b634f5caad27c49d809a33792dfc595a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b634f5caad27c49d809a33792dfc595a_JaffaCakes118
Size

1.1MB
MD5

b634f5caad27c49d809a33792dfc595a
SHA1

2ec69defdb9e8fe640141569deeaa58a11c1b958
SHA256

580b8c649e6b31b7ca5f186584015e32317952efbada555f69cce1f660823f19
SHA512

bbf78bdb92dd78584b7bfea17da706a20003bf4264a4b5a47597325706341b7e8cfdf06500491f7e62024328a8911fbe288905003f3f0c8d85ccf4dbffa4dc47
SSDEEP

12288:ChUezuH1dcQ/SHxbrm/tPWg20+qLJKq7lKxsYIhuOY08GZEPz:6QQetPWg207Kq7l4KuOYzx

Score

1^/10

Malware Config

Signatures

Files

b634f5caad27c49d809a33792dfc595a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4b0818deb7f16ff6fe594d6389471ea1

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:fd:eb:75:dc:48:33:db:a8:07:f5:a1:4f:a7:e8:6e
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

02-01-2009 07:47

Not After

02-01-2011 07:47

Subject

CN=HYOSUNG ITX co.\, LTD.,OU=Infra Team,O=HYOSUNG ITX co.\, LTD.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\project\p3.http.download\Download 업체별\twelvesky_http\DownloadGSkin\release\DownloadGSkin.pdb

Imports

wininet

InternetOpenW
InternetQueryDataAvailable
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW

kernel32

GetLastError
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
HeapSize
ExitProcess
HeapReAlloc
RaiseException
RtlUnwind
CreateThread
ExitThread
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapFree
GetFileTime
GetFileAttributesW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenA
InterlockedIncrement
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
CreateFileW
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
DeleteFileW
MoveFileW
InterlockedDecrement
WritePrivateProfileStringW
GetCurrentProcessId
GetCurrentThread
ConvertDefaultLocale
GetModuleFileNameW
GetVersion
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetModuleHandleA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
WideCharToMultiByte
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
FreeLibrary
CompareStringW
LoadLibraryA
SetLastError
lstrcmpW
GetVersionExA
VirtualAlloc
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
SetEnvironmentVariableA
SizeofResource
LockResource
LoadResource
FindResourceW
ReleaseMutex
CreateMutexW
MultiByteToWideChar
GetTickCount
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
lstrlenW
CreateDirectoryW
SetErrorMode
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
CloseHandle
ResetEvent
Sleep
SetEvent
CreateEventW
GetModuleHandleW
GetProcAddress

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathCompactPathExW
PathFindExtensionW

user32

GetParent
AdjustWindowRectEx
GetSysColor
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
MessageBoxW
GetMenuItemCount
GetMenuItemID
GetSubMenu
CopyRect
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
PostMessageW
GetClientRect
GetSystemMetrics
LoadCursorW
SendMessageW
LoadIconW
SetCursor
IsIconic
SetTimer
GrayStringW
UnregisterClassA
GetForegroundWindow
DrawTextExW
DrawTextW
LoadBitmapW
KillTimer
TabbedTextOutW
GetDC
PtInRect
GetDlgCtrlID
EnableWindow
DrawIcon
SetPropW
GetDesktopWindow
GetMenu
UpdateWindow
IsWindowVisible
SetForegroundWindow
GetKeyState
MapWindowPoints
PeekMessageW
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
UnregisterClassW
GetSysColorBrush
DestroyMenu
CharUpperW
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetMessageW
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
PostQuitMessage
EndPaint
BeginPaint
ReleaseDC
ClientToScreen
IsWindowEnabled
ShowWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetPropW
RemovePropW
GetFocus
IsWindow
SetFocus
GetWindowTextW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
GetDlgItem

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
BitBlt
CreateFontIndirectW
GetBkColor
DPtoLP
GetObjectW
GetViewportExtEx
GetWindowExtEx
Escape
GetMapMode
CreateCompatibleBitmap
LPtoDP
ExtTextOutW
CreateCompatibleDC
TextOutW
RectVisible
SelectObject
PtVisible

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

RegQueryValueW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc

comctl32

InitCommonControlsEx

oleaut32

VariantInit
VariantChangeType
VariantClear
SysAllocStringLen

Sections

.text
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 856KB - Virtual size: 852KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b0818deb7f16ff6fe594d6389471ea1

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

67:fd:eb:75:dc:48:33:db:a8:07:f5:a1:4f:a7:e8:6eCertificate

Extended Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

wininet

kernel32

shlwapi

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oleaut32

Sections

.text Size: 172KB - Virtual size: 169KB

.rdata Size: 40KB - Virtual size: 38KB

.data Size: 12KB - Virtual size: 23KB

.rsrc Size: 856KB - Virtual size: 852KB

01
Certificate

0a
Certificate

67:fd:eb:75:dc:48:33:db:a8:07:f5:a1:4f:a7:e8:6e
Certificate

.text
Size: 172KB - Virtual size: 169KB

.rdata
Size: 40KB - Virtual size: 38KB

.data
Size: 12KB - Virtual size: 23KB

.rsrc
Size: 856KB - Virtual size: 852KB