d61707e93ed9d5f29306a831a2b396d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d61707e93ed9d5f29306a831a2b396d9_JaffaCakes118
Size

8.1MB
MD5

d61707e93ed9d5f29306a831a2b396d9
SHA1

27dc16e295a4301e0a85a4f91cd9f3c185697879
SHA256

d6c6fc2344805c1e4f273b4186a0ff32a1549689ef7ce3d67246f3bc83e34dd1
SHA512

967acb727df8890d335ce3f402658aba8bee8a7d1197a5f7226dfbb195cd6757ed49482a157188f6c414bda2c40eda0ca324a17e5b48dcbecc23ed5423237ac9
SSDEEP

49152:Jo4QcVyNZ5lCVFfZw7Wo4yDN/7/r3m056kKryy4EbqXBUCAScfacD+E2zhlNAYa3:tVrOxzqiApbqXBa+3iRnWsefW5T

Score

1^/10

Malware Config

Signatures

Files

d61707e93ed9d5f29306a831a2b396d9_JaffaCakes118
.dll windows:5 windows x64 arch:x64

b4c26072da69f8d859f4284b2fff7f1a

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_6\Bin\SogouPdb\SogouInput\SogouPy64.pdb

Imports

msimg32

GradientFill
TransparentBlt
AlphaBlend

kernel32

LCMapStringW
DuplicateHandle
OpenProcess
GetCurrentProcess
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateEventW
GlobalGetAtomNameW
SetEvent
CreateThread
ReleaseMutex
OpenFileMappingW
CreateFileMappingW
OpenMutexW
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
ResumeThread
GetProcAddress
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OpenEventW
SetNamedPipeHandleState
EnterCriticalSection
GetLastError
CreateFileW
GlobalAddAtomW
GetCurrentThread
SetThreadPriority
GetSystemDirectoryW
GetFileAttributesExW
OpenThread
ReadFile
LeaveCriticalSection
Sleep
InitializeCriticalSection
WriteFile
WaitNamedPipeW
WideCharToMultiByte
GetCommandLineW
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CloseHandle
GetCurrentThreadId
GetACP
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
lstrlenW
ExitThread
GetVersionExW
IsBadReadPtr
CreateMutexW
FindFirstFileW
FindClose
GetTempPathW
FileTimeToSystemTime
GetLocalTime
HeapAlloc
GetProcessHeap
VirtualAlloc
LoadLibraryA
VirtualFree
VirtualProtect
GetFileTime
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
GetFileSize
lstrlenA
FreeLibrary
HeapFree
LocalAlloc
LocalFree
DeviceIoControl
CreateFileA
lstrcpyA
GetSystemDirectoryA
lstrcatA
CopyFileA
HeapReAlloc
SetLastError
SetFilePointer
FormatMessageW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetTempFileNameW
MoveFileExW
GetLogicalDriveStringsW
GetFileAttributesW
QueryDosDeviceW
SetFileAttributesW
CreateProcessW
CopyFileW
GetExitCodeProcess
GetProcessId
TlsAlloc
TlsFree
OutputDebugStringW
FlushFileBuffers
RtlCaptureContext
VirtualQuery
SetUnhandledExceptionFilter
RtlVirtualUnwind
TerminateProcess
RtlLookupFunctionEntry
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GlobalHandle
WaitForSingleObjectEx
SetWaitableTimer
CreateWaitableTimerW
TlsGetValue
SleepEx
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
FormatMessageA
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GetWindowsDirectoryA
GlobalReAlloc
CreateFileMappingA
OpenFileMappingA
GetModuleHandleA
SwitchToThread
RaiseException
UnhandledExceptionFilter
ExitProcess
FlsSetValue
GetCommandLineA
FileTimeToLocalFileTime
GetDriveTypeW
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
GetTimeZoneInformation
RtlUnwindEx
GetFileInformationByHandle
GetDriveTypeA
FindFirstFileA
RtlPcToFileHeader
HeapSetInformation
HeapCreate
HeapDestroy
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
GetFullPathNameW
GetCurrentDirectoryA
GetDateFormatA
GetTimeFormatA
SetStdHandle
SetEndOfFile
GetFullPathNameA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
OpenWaitableTimerW

user32

CreateWindowExW
ReleaseDC
OffsetRect
GetDC
GetClientRect
LoadCursorW
SetCapture
MonitorFromPoint
UpdateLayeredWindow
SetCursor
DefWindowProcW
CallWindowProcW
EnableWindow
RegisterClassExW
SetPropW
BeginPaint
IsWindowEnabled
TrackMouseEvent
UnregisterClassW
ScreenToClient
EndPaint
DrawTextW
IntersectRect
SubtractRect
RedrawWindow
GetCursor
SetMenuItemInfoW
FillRect
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
GetKeyboardLayoutList
EqualRect
DestroyIcon
CreateDialogParamW
DialogBoxParamW
SetClipboardData
SetCaretPos
OpenClipboard
EmptyClipboard
CloseClipboard
GetWindowPlacement
InflateRect
SetCursorPos
SetWindowRgn
GetSysColorBrush
GetClassInfoExW
SetScrollInfo
PostQuitMessage
LoadBitmapW
IsRectEmpty
WindowFromPoint
wsprintfA
wsprintfW
SetClassLongPtrW
GetClassLongPtrW
mouse_event
PostMessageW
SetWindowLongPtrW
SendMessageW
MessageBoxW
GetForegroundWindow
GetKeyboardState
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
MsgWaitForMultipleObjectsEx
SetWindowPos
SetRectEmpty
IsCharAlphaNumericW
LoadStringW
GetWindowTextLengthW
NotifyWinEvent
SetRect
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
GetWindowLongW
SystemParametersInfoW
ShowWindow
ClientToScreen
PtInRect
GetAncestor
GetCaretPos
FindWindowExW
GetPropW
GetWindowThreadProcessId
GetWindow
RegisterWindowMessageW
SendMessageTimeoutW
TranslateMessage
DispatchMessageW
GetSystemMetrics
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetAsyncKeyState
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongPtrW
LoadImageW
GetMenuItemInfoW
GetCursorPos
GetMenuItemCount
GetMenuInfo
DestroyMenu
DestroyWindow
SetForegroundWindow
GetFocus
GetParent
FindWindowW
LoadIconW
EndDialog
IsWindow
SetTimer
GetMessageW
PeekMessageW
PostThreadMessageW

gdi32

ExtCreateRegion
SetMapMode
SetBkColor
GetCharABCWidthsFloatW
CombineRgn
OffsetRgn
Rectangle
GetClipRgn
GetPixel
GetObjectW
CreateCompatibleDC
SelectObject
DeleteObject
SetPixel
CreateDIBSection
DeleteDC
MoveToEx
LineTo
SelectClipRgn
CreateCompatibleBitmap
GetFontUnicodeRanges
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetStockObject
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
StretchDIBits
GetFontData
CreateFontIndirectW
BitBlt
CreateFontW
StretchBlt
SetBkMode
SetTextCharacterExtra
CreateDCW
GetDeviceCaps
GetTextExtentPoint32W
SetTextColor

advapi32

OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCreateKeyExW
AddAccessAllowedAceEx
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
CryptImportKey
CryptAcquireContextW
RegDeleteKeyW
RegCreateKeyW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegDeleteValueA
RegEnumValueA
RegNotifyChangeKeyValue
RegCreateKeyExA
CryptGetKeyParam

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

shlwapi

StrStrIW
SHDeleteKeyA
SHGetValueW

oleacc

AccessibleObjectFromEvent
LresultFromObject
AccessibleObjectFromWindow

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SogouIn
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4c26072da69f8d859f4284b2fff7f1a

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msimg32

kernel32

user32

gdi32

advapi32

imm32

shlwapi

oleacc

Exports

Exports

Sections

.text Size: 5.6MB - Virtual size: 5.6MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 160KB - Virtual size: 337KB

.pdata Size: 347KB - Virtual size: 347KB

.SogouIn Size: 14KB - Virtual size: 13KB

.rsrc Size: 152KB - Virtual size: 152KB

.reloc Size: 66KB - Virtual size: 66KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 5.6MB - Virtual size: 5.6MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 160KB - Virtual size: 337KB

.pdata
Size: 347KB - Virtual size: 347KB

.SogouIn
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 152KB - Virtual size: 152KB

.reloc
Size: 66KB - Virtual size: 66KB