c2820922e6ce4acceffaadc265f8d326_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c2820922e6ce4acceffaadc265f8d326_JaffaCakes118
Size

243KB
MD5

c2820922e6ce4acceffaadc265f8d326
SHA1

a5862ffb9e5dc5a32b38c1269dda6f5901061116
SHA256

96cd0fcc768324fc81d797ed5eff276be425b5cda480c6db3e6fad813fc6499b
SHA512

9a883e3bf87f93ab5882de9fadb8afb547e53fde1918d45cb22c947472ddf236627a9d867bdf9d6f1d9971486eea6b9598b102c3d767baa3fa11df55d2579f9d
SSDEEP

6144:GMy06JGlBziwcx8q//93X6nKFIvSKZIgZIdKz:2NGTiqq/lX6nKFIvSKZBZz

Score

1^/10

Malware Config

Signatures

Files

c2820922e6ce4acceffaadc265f8d326_JaffaCakes118
.dll windows:5 windows x86 arch:x86

dcc78bc78850a64aeade6fcdf39e6c75

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:9e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:76:11:f3:33:28:3e
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

26/08/2013, 15:45

Not After

30/09/2016, 00:57

Subject

CN=北京优贝在线网络科技有限公司,O=北京优贝在线网络科技有限公司,L=北京市,ST=北京市,C=CN,1.2.840.113549.1.9.1=#0c12736f6674406d61696c2e353176762e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e8:f8:35:61:c7:4d:57:d7:fc:8e:50:29:87:8e:63:5d:cb:9b:f7:aa
Signer

Actual PE Digest

e8:f8:35:61:c7:4d:57:d7:fc:8e:50:29:87:8e:63:5d:cb:9b:f7:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\Delphi\NewMvBoxPlayer\Downloader\Build\libcomms.pdb

Imports

kernel32

FlushFileBuffers
GetLocalTime
GetModuleFileNameA
CloseHandle
FindResourceExW
FindResourceW
LoadResource
GetFileAttributesExA
GetVolumeInformationA
SizeofResource
FormatMessageW
GetFileAttributesW
GetModuleFileNameW
GetSystemDirectoryA
lstrlenW
RaiseException
GetLastError
LockResource
LocalFree
SetFilePointer
ReadFile
CreateFileW
GetFileSizeEx
DeleteFileW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WaitForSingleObject
GetTickCount
WideCharToMultiByte
DisableThreadLibraryCalls
CreateEventW
lstrlenA
IsBadCodePtr
MultiByteToWideChar
WriteFile
GlobalAlloc
Sleep
GlobalFree
GetPrivateProfileStringW
GetCommandLineA
WritePrivateProfileStringW
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
GetSystemDirectoryW
CopyFileW
IsBadWritePtr
FileTimeToSystemTime
GetFileSize
WaitForMultipleObjectsEx
ReadFileEx
CancelIo
InterlockedIncrement
WriteConsoleW
SetStdHandle
LoadLibraryW
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
RtlUnwind
SetEvent
CreateFileA
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
ExitThread
CreateThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
GetCPInfo
GetACP

ws2_32

WSAStartup
htonl
htons
WSAEventSelect
setsockopt
WSACleanup
bind
socket
closesocket
gethostbyname
recvfrom
WSAGetLastError
WSAWaitForMultipleEvents
ntohs
inet_ntoa
inet_addr
sendto

shlwapi

PathFileExistsA

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcc78bc78850a64aeade6fcdf39e6c75

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

19:9d:f8:9eCertificate

Key Usages

02:76:11:f3:33:28:3eCertificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

e8:f8:35:61:c7:4d:57:d7:fc:8e:50:29:87:8e:63:5d:cb:9b:f7:aaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

shlwapi

iphlpapi

version

Sections

.text Size: 187KB - Virtual size: 186KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 828B

.reloc Size: 13KB - Virtual size: 12KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

19:9d:f8:9e
Certificate

02:76:11:f3:33:28:3e
Certificate

3d
Certificate

e8:f8:35:61:c7:4d:57:d7:fc:8e:50:29:87:8e:63:5d:cb:9b:f7:aa
Signer

.text
Size: 187KB - Virtual size: 186KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 828B

.reloc
Size: 13KB - Virtual size: 12KB