawImageI
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImagePointRectI
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusShutdown
GdipReleaseDC
GdiplusStartup

wsock32

ioctlsocket
gethostbyname
gethostname
WSAStartup
inet_addr

iphlpapi

GetAdaptersInfo
SendARP

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW

wininet

InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
DeleteUrlCacheEntryW

Sections

.text
Size: 385KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 860KB - Virtual size: 860KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5fd3502af2a53c0f8ee5a681a12c1652

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

23:15:eb:45:51:67:ac:c7:05:9b:15:3c:1e:7c:fe:10Certificate

Extended Key Usages

Key Usages

cb:f4:a8:be:68:e7:17:f2:66:45:c6:2c:63:41:68:7c:63:f0:8f:9fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oledlg

ole32

oleaut32

version

gdiplus

wsock32

iphlpapi

psapi

wininet

Sections

.text Size: 385KB - Virtual size: 385KB

.rdata Size: 93KB - Virtual size: 93KB

.data Size: 13KB - Virtual size: 29KB

.rsrc Size: 860KB - Virtual size: 860KB

.reloc Size: 45KB - Virtual size: 45KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

23:15:eb:45:51:67:ac:c7:05:9b:15:3c:1e:7c:fe:10
Certificate

cb:f4:a8:be:68:e7:17:f2:66:45:c6:2c:63:41:68:7c:63:f0:8f:9f
Signer

.text
Size: 385KB - Virtual size: 385KB

.rdata
Size: 93KB - Virtual size: 93KB

.data
Size: 13KB - Virtual size: 29KB

.rsrc
Size: 860KB - Virtual size: 860KB

.reloc
Size: 45KB - Virtual size: 45KB