d23bf8fbe60a17db118c8bbaef3a4bc6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d23bf8fbe60a17db118c8bbaef3a4bc6_JaffaCakes118
Size

2.4MB
MD5

d23bf8fbe60a17db118c8bbaef3a4bc6
SHA1

f015cf488396ec45168b85cf516e26ab36480788
SHA256

bdb57509eebd8b7137364902c98c6dc3af467ee4161aaa34db0f5cc249ca1176
SHA512

b443aa742b8be19c5b88720901acdbcf1b2bc828bbecc9a12e63a258e9da1906f6873a49a7fe49143ca58d8ae41b7201fd9fa4578c0ebcea39703b5576c00f9a
SSDEEP

49152:/zfL91GAdDW0QTgswgYobnKJEWhhvThtAOAFMOXrV:LfyA9W0QoKoEWhhzAFT

Score

1^/10

Malware Config

Signatures

Files

d23bf8fbe60a17db118c8bbaef3a4bc6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

6ec140d5bf186a4279413dcccb298018

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ce
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

30/09/2015, 00:00

Not After

28/09/2018, 23:59

Subject

CN=Sogou.com,OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:1e:b9:6e:93:0b:fc:ad:e2:56:f1:05:4c:b3:68:97:dc:99:7c:ad
Signer

Actual PE Digest

7a:1e:b9:6e:93:0b:fc:ad:e2:56:f1:05:4c:b3:68:97:dc:99:7c:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_8_0_OldKernel_Freq\Bin\SogouPdb\SogouInput\SetupLib.pdb

Imports

shlwapi

StrStrIW
StrRetToBufW
StrToIntW
SHDeleteKeyW
PathFileExistsW
SHGetValueW

wininet

HttpEndRequestW
InternetQueryOptionW
HttpOpenRequestA
HttpAddRequestHeadersW
InternetWriteFile
InternetReadFile
InternetCrackUrlA
InternetOpenA
InternetOpenUrlA
InternetErrorDlg
HttpQueryInfoA
InternetOpenW
InternetOpenUrlW
InternetSetOptionW
InternetCloseHandle
InternetConnectA
HttpSendRequestExW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

kernel32

VirtualProtect
VirtualFree
LoadLibraryA
VirtualAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetVersionExW
SuspendThread
GetThreadContext
SetThreadContext
VirtualQuery
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetEndOfFile
GetCurrentDirectoryA
GetFullPathNameA
SetStdHandle
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetTempPathW
DeleteFileW
Sleep
lstrcpyW
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32NextW
CreateFileMappingW
Process32FirstW
GlobalFree
EnterCriticalSection
SetLastError
GetLastError
RaiseException
FlushInstructionCache
GetFileAttributesExW
MultiByteToWideChar
CreateFileW
ReadFile
TerminateProcess
GetExitCodeProcess
LeaveCriticalSection
WideCharToMultiByte
GetSystemDirectoryW
GlobalAlloc
OpenProcess
GetTickCount
WaitForSingleObject
GetCurrentProcess
MoveFileExW
CreateProcessW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
DebugBreak
OutputDebugStringW
lstrlenA
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
LocalFree
LocalAlloc
LoadLibraryW
FindNextFileW
FindClose
GetProcAddress
lstrlenW
GetStartupInfoA
SetHandleCount
GetConsoleMode
GetConsoleCP
LCMapStringA
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
GetModuleFileNameA
HeapCreate
ExitProcess
GetDriveTypeW
RtlUnwind
GetTimeZoneInformation
FindFirstFileA
GetDriveTypeA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCommandLineA
ResumeThread
GetFullPathNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapSize
HeapDestroy
IsProcessorFeaturePresent
GetWindowsDirectoryW
CreateFileA
GetACP
SetNamedPipeHandleState
WaitNamedPipeW
CreateIoCompletionPort
TransactNamedPipe
GetQueuedCompletionStatus
WaitForSingleObjectEx
GlobalHandle
GlobalUnlock
GlobalLock
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
QueryPerformanceFrequency
FlushFileBuffers
InterlockedExchange
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
CreateMutexW
CreateThread
DuplicateHandle
ExitThread
FormatMessageW
GetCommandLineW
QueryDosDeviceW
GetModuleHandleW
RemoveDirectoryW
GetLogicalDriveStringsW
SetFileAttributesW
FindFirstFileW
GetLocalTime
lstrcatW
FreeEnvironmentStringsA
GetProcessId
FileTimeToSystemTime
GetFileAttributesW
CopyFileW
GetFileType
WaitForMultipleObjects
PeekNamedPipe
InitializeCriticalSection
CreateDirectoryW
OpenEventW
CreateEventW
SetEvent
SetThreadPriority
GetDiskFreeSpaceExW
ReleaseMutex
OpenFileMappingW
GetExitCodeThread
OpenMutexW
TerminateThread
GetCurrentThread
FormatMessageA
ExpandEnvironmentStringsA
WriteFile
GetTempFileNameW
GetFileSize
SetFilePointer
SleepEx
GetSystemDirectoryA
DeleteCriticalSection
GetStdHandle

user32

TranslateMessage
LoadStringW
CopyRect
DefWindowProcW
CallWindowProcW
SetWindowLongW
GetWindowLongW
InvalidateRect
BeginPaint
LoadImageW
wvsprintfW
FillRect
CharNextW
GetWindowRect
SetTimer
EndPaint
GetKeyboardLayoutList
UnregisterClassA
WindowFromPoint
UnionRect
MonitorFromPoint
SubtractRect
FindWindowW
IntersectRect
GetFocus
OffsetRect
GetCursor
PtInRect
UpdateLayeredWindow
DrawTextW
ClientToScreen
SetCursor
ScreenToClient
SetCapture
GetKeyState
TrackMouseEvent
SetPropW
GetCursorPos
ReleaseCapture
SetRectEmpty
IsIconic
GetDesktopWindow
GetSystemMetrics
GetWindowThreadProcessId
NotifyWinEvent
GetPropW
IsWindowEnabled
GetDC
ReleaseDC
SetActiveWindow
wsprintfA
DestroyIcon
GetSystemMenu
DeleteMenu
GetMenuItemInfoW
wsprintfW
SendMessageTimeoutW
GetMenuItemCount
GetWindowTextLengthW
PostMessageW
KillTimer
GetParent
GetForegroundWindow
GetWindowTextW
GetDlgItem
SetWindowPos
ShowWindow
EnableWindow
SetWindowTextW
UnloadKeyboardLayout
LoadCursorW
GetClientRect
GetClassInfoExW
LoadKeyboardLayoutW
RegisterClassExW
GetMessageW
FindWindowExW
CreateWindowExW
MessageBoxW
SendMessageW
MessageBoxIndirectW
LoadIconW
SetParent
MoveWindow
SystemParametersInfoW
SetFocus
SetForegroundWindow
DestroyWindow
DispatchMessageW
GetMonitorInfoW
IsWindowVisible
MonitorFromWindow
SetRect
IsWindow

gdi32

DeleteDC
GetDeviceCaps
BitBlt
SetViewportOrgEx
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetFontData
GetTextExtentExPointW
SetTextCharacterExtra
SetBkMode
CreateDIBSection
SetTextColor
GetStockObject
CreateFontIndirectW
GetObjectW

advapi32

GetNamedSecurityInfoW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
LookupAccountSidW
GetTokenInformation
RegSetValueExW
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
OpenProcessToken
RegCreateKeyW
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
AdjustTokenPrivileges
RegEnumKeyExW
RegFlushKey
RegEnumValueW
LookupPrivilegeValueW
LookupAccountNameW
RegQueryInfoKeyW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyW

shell32

ShellExecuteExW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoCreateGuid
OleCreate
OleSetContainedObject
OleDraw
CoTaskMemFree

oleaut32

VariantInit
SysStringLen
SysAllocString
SysFreeString
VariantClear
GetErrorInfo
SysStringByteLen
SysAllocStringByteLen

ws2_32

sendto
recvfrom
WSASetLastError
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
inet_addr
ioctlsocket
select
__WSAFDIsSet
socket
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
WSAGetLastError
closesocket
WSAStartup
WSACleanup
listen
accept
gethostname

wldap32

ord50
ord60
ord143
ord211
ord22
ord26
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46
ord30

imm32

ImmDisableIME
ImmNotifyIME
ImmSetOpenStatus
ImmGetContext
ImmInstallIMEW
ImmGetIMEFileNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

msimg32

AlphaBlend

oleacc

AccessibleObjectFromWindow
LresultFromObject

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
BackupExe
BackupOtherFile
CancelDelayDelDir
CheckAccess
CmpFile
CreateSmartInfoUid
DefaultBrowserIsIE
DelBackupExe
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DeleteShortcut
DeleteShortcutWithPath
DeleteUsbdt
DownloadQuiet
ExecWait
FilterSid
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetHWID
GetHwndImage
GetHwndMain
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsFullScreenActivated
IsInWin8
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyEdit
MonitorVerifyUninstallSelect
MoveImeDir
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
RunLotus
SECheckOSInstalled
SaveInstallTime
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetQQShowType
SetReadSecond
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
UpdateFireWall_OctopusDownloader
WaitAccountThread

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 644KB - Virtual size: 644KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ec140d5bf186a4279413dcccb298018

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ceCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7a:1e:b9:6e:93:0b:fc:ad:e2:56:f1:05:4c:b3:68:97:dc:99:7c:adSigner

Headers

File Characteristics

PDB Paths

Imports

shlwapi

wininet

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

wldap32

imm32

version

psapi

msimg32

oleacc

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 644KB - Virtual size: 644KB

.data Size: 72KB - Virtual size: 151KB

.rsrc Size: 1024B - Virtual size: 712B

.reloc Size: 111KB - Virtual size: 110KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7d:c7:02:07:5f:cc:db:9e:63:38:5f:f5:13:14:c4:ce
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7a:1e:b9:6e:93:0b:fc:ad:e2:56:f1:05:4c:b3:68:97:dc:99:7c:ad
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 644KB - Virtual size: 644KB

.data
Size: 72KB - Virtual size: 151KB

.rsrc
Size: 1024B - Virtual size: 712B

.reloc
Size: 111KB - Virtual size: 110KB