855d50a4700d561483994fe5a8695ca8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

855d50a4700d561483994fe5a8695ca8_JaffaCakes118
Size

249KB
MD5

855d50a4700d561483994fe5a8695ca8
SHA1

c13510a930a250afb27de36c340b17bfa4c1c87f
SHA256

875f1d7d12f3149bd8a1f704a7c36f92cab29965152d0e708e7d2434dffde21c
SHA512

9cd8659c385695608c4c057381042082c474a5903d0787d214a20ca545ee55a5aa199d39a857d6d447854cbb0a40f4a259a216e5457d9461874712b3335920d5
SSDEEP

3072:jXADYJ3eLHz6hd8lcTkRaGMdC9H723jbOWRb/lntuDaMJfixStPllesnHB:jQDuurzOuc3C9HIOklntuXaxgveyHB

Score

1^/10

Malware Config

Signatures

Files

855d50a4700d561483994fe5a8695ca8_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

a9a3199e9fb2fe22a7ebbf8e7ec9e547

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:f4:37:cb:40:e7:c3:e6:b6:63:b3:e3:ba:45:2f:de
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/05/2009, 00:00

Not After

26/05/2011, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ShenZhen Thunder Networking Technologies Ltd.,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:ae:b6:82:86:63:fe:d9:75:55:f8:fe:24:f3:3b:1a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority - G2+OU=(c) 1998 VeriSign\, Inc. - For authorized use only+OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US

Not Before

01/04/2009, 00:00

Not After

31/03/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\公司源码\插件完整\Thunder\release\qibho.pdb

Imports

kernel32

MultiByteToWideChar
lstrlenA
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetTickCount
GetTempFileNameA
GetTempPathA
CloseHandle
CreateFileW
ReadFile
GetFileSize
WideCharToMultiByte
DeleteFileA
GetPrivateProfileIntA
CopyFileA
CopyFileW
DeleteFileW
VirtualProtect
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
WaitForSingleObject
SetEvent
lstrcmpiW
CreateThread
CreateEventW
Sleep
IsBadReadPtr
GetThreadLocale
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FindResourceExW
lstrlenW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
ResetEvent
InterlockedExchange
SetFilePointer
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
GetProcessHeap
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
LCMapStringW
LCMapStringA
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
LoadLibraryW
lstrcpyW
lstrcatA
DeviceIoControl
GetSystemWindowsDirectoryW
lstrcpyA
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
WriteFile

user32

FindWindowExW
CharNextW
wsprintfW
EnumChildWindows
GetParent
UnregisterClassA
GetClassNameA
RemovePropW
SetPropW
PostMessageW
wsprintfA
SendMessageW
DefWindowProcA
DefWindowProcW
GetWindowTextLengthW
GetWindowTextW
GetFocus
GetWindowTextA
SetWindowTextW
IsWindowVisible
GetPropW
IsWindowUnicode
SetWindowLongW
SetWindowLongA
CallWindowProcW
CallWindowProcA

advapi32

RegDeleteValueW
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
StringFromIID

oleaut32

LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
VariantClear
SysFreeString

shlwapi

SHSetValueA
SHDeleteKeyA
SHDeleteKeyW
SHSetValueW
SHGetValueA

urlmon

URLDownloadToFileA

wininet

InternetCloseHandle
InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetSetOptionW

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 180KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9a3199e9fb2fe22a7ebbf8e7ec9e547

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1b:f4:37:cb:40:e7:c3:e6:b6:63:b3:e3:ba:45:2f:deCertificate

Extended Key Usages

Key Usages

2e:ae:b6:82:86:63:fe:d9:75:55:f8:fe:24:f3:3b:1aCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

urlmon

wininet

iphlpapi

Exports

Exports

Sections

.text Size: 180KB - Virtual size: 176KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 8KB - Virtual size: 43KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1b:f4:37:cb:40:e7:c3:e6:b6:63:b3:e3:ba:45:2f:de
Certificate

2e:ae:b6:82:86:63:fe:d9:75:55:f8:fe:24:f3:3b:1a
Certificate

.text
Size: 180KB - Virtual size: 176KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 8KB - Virtual size: 43KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB