d635846306a9eb1f8db145e7dbdd65cd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d635846306a9eb1f8db145e7dbdd65cd_JaffaCakes118
Size

145KB
MD5

d635846306a9eb1f8db145e7dbdd65cd
SHA1

94bde6d1c4922df0c01b03901eb50734f7a52fcf
SHA256

7d603c6a56a75d682bb80c5c6a75ee502058e49f69d0298f65c9c395bb6f0202
SHA512

84d8c8ca7b59d6b71cd064e17859f2c6940dfd5fb6ad02d04400c47877e418a867bc55b08dd494cc6563ce869f609a9e5fe7c472201a3a330a3b241076c2f2f4
SSDEEP

3072:no0rNq6JUEzAKbW7qj+qkYIg72HMWpM8DBvWlPcyY/h:noMUTEW7qj+5Yv72HhDpWlPc7/h

Score

1^/10

Malware Config

Signatures

Files

d635846306a9eb1f8db145e7dbdd65cd_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b8e6bfacce8677c10adab9e3dbf13aef

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d3:5f:09:6b:d4:b6:01:3c:bf:b8:60:24:cc:0c:04:85:2d:2f:0c:15
Signer

Actual PE Digest

d3:5f:09:6b:d4:b6:01:3c:bf:b8:60:24:cc:0c:04:85:2d:2f:0c:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WideCharToMultiByte
GetModuleHandleW
GetModuleFileNameW
GetLastError
MultiByteToWideChar
lstrcpynW
SetEvent
ResetEvent
lstrlenW
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
CreateEventW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadReadPtr
GetTempPathW
CreateDirectoryW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
LoadLibraryExW
GetSystemDirectoryW
ReadProcessMemory
InterlockedDecrement
GetUserDefaultLangID
IsBadStringPtrW
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
lstrcpynA
lstrlenA
lstrcmpW
LoadLibraryA
OutputDebugStringA
GetFileAttributesW
DisableThreadLibraryCalls
GetModuleHandleA
LocalFree
lstrcmpiW
GetVersion
GetVersionExW
GetCurrentProcess
FreeLibrary
GetProcAddress
SetLastError
LoadLibraryW

user32

IsWindowVisible
GetClassInfoW
LoadCursorW
GetClassLongW
SetClassLongW
GetDC
RegisterClassW
DispatchMessageW
SetTimer
PostMessageW
DestroyWindow
InvalidateRect
TranslateMessage
SetWindowPos
IsWindow
GetSystemMetrics
SendMessageW
FillRect
RemovePropW
IsWindowUnicode
SetPropW
GetPropW
DefWindowProcW
GetWindowLongA
CreateWindowExW
GetWindowThreadProcessId
CallWindowProcW
EndPaint
IsRectEmpty
BeginPaint
ReleaseDC
GetWindowLongW
GetWindowRgn
GetSysColor
GetSysColorBrush
CallNextHookEx
GetClassNameA
PtInRect
SetWindowLongW
SetWindowsHookExW
UnhookWindowsHookEx
ShowWindow
GetWindowDC
SetWindowRgn
DrawTextW
InflateRect
LoadImageW
GetWindowRect
SystemParametersInfoW
MapWindowPoints
GetParent
FindWindowExW
ScreenToClient
GetCursorPos
SetCursor
ClientToScreen
KillTimer
GetClientRect
GetWindow

gdi32

FillRgn
CreateRectRgn
CreatePolygonRgn
DeleteDC
GetObjectW
CreateCompatibleDC
DeleteObject
SetBkMode
CreateSolidBrush
StretchBlt
MoveToEx
LineTo
GetStockObject
SelectObject
CreatePen

oleaut32

SysStringByteLen
SysFreeString
SysAllocString
VariantInit
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysAllocStringByteLen

msvcp60

??0bad_alloc@std@@QAE@ABV01@@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1bad_alloc@std@@UAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??_7bad_alloc@std@@6B@
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD1@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

shlwapi

PathAppendW
PathFindFileNameW
wnsprintfA
PathFileExistsW
PathRemoveFileSpecW
PathRemoveBackslashW
PathRemoveBlanksW
PathIsDirectoryW
PathStripToRootW
wnsprintfW
SHGetValueW
SHSetValueW

msvcrt

_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
srand
rand
strncpy
strcpy
wcsncpy
memcpy
memcmp
memset
wcslen
wcstombs
_CxxThrowException
??0exception@@QAE@ABQBD@Z
mbstowcs
??0exception@@QAE@ABV0@@Z
malloc
abs
_snwprintf
strcmp
sprintf
time
strlen
_except_handler3
_wcsicmp
_strrev
_adjust_fdiv
_purecall
free
memmove
realloc
__CxxFrameHandler
??2@YAPAXI@Z
atoi
fputc
exit
_iob
calloc
fgetc

wininet

InternetCrackUrlW
InternetSetCookieW
InternetReadFile
HttpAddRequestHeadersW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetCloseHandle
InternetOpenW

ws2_32

htons
ntohl

shell32

SHGetSpecialFolderPathW

ole32

CoCreateInstance
OleRun
OleInitialize
OleUninitialize

Exports

Exports

OnButtonMessage

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.webslic
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8e6bfacce8677c10adab9e3dbf13aef

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

d3:5f:09:6b:d4:b6:01:3c:bf:b8:60:24:cc:0c:04:85:2d:2f:0c:15Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

msvcp60

shlwapi

msvcrt

wininet

ws2_32

shell32

ole32

Exports

Exports

Sections

.text Size: 72KB - Virtual size: 68KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 12KB - Virtual size: 12KB

.webslic Size: 4KB - Virtual size: 8B

.rsrc Size: 20KB - Virtual size: 17KB

.reloc Size: 12KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

d3:5f:09:6b:d4:b6:01:3c:bf:b8:60:24:cc:0c:04:85:2d:2f:0c:15
Signer

.text
Size: 72KB - Virtual size: 68KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 12KB - Virtual size: 12KB

.webslic
Size: 4KB - Virtual size: 8B

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 12KB - Virtual size: 9KB