aa564060276137152385e01b64e42584_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

aa564060276137152385e01b64e42584_JaffaCakes118
Size

22.5MB
MD5

aa564060276137152385e01b64e42584
SHA1

dc1f1c8a8ad49b774fa3dca4d8e90402279f00a4
SHA256

fe2ae655476be799ffb482588c2697d89d9457f93d4d0b4b833b6fbac1ffa0aa
SHA512

16fb3eb74e19b0fe674b18819ae288df3f84f95b74e756827236996e0d1100bbd6f4eca89cc609aa05695592ebbbbeca931ee1997e7a06f69829e0adf8ad09a8
SSDEEP

393216:D92p5JMBCN53A4rHltt1WgUcZLqTF/toUzltF0dGl7HWvTePQi2xfCSTLU/b2pxx:p2jJl3AqltrWntR/thz/FQMWrePX2Vbx

Score

1^/10

Malware Config

Signatures

Files

aa564060276137152385e01b64e42584_JaffaCakes118
.exe windows:5 windows x86 arch:x86

17d8087fd38a99c5fc75cf0437cd0dc4

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

68:a6:55:e0:0a:54:3a:7d:05:12:fe:69:c2:1e:17:bb
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

05/08/2016, 00:00

Not After

05/08/2017, 23:59

Subject

CN=暴风集团股份有限公司,OU=OPS,O=暴风集团股份有限公司,L=北京,ST=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a6:c1:1d:c6:84:b1:19:08:2d:79:cc:85:e4:01:04:94:d8:36:15:42
Signer

Actual PE Digest

a6:c1:1d:c6:84:b1:19:08:2d:79:cc:85:e4:01:04:94:d8:36:15:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\svnwork\stormplayer\tags\5.62.0808.2111\Setup\BF_NewInstall\src\BF_InstallEngine\bin\Release\B5_Install.pdb

Imports

kernel32

GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetCurrentProcessId
OpenMutexW
GetSystemDirectoryW
lstrcpyW
GetWindowsDirectoryW
TerminateThread
InitializeCriticalSectionAndSpinCount
GlobalFree
lstrcmpW
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FlushInstructionCache
RaiseException
CreateFileMappingW
OpenFileMappingW
CreateMutexW
GetModuleFileNameW
SetLastError
CreateEventW
SetEvent
CreateDirectoryA
SetFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
ReadFile
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
RtlUnwind
LCMapStringW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
HeapCreate
IsDebuggerPresent
CreateFileA
SetFilePointer
GetFileSize
GetTickCount
OutputDebugStringW
GetCurrentThreadId
GetDriveTypeW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetSystemInfo
GetVersionExW
LoadLibraryW
LocalFree
GetModuleHandleW
CopyFileW
Sleep
MoveFileExW
CreateDirectoryW
CreateFileW
HeapFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
lstrcmpiW
RemoveDirectoryW
FindFirstFileW
lstrcatW
lstrlenW
GetFileAttributesW
lstrcpynW
TerminateProcess
OpenProcess
Process32NextW
FindResourceExW
Process32FirstW
CreateToolhelp32Snapshot
SystemTimeToFileTime
GetLocalTime
WideCharToMultiByte
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryExW
SetErrorMode
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceW
CloseHandle
WaitForSingleObject
CreateProcessW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineW
EncodePointer
CreateThread
ExitThread
GetSystemTimeAsFileTime
DecodePointer
ExitProcess
VirtualQuery
VirtualProtect
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
QueryPerformanceCounter
GetStdHandle
lstrlenA
MultiByteToWideChar
GetTempPathW
InterlockedDecrement
InterlockedIncrement
lstrcmpiA
GlobalReAlloc
GetVersion
GetFileType
GetLastError

user32

DefWindowProcW
RegisterClassExW
LoadCursorW
SetWindowLongW
GetWindowLongW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
CallWindowProcW
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
GetParent
ClientToScreen
CreateAcceleratorTableW
SetForegroundWindow
CreateWindowExW
GetClassInfoExW
RedrawWindow
SetWindowPos
CharNextW
GetSysColor
UnregisterClassA
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
IsWindowEnabled
TrackMouseEvent
SetWindowRgn
PostQuitMessage
EnableWindow
SetMenuItemInfoW
RemoveMenu
GetMenuState
SetMenuInfo
GetMenuInfo
GetClassNameA
CallNextHookEx
GetCursorPos
DestroyWindow
GetWindowTextW
SetWindowsHookExW
SetPropA
SetClassLongW
GetClassLongW
UnhookWindowsHookEx
GetMenuItemInfoW
InflateRect
SetWindowTextA
FindWindowA
GetWindowDC
GetMenuItemCount
UpdateWindow
GetPropA
OffsetRect
EqualRect
CopyRect
IsWindowVisible
SetParent
EndDialog
DialogBoxParamW
DrawIconEx
SetCursor
PtInRect
SetRect
MapWindowPoints
IsIconic
IsDialogMessageW
SetRectEmpty
IsZoomed
GetWindowRect
LoadIconW
GetSystemMetrics
FindWindowExW
SendMessageTimeoutW
FindWindowW
WaitForInputIdle
MessageBoxW
DrawTextW
EnableMenuItem
GetSystemMenu
IsRectEmpty
KillTimer
SetTimer
PostMessageW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowThreadProcessId
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
SendMessageW
IsWindow
GetClassNameW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
SystemParametersInfoW
ShowWindow
MonitorFromWindow
GetMonitorInfoW

gdi32

CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
SetBkColor
ExtTextOutW
CreatePen
CreateFontIndirectW
GetClipBox
ExcludeClipRect
Rectangle
GetRgnBox
StretchBlt
CreateCompatibleDC
CreateFontW
RoundRect
GetTextExtentPoint32W
Ellipse
CreateDCW
SelectPalette
RealizePalette
GetDIBits
CreateDIBitmap
CreateDIBSection
ExtCreateRegion
CombineRgn
SetTextColor
CreateSolidBrush
GetPixel
SetBkMode

advapi32

AdjustTokenPrivileges
ReportEventA
DeregisterEventSource
RegEnumValueW
DeleteService
ControlService
CloseServiceHandle
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
GetUserNameW
BuildExplicitAccessWithNameW
DeleteAce
GetExplicitEntriesFromAclW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetFileSecurityW
LookupAccountNameW
RegisterEventSourceA
LookupPrivilegeValueW
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW

shell32

SHGetFolderPathW
SHChangeNotify
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
SHCreateDirectoryExW

ole32

CoUninitialize
PropVariantClear
CLSIDFromString
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CLSIDFromProgID
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemRealloc

oleaut32

OleCreateFontIndirect
SysStringLen
VariantInit
LoadRegTypeLi
SysAllocStringByteLen
SysAllocStringLen
VariantClear
SysStringByteLen
SysFreeString
SysAllocString
LoadTypeLi
VarUI4FromStr

wininet

InternetGetConnectedState

sensapi

IsNetworkAlive

psapi

GetModuleFileNameExW

shlwapi

SHSetValueW
SHGetValueW
PathStripToRootW
SHDeleteKeyW
PathRemoveFileSpecW
SHDeleteValueW
StrStrIW
StrChrIW
SHStrDupW
PathFileExistsW
PathAppendW
PathCanonicalizeW
PathIsSameRootW
PathSkipRootW
StrCmpW
PathAddBackslashW
PathIsDirectoryW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

TransparentBlt

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

winhttp

WinHttpSetOption
WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData

winmm

timeSetEvent
timeKillEvent

gdiplus

GdipSetCompositingQuality
GdiplusStartup
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdiplusShutdown
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdipDrawImageRectRect
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipCreateBitmapFromStream
GdipSetCompositingMode
GdipCreateFromHDC
GdipAlloc
GdipReleaseDC
GdipFree
GdipDeleteGraphics

Sections

.text
Size: 752KB - Virtual size: 751KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21.4MB - Virtual size: 21.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17d8087fd38a99c5fc75cf0437cd0dc4

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

68:a6:55:e0:0a:54:3a:7d:05:12:fe:69:c2:1e:17:bbCertificate

Extended Key Usages

Key Usages

a6:c1:1d:c6:84:b1:19:08:2d:79:cc:85:e4:01:04:94:d8:36:15:42Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

sensapi

psapi

shlwapi

comctl32

msimg32

wtsapi32

version

iphlpapi

winhttp

winmm

gdiplus

Sections

.text Size: 752KB - Virtual size: 751KB

.rdata Size: 183KB - Virtual size: 183KB

.data Size: 51KB - Virtual size: 74KB

.rsrc Size: 21.4MB - Virtual size: 21.4MB

.reloc Size: 121KB - Virtual size: 121KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

68:a6:55:e0:0a:54:3a:7d:05:12:fe:69:c2:1e:17:bb
Certificate

a6:c1:1d:c6:84:b1:19:08:2d:79:cc:85:e4:01:04:94:d8:36:15:42
Signer

.text
Size: 752KB - Virtual size: 751KB

.rdata
Size: 183KB - Virtual size: 183KB

.data
Size: 51KB - Virtual size: 74KB

.rsrc
Size: 21.4MB - Virtual size: 21.4MB

.reloc
Size: 121KB - Virtual size: 121KB