a3c09a77a97436f55e59a53a3ea5a548_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a3c09a77a97436f55e59a53a3ea5a548_JaffaCakes118
Size

1.7MB
MD5

a3c09a77a97436f55e59a53a3ea5a548
SHA1

46b6f2be984b825c828483f2e8f0e25e7d5e1439
SHA256

58a4e8d1d2a488f03e2917e265d6368d3fe258b63bc0e6f6082961dcc63cf70f
SHA512

4df628ccfde4db24aa7752283b345a5544d8dc6b1a180b14f63b4a09ea7b47486c918eb5e73a7114b3b7ada02091ed522bd9d9645ff45208b756531a09819b6c
SSDEEP

24576:WsxYnuXEdBGedidZYPZKdSxLiNzMtP7nki589qDCLGx1aIYr86EPBaKf05XyJpwz:WelPeBmMIzoTki5tfFM5X2PK

Score

1^/10

Malware Config

Signatures

Files

a3c09a77a97436f55e59a53a3ea5a548_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b60b42d4d12869eb5cc9b62aaffb960d

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/07/2008, 08:07

Not After

11/07/2010, 08:07

Subject

CN=福建网龙计算机网络信息技术有限公司,OU=Technical Dept.,O=福建网龙计算机网络信息技术有限公司,L=Fu Zhou,ST=Fu Jian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:95:f1:73:bb:34:d4:0f:67:89:9a:27:65:ce:42:69:7f:01:83:94
Signer

Actual PE Digest

43:95:f1:73:bb:34:d4:0f:67:89:9a:27:65:ce:42:69:7f:01:83:94

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostbyname
inet_ntoa
gethostname
inet_addr
recv
send
socket
WSAGetLastError
setsockopt
ioctlsocket
htons
connect
select
__WSAFDIsSet
closesocket
WSAStartup
WSACleanup

graphic

?Init3DEx@CMyBitmap@@SAHPAUHWND__@@KKHK@Z
?GameFontCreate@CMyBitmap@@SAHXZ
TargetBmpCreate
?GetScreenSize@CMyBitmap@@SAXAAH0@Z
?ScreenShot@CMyBitmap@@SAXPBD@Z
?HintGraphicDetail@CMyBitmap@@SAHK@Z
?End3D@CMyBitmap@@SAHXZ
?Flip@CMyBitmap@@SAHPBUtagRECT@@0PAUHWND__@@@Z
?IfDeviceLost@CMyBitmap@@SAHXZ
?ResetDevice@CMyBitmap@@SAHXZ
?Begin3D@CMyBitmap@@SAHXZ
?GetFontSize@CMyBitmap@@SAKXZ
?ShowString@CMyBitmap@@SAXHHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?GetStrShowLen@CMyBitmap@@SAHPBDHH@Z
?ShowEmotionString@CMyBitmap@@SAXHHKPBDPAVIDataIcon@@0HHHHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?ShowEmotionStringEx@CMyBitmap@@SA?AUCMySize@@HHKPBDPAVIDataIcon@@0HHHHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?CheckStringPixels@CMyBitmap@@SA_NPBDK0H@Z
?GetFontSize@CMyBitmap@@SAXAAUCMySize@@@Z
?CalcuTextExtent@CMyBitmap@@SA?AUCMySize@@PBD0HPAVIDataIcon@@H@Z
?ShowBlock@CMyBitmap@@SAXHHHHK@Z
?GetFontWidth@CMyBitmap@@SAKPBDH@Z
?GameCameraBuild@CMyBitmap@@SAXUCMySize@@@Z
?ClearBuffer@CMyBitmap@@SAHHHK@Z
?GetScreenHeight@CMyBitmap@@SAHXZ
?ShowStringEx@CMyBitmap@@SA?AUCMySize@@HHKPBD0HHW4RENDER_TEXT_STYLE@@KAAUCMyPos@@@Z
?GetScreenWidth@CMyBitmap@@SAHXZ
PuzzelTriangleCreate
PuzzelBlockCreate
?PrepareLine@CMyBitmap@@SAXXZ
?ShowRect@CMyBitmap@@SAXHHHHK@Z
?PrepareSprite@CMyBitmap@@SAXXZ
?ShowBlock@CMyBitmap@@SAXUCMyPos@@000K@Z
MultiBmpCreate
?ShowLine@CMyBitmap@@SAXHHHHK@Z
?GameCameraSet@CMyBitmap@@SAXMMMK@Z
?GameCameraDestroy@CMyBitmap@@SAXXZ

graphicdata

GameDataSetQuery
GameDataSetDestroy

ndsound

_DXSoundinit@4
_DXSetSoundVolume@4
_DXSetMusicVolume@4
_DXProcessSound@8
_DXPlayMedia@8
_DXCloseMedia@4
_DXSetVolume@16
_DXCloseSound@12
_DXClose2DSound@4
_DXSet2DSoundPos@12
_DXCloseAllMedia@0
_DXCloseAllSound@0
_DXDestroy@0
_DXPlaySound@24

role3d

Simple3DObjCreate
Game3DEffectCreate

dinput8

DirectInput8Create

assist

?QueryMonitorManager@@YAPAVIMonitorManager@@XZ
?CreateMonitorManager@@YAXXZ

gamedata

RoleDataQuery
RoleDataDestroy

roleview

RoleViewCreate

mfc42

ord4853
ord4998
ord2514
ord6052
ord1775
ord5280
ord4425
ord3597
ord3610
ord3402
ord3721
ord795
ord800
ord641
ord540
ord324
ord656
ord2302
ord4234
ord2645
ord3874
ord6199
ord4710
ord5875
ord3092
ord3803
ord537
ord2864
ord4299
ord3706
ord3626
ord2414
ord1641
ord3663
ord2614
ord858
ord4376
ord860
ord2818
ord3876
ord941
ord6778
ord2575
ord4396
ord3574
ord3573
ord609
ord4476
ord2860
ord6453
ord1768
ord4538
ord3089
ord2135
ord1572
ord3631
ord683
ord3226
ord1200
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord616
ord6779
ord2688
ord4224
ord4284
ord6877
ord692
ord665
ord1979
ord5442
ord5186
ord354
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord3571
ord2915
ord2099
ord6605
ord5148
ord3698
ord765
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord2621
ord1134
ord2725
ord2859
ord755
ord470
ord2393
ord690
ord5207
ord389
ord1949
ord4034
ord535
ord5265
ord2078
ord2642
ord4123
ord6880
ord3873
ord823
ord2379
ord2086
ord6215
ord5981
ord1233
ord6442
ord4275
ord825
ord567
ord1168
ord1146
ord818
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord922
ord1576

msvcrt

mktime
atol
ctime
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strlwr
srand
sin
atan2
feof
free
malloc
fseek
fabs
rand
atan
_splitpath
sqrt
fread
fwrite
exit
fgets
fclose
fprintf
??8type_info@@QBEHABV0@@Z
vsprintf
floor
time
_daylight
localtime
fopen
fscanf
strtoul
_mbscmp
strstr
_i64toa
abs
_findfirst
_findnext
_findclose
_strset
strrchr
pow
_atoi64
memset
strchr
strcpy
strcat
atoi
_ftol
sprintf
_snprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
memcmp
_CxxThrowException
memmove
memcpy
strcmp
strlen
strncpy
sscanf
_purecall
__CxxFrameHandler
gmtime
_rotr
_rotl
_strdup
_strrev
_mkdir
wcslen
wcscat
isdigit
_itoa
_stricmp
_strupr
_filelength
_fileno
realloc
_pctype
__mb_cur_max
_isctype
abort
wcsstr
_vsnprintf
vfprintf
_iob
memchr
fflush
_setmode
ftell
qsort
_setmbcp
wcsncat

kernel32

GetStartupInfoA
InterlockedDecrement
GetStdHandle
GetCurrentProcessId
GlobalMemoryStatus
QueryPerformanceCounter
GetVersionExA
GetFileType
GetVersion
InterlockedIncrement
OutputDebugStringA
CreateToolhelp32Snapshot
InterlockedExchange
GetPrivateProfileIntA
GetModuleFileNameA
CloseHandle
ReleaseMutex
GetLastError
CreateMutexA
WritePrivateProfileStringA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetTickCount
GetFileAttributesA
WritePrivateProfileSectionA
WritePrivateProfileStructA
DeleteFileA
IsDBCSLeadByte
GlobalFree
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceA
lstrcpynA
GetProcAddress
GetModuleHandleA
WriteProcessMemory
ReadProcessMemory
LoadLibraryA
FreeLibrary
_lclose
_lopen
IsDebuggerPresent
CreateDirectoryA
GetCurrentThreadId
WinExec
CopyFileA
SetCurrentDirectoryA
GetSystemDirectoryA
OpenMutexA
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapValidate
IsBadCodePtr
MulDiv
MultiByteToWideChar
WideCharToMultiByte
FindClose
FindNextFileA
FindFirstFileA
Process32Next
Process32First
Sleep

user32

SetWindowsHookExA
IsWindow
ChangeDisplaySettingsA
InflateRect
GetClassNameA
GetWindowTextA
EnumWindows
SetTimer
KillTimer
LoadImageA
IsWindowVisible
SetCursor
UnionRect
ReleaseCapture
SetCapture
CallNextHookEx
GetSystemMetrics
GetForegroundWindow
EndPaint
GetCursorPos
ScreenToClient
PtInRect
GetDC
SetWindowPos
SetWindowLongA
GetWindowRect
SetRect
PostMessageA
ClientToScreen
OffsetRect
EnableWindow
SendMessageA
SetWindowRgn
GetActiveWindow
GetClientRect
DrawIcon
LoadCursorA
DestroyIcon
LoadIconA
BeginPaint
IsIconic
EnumDisplaySettingsA
DestroyCursor
LoadCursorFromFileA
MessageBoxA
GetKeyState
keybd_event
PostQuitMessage
WindowFromPoint
MapDialogRect
GetKeyboardState
mouse_event
GetFocus
RedrawWindow
InvalidateRect
SetCursorPos
CallWindowProcA
UnhookWindowsHookEx
FillRect
GetParent
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
BringWindowToTop

gdi32

DeleteObject
CreateRectRgnIndirect
CreateRectRgn
GetStockObject
GetObjectA
CreatePatternBrush
ExtCreateRegion
PtInRegion
DeleteDC
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
GetTextMetricsA
CreateFontA
CreatePolygonRgn
CombineRgn
CreateSolidBrush

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource

shell32

ShellExecuteA

oleaut32

VariantClear

msvcp60

??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@ios_base@std@@QAEXH_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

netapi32

Netbios

winmm

timeGetTime

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b60b42d4d12869eb5cc9b62aaffb960d

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

43:95:f1:73:bb:34:d4:0f:67:89:9a:27:65:ce:42:69:7f:01:83:94Signer

Headers

File Characteristics

Imports

ws2_32

graphic

graphicdata

ndsound

role3d

dinput8

assist

gamedata

roleview

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

oleaut32

msvcp60

netapi32

winmm

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 236KB - Virtual size: 233KB

.data Size: 68KB - Virtual size: 105KB

.rsrc Size: 128KB - Virtual size: 125KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

61:c3:80:3e:4e:7a:9e:4e:71:54:48:f5:1a:97:59:f0
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

43:95:f1:73:bb:34:d4:0f:67:89:9a:27:65:ce:42:69:7f:01:83:94
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 236KB - Virtual size: 233KB

.data
Size: 68KB - Virtual size: 105KB

.rsrc
Size: 128KB - Virtual size: 125KB