a03a4bb2dfd6914e7be78a5a54c81718_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a03a4bb2dfd6914e7be78a5a54c81718_JaffaCakes118
Size

229KB
MD5

a03a4bb2dfd6914e7be78a5a54c81718
SHA1

d5ec54b780a4fed26c64ccdf9024311871bd41b4
SHA256

9087a5b2783aee58d8176af4c45ed1196407cc94019b9c8c7ce11ddec6cdc0bb
SHA512

58ab2c797a4e868dbfd7aae2d0d8568eb2ba6019a8a6d86c4999e0caa4d3858c20d6b39c8b0c4b6fda2ff9e14022abbb88e18e55531c5084533c3dc0bec5e04e
SSDEEP

6144:iNHOVcUBS1hV1HYHcQ7dyDMtK/ch23gt2KhgDKxMvil74qT2COf2Mw4TSc:auV61j1zQ7dyDMtK/ch23gt2KhgDKxM6

Score

1^/10

Malware Config

Signatures

Files

a03a4bb2dfd6914e7be78a5a54c81718_JaffaCakes118
.dll windows:5 windows x86 arch:x86

ae0376dc635f6aa00af2d55eff38ffe7

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2016, 09:16

Not After

21/07/2019, 08:09

Subject

CN=深圳市为爱普信息技术有限公司,OU=IT Dept.,O=深圳市为爱普信息技术有限公司,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f0:53:e2:13:33:b8:0c:84:c9:d8:30:07:1a:ee:e3:24:eb:d7:00:67
Signer

Actual PE Digest

f0:53:e2:13:33:b8:0c:84:c9:d8:30:07:1a:ee:e3:24:eb:d7:00:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\libidevicerestore\bin\libidevicerestore.pdb

Imports

kernel32

CreateFileW
GetFileSizeEx
CloseHandle
Sleep
CreateProcessW
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
GetModuleFileNameW
GetLastError
GetProcAddress
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetDiskFreeSpaceExW
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateMutexW
OpenMutexW
CreateFileA
CreateEventA
GetOverlappedResult
ResetEvent
DeviceIoControl
CancelIo
CreateThread
ExitProcess
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
DecodePointer
EncodePointer
IsProcessorFeaturePresent

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

msvcr100

strncpy
??3@YAXPAX@Z
strrchr
toupper
??2@YAPAXI@Z
_ftelli64
free
malloc
strerror
_fseeki64
_wfopen
_errno
fread
fclose
sprintf_s
__iob_func
wcsncpy
vsprintf_s
printf
fopen
rand
srand
fwrite
vfprintf
_vsnwprintf_s
_time64
_wremove
realloc
calloc
strchr
fprintf
_snwprintf
_snprintf
_wtempnam
wcsrchr
_waccess
_wunlink
_wrename
strtoul
sprintf
_strtoui64
_wcsdup
tolower
_stricmp
perror
_stat64i32
_vsnprintf_s
_vsnprintf
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
strstr
strncmp
wcsstr
memmove
_CxxThrowException
memset
memcpy
_wcsupr
_strdup
_wassert
strcpy_s
wcscpy_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
sscanf
__CxxFrameHandler3

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

shlwapi

PathRemoveFileSpecW
PathGetDriveNumberW
PathFileExistsW
PathRemoveFileSpecA

libplist2

plist_dict_new_iter
plist_dict_next_item
plist_get_data_val
lp_free
plist_array_insert_item
plist_access_path
plist_compare_node_value
plist_set_uint_val
plist_dict_get_size
plist_new_array
plist_array_get_size
plist_dict_remove_item
plist_new_data
plist_dict_merge
plist_array_append_item
plist_array_get_item
plist_from_bin
plist_to_bin
plist_new_bool
plist_new_string
plist_copy
plist_get_bool_val
plist_get_uint_val
plist_free
plist_get_node_type
plist_dict_set_item
plist_dict_get_item
plist_to_xml
plist_from_xml
plist_new_dict
plist_new_uint
plist_get_string_val

libssl-1_1

SSL_CTX_new
SSL_write
SSL_free
SSL_CTX_free
TLSv1_method
SSL_do_handshake
SSL_read
SSL_new
SSL_set_connect_state
SSL_set_verify
SSL_CTX_use_RSAPrivateKey
SSL_set_bio
SSL_CTX_use_certificate
SSL_shutdown

libcrypto-1_1

X509_add_ext
X509_set1_notBefore
X509_set1_notAfter
PEM_read_bio_RSAPublicKey
ASN1_INTEGER_new
ASN1_INTEGER_free
X509_set_serialNumber
BIO_s_mem
EVP_PKEY_free
RSA_new
ASN1_TIME_new
X509_set_version
BIO_ctrl
EVP_PKEY_new
BN_new
ASN1_TIME_free
X509_set_pubkey
X509_new
SHA1_Update
SHA1_Final
SHA1_Init
SHA1
SHA384
BIO_s_socket
BIO_free
RSA_free
PEM_read_bio_X509
ERR_remove_thread_state
BIO_int_ctrl
BIO_new_mem_buf
PEM_read_bio_RSAPrivateKey
BIO_new
X509_free
BN_free
EVP_sha1
X509V3_EXT_conf_nid
RSA_generate_key_ex
EVP_PKEY_assign
X509V3_set_ctx
X509V3_EXT_cleanup
PEM_write_bio_PrivateKey
BN_set_word
ASN1_INTEGER_set
X509_EXTENSION_free
X509_sign
PEM_write_bio_X509
ASN1_TIME_set

libcurl

curl_slist_append
curl_easy_init
curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_slist_free_all

libzip

zip_name_locate
zip_close
zip_fread
zip_fopen_index
zip_stat_index
zip_discard
zip_stat_init
zip_open_w
zip_fclose
zip_get_num_entries
zip_file_add
zip_source_buffer
zip_dir_add
zip_strerror
zip_replace
zip_get_name
zip_add
zip_source_free
zip_get_num_files
zip_unchange_all
zip_delete

ws2_32

connect
WSAStartup
select
WSAGetLastError
setsockopt
closesocket
recv
socket
htons
gethostbyname
send

Exports

Exports

ios_exit_recovery_mode
ios_get_normal_mode_descriptor
ios_get_product_type
ios_restore
ios_rqshsh
ios_setup_more_device
ios_show_preflash_text
setup_curl_agent_name

Sections

.text
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae0376dc635f6aa00af2d55eff38ffe7

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5Certificate

Extended Key Usages

Key Usages

f0:53:e2:13:33:b8:0c:84:c9:d8:30:07:1a:ee:e3:24:eb:d7:00:67Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

ole32

msvcr100

msvcp100

setupapi

shlwapi

libplist2

libssl-1_1

libcrypto-1_1

libcurl

libzip

ws2_32

Exports

Exports

Sections

.text Size: 137KB - Virtual size: 137KB

.rdata Size: 62KB - Virtual size: 61KB

.data Size: 5KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

f0:53:e2:13:33:b8:0c:84:c9:d8:30:07:1a:ee:e3:24:eb:d7:00:67
Signer

.text
Size: 137KB - Virtual size: 137KB

.rdata
Size: 62KB - Virtual size: 61KB

.data
Size: 5KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB