8573f0453c2f7f23da34e4bc386beacb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8573f0453c2f7f23da34e4bc386beacb_JaffaCakes118
Size

981KB
MD5

8573f0453c2f7f23da34e4bc386beacb
SHA1

c0de2f904e65e504aa291d81837b3c4b0782245f
SHA256

1cd2401f6923cf10ffcf5b41151f820f52b3867962d69a1bd3fcfffbd0dac04c
SHA512

65f33a5cb1d7b210ca39c1a4d374addc2d5c332e7786612c3f79064e6299522c1608f3c373ecf7c86bc95cda8656d68d5a3dbe31f7d53e8434bbbdafcaf098ec
SSDEEP

24576:vbxdA6m71k+xplqpkRVmOkZ7TuBrNyNsVzPJqiIS/i3kJgnVYa3Pd0qRjkIxZWNa:U6mpDxkDZog

Score

1^/10

Malware Config

Signatures

Files

8573f0453c2f7f23da34e4bc386beacb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2cd3bb25bec3dfccbc047213ba5a51b1

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

e7:3c:a0:c4:20:77:20:88:03:78:64:e0:1d:1e:57:19
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

02/12/2008, 00:00

Not After

02/12/2009, 23:59

Subject

CN=北京爆豆科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=北京爆豆科技有限公司,L=海淀区,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ca:ce:01:b6:ec:15:a5:2d:ee:d2:eb:37:78:e4:1d:95:fa:13:b8:f9
Signer

Actual PE Digest

ca:ce:01:b6:ec:15:a5:2d:ee:d2:eb:37:78:e4:1d:95:fa:13:b8:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\google\OnlineInstal\Release\MySpeed_Onlineinstaller_1.0.0.0.pdb

Imports

kernel32

GetStartupInfoW
RtlUnwind
ExitProcess
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
GetTimeZoneInformation
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CreateFileA
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
GlobalFlags
InterlockedIncrement
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
RaiseException
GlobalFindAtomW
lstrlenA
GetModuleHandleA
LoadLibraryA
lstrcatW
GetVersionExA
InterlockedDecrement
GetLastError
SetLastError
MulDiv
FormatMessageW
lstrcpynW
LocalFree
GlobalUnlock
GlobalFree
FreeResource
GlobalAddAtomW
GetCurrentThread
GetCurrentThreadId
GlobalLock
lstrcmpW
GlobalAlloc
GlobalDeleteAtom
GetModuleHandleW
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrcpyW
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
lstrcmpiW
GetFullPathNameW
WideCharToMultiByte
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetModuleFileNameW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
CreateDirectoryW
GetSystemDirectoryW
Sleep
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CopyFileW
lstrlenW
WaitForSingleObject
DeleteFileW
MultiByteToWideChar
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetFileSize
GetFileAttributesW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileW
ReadFile
SetFilePointer
WriteFile
CloseHandle
GetTempPathW
FindResourceW
LoadResource
LockResource
VirtualFree
SizeofResource

user32

DestroyMenu
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
GetSysColorBrush
LoadCursorW
SetCapture
CharUpperW
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ShowWindow
MoveWindow
SetWindowTextW
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
SetFocus
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoW
RegisterClassW
UnregisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
PtInRect
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetWindow
SetWindowContextHelpId
MapDialogRect
wsprintfW
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetMenuItemBitmaps
PostThreadMessageW
RegisterClipboardFormatW
GetFocus
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
MessageBoxW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
SetCursor
PostQuitMessage
PeekMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
SetWindowPos
ReleaseCapture
GetSystemMetrics
EnableWindow
LoadIconW
KillTimer
SetTimer
GetClientRect
GetWindowRect
IsIconic
PostMessageW
SendMessageW
DrawIcon

gdi32

Escape
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
CreateRectRgnIndirect
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateSolidBrush
SetMapMode
RestoreDC
SaveDC
GetObjectW
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
CreateBitmap
CreateFontW
SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyW
RegSetValueW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueW
RegEnumKeyW

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW

comctl32

ord17

shlwapi

PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc
CoRegisterMessageFilter
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoCreateInstance
OleFlushClipboard
OleIsCurrentClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject

oleaut32

VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString

urlmon

URLDownloadToFileW

netapi32

Netbios

wininet

InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile

Sections

.text
Size: 220KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 672KB - Virtual size: 669KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cd3bb25bec3dfccbc047213ba5a51b1

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

e7:3c:a0:c4:20:77:20:88:03:78:64:e0:1d:1e:57:19Certificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

ca:ce:01:b6:ec:15:a5:2d:ee:d2:eb:37:78:e4:1d:95:fa:13:b8:f9Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

netapi32

wininet

Sections

.text Size: 220KB - Virtual size: 217KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 16KB - Virtual size: 28KB

.rsrc Size: 672KB - Virtual size: 669KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

e7:3c:a0:c4:20:77:20:88:03:78:64:e0:1d:1e:57:19
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

ca:ce:01:b6:ec:15:a5:2d:ee:d2:eb:37:78:e4:1d:95:fa:13:b8:f9
Signer

.text
Size: 220KB - Virtual size: 217KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 16KB - Virtual size: 28KB

.rsrc
Size: 672KB - Virtual size: 669KB