e18505fe4e2432206493f9a0e93f3506_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e18505fe4e2432206493f9a0e93f3506_JaffaCakes118
Size

635KB
MD5

e18505fe4e2432206493f9a0e93f3506
SHA1

e2c6e88259a6fe12f6d56884742841cc40c29725
SHA256

8848099ed4dd88e63a5b5437b0ebc40a498fb6e3b4a572a70b81d057c2d5d097
SHA512

4029becb4f676267bcae4112b13a50e434d09064e1628513216d2a6daaaf1a2fafa5d07802cfe1b617f2ccf77ed33a006df933d4bc07456ec40d85b27e8cf645
SSDEEP

12288:kwnt4b7DG5foeFHFZ5jpQJZYBo7dGOyqBsqDKsZFs0E2D/U2N6wA:k04b/GFHFjjpQX7dGfssq2s/bhX

Score

1^/10

Malware Config

Signatures

Files

e18505fe4e2432206493f9a0e93f3506_JaffaCakes118
.exe windows:5 windows x86 arch:x86

50589217ffbdfba14d7a166575c753a2

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/02/2015, 00:00

Not After

05/04/2016, 23:59

Subject

CN=Beijing Baofeng Technology Co.\, Ltd.,OU=在线QA,O=Beijing Baofeng Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:5e:d8:3e:b1:16:2c:62:7d:0a:8e:5e:78:f6:40:2b:14:f3:97:0d
Signer

Actual PE Digest

63:5e:d8:3e:b1:16:2c:62:7d:0a:8e:5e:78:f6:40:2b:14:f3:97:0d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\jenkins\workspace\暴风主干\trunk\bin\Release\MediaLibraryUpdate.pdb

Imports

medialibrary

SetUserUpdatedMediaLibrary
ModifyIconWithUAC
UpdateMediaLibraryEx
SetMediaLibraryCallback
UpdateMediaLibraryFromPlatform
HasUserUpdatedMediaLibrary
OpenMediaLibraryDir
UpdateMediaLibrarySilent
IsNeedChangeNewStatus
RemoveShellViewIcon
UpdateDesktopShortcutIcon
RemoveRestartExplorerFlag
IsNeedRestartExplorer
RunPlatForm
IsPlatformRun
?GetDislikeListEx@UserInfoFromGalaxy@@SAHAAV?$vector@UIconMovieInfo@@V?$allocator@UIconMovieInfo@@@std@@@std@@@Z
?GetLikeListEx@UserInfoFromGalaxy@@SAHAAV?$vector@UIconMovieInfo@@V?$allocator@UIconMovieInfo@@@std@@@std@@@Z
?SetDisLikeItemCancel@UserInfoFromGalaxy@@SAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?SetDisLikeItem@UserInfoFromGalaxy@@SAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0000@Z
?SetLikeItemCancel@UserInfoFromGalaxy@@SAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?SetLikeItem@UserInfoFromGalaxy@@SAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0000@Z
?IsInLikeList@UserInfoFromGalaxy@@SAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
GetMediaLibraryDir
UpdateMediaLibrary

crt

ord38
ord36
ord46
ord55
ord77
ord27
ord58
ord29
ord3
ord4
ord62
ord10
ord133
ord37
ord72
ord35
ord78
ord119
ord74
ord5
ord34

gdiplus

GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipDrawImageRectRect
GdiplusShutdown
GdiplusStartup
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipAlloc
GdipReleaseDC
GdipFree
GdipImageGetFrameDimensionsCount
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipLoadImageFromStream

kernel32

HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
GlobalReAlloc
GlobalFree
ReadFile
GetFileSize
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GetModuleFileNameW
GetTickCount
WideCharToMultiByte
GetCommandLineW
WaitForSingleObject
CreateEventW
CreateEventA
SetEvent
CloseHandle
CreateMutexW
CreateThread
ResumeThread
GetExitCodeThread
Sleep
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
TerminateThread
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
RaiseException
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
OutputDebugStringW
CopyFileW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
FindFirstFileW
FindClose
DeleteFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryW
SuspendThread
LoadLibraryW
GetProcAddress
GetModuleHandleW
FreeLibrary
DeleteCriticalSection
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
GetWindowsDirectoryW
WinExec
GetLocalTime
CreateFileW
SetFilePointer
WriteFile
GetVersionExW
lstrcpyW
lstrcmpiA
MultiByteToWideChar
lstrcmpiW

user32

GetMenuItemCount
UpdateWindow
GetPropA
SetRectEmpty
SystemParametersInfoW
GetMonitorInfoW
MonitorFromWindow
SetCursor
PtInRect
SetParent
IsWindowVisible
GetSystemMetrics
SetActiveWindow
SetForegroundWindow
IsIconic
FindWindowExW
EnumChildWindows
MessageBoxW
GetCapture
FindWindowW
GetWindowDC
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
FindWindowA
SetWindowTextA
InflateRect
CopyRect
OffsetRect
GetMenuItemInfoW
UnhookWindowsHookEx
UnregisterClassA
DefWindowProcW
GetParent
GetWindowRect
SetWindowLongW
GetWindowLongW
CallWindowProcW
SendMessageW
GetDlgItem
IsWindow
DestroyWindow
KillTimer
SetTimer
PostMessageW
ShowWindow
MsgWaitForMultipleObjects
SetPropA
SetWindowsHookExW
GetCursorPos
CallNextHookEx
GetClassNameA
GetMenuInfo
SetMenuInfo
GetMenuState
RemoveMenu
SetMenuItemInfoW
EqualRect
MapWindowPoints
IsWindowEnabled
TrackMouseEvent
SetWindowRgn
EnableWindow
PostQuitMessage
IsZoomed
DrawIconEx
SetRect
IsRectEmpty
RegisterWindowMessageW
IsChild
GetFocus
SetFocus
GetWindow
GetClassNameW
GetSysColor
CharNextW
SetWindowPos
RedrawWindow
GetClassInfoExW
CreateWindowExW
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
InvalidateRgn
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
DestroyAcceleratorTable
LoadCursorW
RegisterClassExW
GetMessageW
PostThreadMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
DrawTextW

gdi32

SetBkMode
SetTextColor
GetClipBox
ExcludeClipRect
Rectangle
StretchBlt
GetPixel
CreateFontIndirectW
EnumFontFamiliesExW
GetRgnBox
RoundRect
GetTextExtentPoint32W
Ellipse
CreateDCW
SelectPalette
CreatePen
ExtTextOutW
SetBkColor
CreateSolidBrush
GetObjectW
GetDeviceCaps
BitBlt
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
DeleteObject
CreateFontW
CombineRgn
ExtCreateRegion
CreateDIBSection
CreateDIBitmap
GetDIBits
RealizePalette

advapi32

RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW

shell32

ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHChangeNotify
SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoInitialize
CoUninitialize
OleUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemRealloc

oleaut32

LoadTypeLi
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
SysAllocStringLen
VariantInit
VariantClear
DispGetParam
VarUI4FromStr
VariantChangeType
VariantCopy
VarBstrCmp
DispCallFunc

shlwapi

PathAppendW
PathFileExistsW
StrStrIW
PathCombineW
PathFindFileNameW
StrCmpIW
PathIsDirectoryW
StrCpyW
StrChrIW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx
_TrackMouseEvent

msimg32

TransparentBlt

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr100

_lock
_snwprintf
_wtol
wcsstr
wcscpy_s
iswspace
_snwprintf_s
_vscwprintf
_wcslwr_s
vswprintf_s
wcsrchr
wcschr
wcsnlen
wcsncpy_s
wmemcpy_s
iswdigit
_wtoi
malloc
__dllonexit
_recalloc
free
_beginthreadex
??_V@YAXPAX@Z
_purecall
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_vsnwprintf_s
??2@YAPAXI@Z
wcscat_s
_wcsicmp
memmove_s
memcpy_s
??3@YAXPAX@Z
_unlock
?terminate@@YAXXZ
_mbslwr_s
memset
swprintf_s
_wtof
_onexit
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
memcpy
__CxxFrameHandler3
__RTDynamicCast
_CxxThrowException

Sections

.text
Size: 317KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50589217ffbdfba14d7a166575c753a2

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

63:5e:d8:3e:b1:16:2c:62:7d:0a:8e:5e:78:f6:40:2b:14:f3:97:0dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

medialibrary

crt

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

msvcp100

msvcr100

Sections

.text Size: 317KB - Virtual size: 316KB

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 175KB - Virtual size: 175KB

.reloc Size: 39KB - Virtual size: 38KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

3f:5a:9d:93:d7:70:22:9c:50:3b:83:55:b1:5b:6d:f0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

63:5e:d8:3e:b1:16:2c:62:7d:0a:8e:5e:78:f6:40:2b:14:f3:97:0d
Signer

.text
Size: 317KB - Virtual size: 316KB

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 175KB - Virtual size: 175KB

.reloc
Size: 39KB - Virtual size: 38KB