a34f1781d3cbd43d0d7f1a20997c167a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a34f1781d3cbd43d0d7f1a20997c167a_JaffaCakes118
Size

246KB
MD5

a34f1781d3cbd43d0d7f1a20997c167a
SHA1

54a7b14dded172ab24081d604082947c8612af5b
SHA256

49dfeb8a68241ec88b37299285406d1865428f98ecbf3a4f20c540357584301e
SHA512

60e1065bf53631bc9905ff6f47c478bb02753a2e4e79e03cd8d99421de5971598598921f35652f0f1bf66d207f6a2b9471faafbea086cebea34b5e2bd7214997
SSDEEP

6144:FSsQWNYe093vOkvvKxrBFctCz8daPMRmHVczaxQzaBcfS1XJXn0XjCOf2OiY5q0/:FSrNOkvifFctCz8daPMRmHVczaxQzaB8

Score

1^/10

Malware Config

Signatures

Files

a34f1781d3cbd43d0d7f1a20997c167a_JaffaCakes118
.dll windows:5 windows x86 arch:x86

78bda22c071d802b2343486f28530555

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2016, 09:16

Not After

21/07/2019, 08:09

Subject

CN=深圳市为爱普信息技术有限公司,OU=IT Dept.,O=深圳市为爱普信息技术有限公司,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a9:d6:0e:aa:85:3b:be:b8:9e:cb:a5:9e:6d:d4:fe:ad:97:6f:ff:56
Signer

Actual PE Digest

a9:d6:0e:aa:85:3b:be:b8:9e:cb:a5:9e:6d:d4:fe:ad:97:6f:ff:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\work\libidevicerestore\bin\libidevicerestore.pdb

Imports

kernel32

CreateFileW
GetFileSizeEx
CloseHandle
Sleep
CreateProcessW
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
GetModuleFileNameW
GetLastError
GetProcAddress
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetDiskFreeSpaceExW
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
DeleteFileW
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateMutexW
OpenMutexW
CopyFileW
CreateFileA
CreateEventA
GetOverlappedResult
ResetEvent
DeviceIoControl
CancelIo
CreateThread
ExitProcess
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
DecodePointer
EncodePointer
IsProcessorFeaturePresent

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation

ole32

CoTaskMemFree

msvcr100

strncpy
??3@YAXPAX@Z
strrchr
toupper
??2@YAPAXI@Z
_ftelli64
free
malloc
strerror
_fseeki64
_wfopen
_errno
fread
fclose
sprintf_s
__iob_func
wcsncpy
vsprintf_s
printf
fopen
rand
srand
fwrite
vfprintf
_vsnwprintf_s
_time64
_snprintf
_wunlink
wcscat_s
_wremove
realloc
calloc
strchr
fprintf
_snwprintf
memchr
wcsrchr
wcsstr
_waccess
_wrename
strtoul
sprintf
_wcsdup
tolower
_stricmp
perror
_stat64i32
_vsnprintf_s
_vsnprintf
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
strstr
strncmp
_wtempnam
memmove
_CxxThrowException
memset
memcpy
_wcsupr
_strdup
_wassert
strcpy_s
wcscpy_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
sscanf
__CxxFrameHandler3

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z

setupapi

SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces

shlwapi

PathRemoveFileSpecW
PathGetDriveNumberW
PathFileExistsW
PathRemoveFileSpecA

libplist2

plist_dict_merge
plist_compare_node_value
plist_set_uint_val
plist_array_insert_item
lp_free
plist_dict_next_item
plist_dict_new_iter
plist_access_path
plist_dict_get_size
plist_new_array
plist_new_data
plist_array_append_item
plist_to_bin
plist_new_bool
plist_array_get_size
plist_dict_remove_item
plist_array_get_item
plist_get_data_val
plist_from_bin
plist_new_string
plist_get_bool_val
plist_new_uint
plist_get_uint_val
plist_free
plist_get_string_val
plist_dict_set_item
plist_dict_get_item
plist_to_xml
plist_from_xml
plist_new_dict
plist_copy
plist_get_node_type

libssl-1_1

SSL_CTX_new
TLSv1_method
SSL_do_handshake
SSL_write
SSL_free
SSL_CTX_free
SSL_read
SSL_set_connect_state
SSL_set_verify
SSL_CTX_use_RSAPrivateKey
SSL_new
SSL_set_bio
SSL_CTX_use_certificate
SSL_shutdown

libcrypto-1_1

ASN1_TIME_set
X509_set1_notBefore
X509_set1_notAfter
PEM_read_bio_RSAPublicKey
ASN1_INTEGER_new
ASN1_INTEGER_free
X509_set_serialNumber
BIO_s_mem
EVP_PKEY_free
RSA_new
ASN1_TIME_new
X509_set_version
BIO_ctrl
EVP_PKEY_new
BN_new
ASN1_TIME_free
X509_set_pubkey
SHA1_Update
SHA1_Final
SHA1_Init
SHA1
SHA384
BIO_s_socket
BIO_free
RSA_free
PEM_read_bio_X509
ERR_remove_thread_state
BIO_int_ctrl
BIO_new_mem_buf
PEM_read_bio_RSAPrivateKey
BIO_new
X509_free
BN_free
EVP_sha1
X509V3_EXT_conf_nid
RSA_generate_key_ex
EVP_PKEY_assign
X509V3_set_ctx
X509V3_EXT_cleanup
PEM_write_bio_PrivateKey
BN_set_word
ASN1_INTEGER_set
X509_EXTENSION_free
X509_add_ext
PEM_write_bio_X509
X509_new
X509_sign

libcurl

curl_free
curl_slist_free_all
curl_slist_append
curl_easy_init
curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_getinfo

libzip

zip_name_locate
zip_close
zip_fread
zip_fopen_index
zip_stat_index
zip_discard
zip_stat_init
zip_open_w
zip_fclose
zip_get_num_entries
zip_file_add
zip_source_buffer
zip_dir_add
zip_strerror
zip_replace
zip_get_name
zip_delete
zip_get_num_files
zip_source_free
zip_unchange_all
zip_add

zlib1

inflateEnd
crc32
inflate
inflateInit2_

ws2_32

htons
connect
WSAStartup
select
WSAGetLastError
closesocket
setsockopt
recv
socket
gethostbyname
send

Exports

Exports

ios_downgrade
ios_exit_recovery_mode
ios_get_normal_mode_descriptor
ios_get_product_type
ios_restore
ios_rqshsh
ios_setup_more_device
ios_show_preflash_text
setup_curl_agent_name

Sections

.text
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78bda22c071d802b2343486f28530555

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5Certificate

Extended Key Usages

Key Usages

a9:d6:0e:aa:85:3b:be:b8:9e:cb:a5:9e:6d:d4:fe:ad:97:6f:ff:56Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

ole32

msvcr100

msvcp100

setupapi

shlwapi

libplist2

libssl-1_1

libcrypto-1_1

libcurl

libzip

zlib1

ws2_32

Exports

Exports

Sections

.text Size: 149KB - Virtual size: 148KB

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 5KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 16KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

a9:d6:0e:aa:85:3b:be:b8:9e:cb:a5:9e:6d:d4:fe:ad:97:6f:ff:56
Signer

.text
Size: 149KB - Virtual size: 148KB

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 5KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 16KB