e23e5a5b8f206a95a8da861b3d80bd05_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e23e5a5b8f206a95a8da861b3d80bd05_JaffaCakes118
Size

524KB
MD5

e23e5a5b8f206a95a8da861b3d80bd05
SHA1

68f4f677fe28282176184eb7f3af417d9713114c
SHA256

1b66c041bc2c74b8a9ba27795f9390d0a3b037dc8fa7a1739f035096faf3f71c
SHA512

4c97403f6db96077d49242028e246271ecbd977981d6c2f36374b328698e5f7f2d8f85affe7f24ab344247e7b3b1e8569c872021ad074638672feb91b2c37bd9
SSDEEP

6144:O98qZL/lWV0tnSBPd0T9XTiS5shJDdLbI6ubj7mEGjnkyZ9GryL6t//Vc/k1bkkq:O98qZlWVOr55sbDdzuRGLJZ9ac/ekhBp

Score

1^/10

Malware Config

Signatures

Files

e23e5a5b8f206a95a8da861b3d80bd05_JaffaCakes118
.exe windows:4 windows x86 arch:x86

64679233ba8ecc9bfadeca7f707254b4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:9f:1e:2f:73:eb:9c:0f:7d:fa:ac:48:16:b2:92:d3
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

21/01/2009, 00:00

Not After

21/01/2010, 23:59

Subject

CN=DoubleD Advertising Limited,O=DoubleD Advertising Limited,POSTALCODE=N/A,STREET=COMMITTEE RD SHATIN NT+STREET=PLAZA 138 SHATIN RURAL+STREET=15/F TOWER 1 GRAND CENTRAL,L=HONG KONG,ST=HONG KONG,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:58:1c:b2:8c:3f:13:23:0e:93:4a:22:e6:5a:61:e3:bb:41:ff:7c
Signer

Actual PE Digest

6d:58:1c:b2:8c:3f:13:23:0e:93:4a:22:e6:5a:61:e3:bb:41:ff:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

x:\Projects\ProductwiseToolbar\Sources\VS_Projects\Toolbar Updater\Toolbar Updater\Release\bin\stbup.pdb

Imports

kernel32

FindResourceW
LoadResource
SizeofResource
FreeLibrary
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ExitThread
SetLastError
LoadLibraryExW
GetCurrentProcess
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryW
OpenProcess
Sleep
TerminateProcess
FindClose
FindFirstFileW
CreateProcessW
GetExitCodeProcess
CloseHandle
CreateDirectoryW
WaitForSingleObject
LockResource
FindResourceA
lstrcpyW
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
OutputDebugStringW
DebugBreak
lstrlenA
InterlockedIncrement
InterlockedDecrement
CopyFileW
DeleteFileW
GetCurrentThreadId
SetHandleInformation
CreatePipe
CreateProcessA
GetEnvironmentVariableA
CreateFileMappingA
GetOverlappedResult
GetSystemTimeAdjustment
GetProcessTimes
GetWindowsDirectoryA
GlobalMemoryStatus
GetThreadTimes
SetConsoleMode
CreateEventA
SetEvent
lstrlenW
MultiByteToWideChar
FindNextFileA
FindFirstFileA
ReleaseMutex
CreateMutexW
LocalAlloc
GlobalAlloc
GlobalFree
GetSystemTime
GetVersionExW
LocalFree
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileW
ReadFile
RemoveDirectoryW
FindNextFileW
GetTickCount
LoadLibraryA
GetModuleHandleA
GetFileAttributesW
GetTempFileNameW
GetVersionExA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
WideCharToMultiByte
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetStartupInfoW
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
GetOEMCP
IsValidCodePage
HeapDestroy
HeapCreate
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetCurrentProcessId
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
GetCurrentDirectoryW
GetLocalTime
CreateFileMappingW
DeleteFileA

user32

SetWindowPos
InvalidateRect
ShowWindow
SetTimer
KillTimer
EnableWindow
GetDlgItem
GetWindowTextW
SetWindowTextW
wsprintfW
UnregisterClassA
CopyImage
GetCapture
GetQueueStatus
GetClipboardOwner
FindWindowA
SendMessageA
GetWindowLongW
DestroyIcon
GetClientRect
CharLowerW
FindWindowW
GetActiveWindow
DialogBoxParamW
LoadImageW
GetCursorPos
ClientToScreen
IsMenu
GetSubMenu
SetMenuDefaultItem
TrackPopupMenu
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
CallWindowProcW
SetWindowLongW
IsWindow
DefWindowProcW
EndPaint
BeginPaint
GetForegroundWindow
MessageBoxW
GetSystemMetrics
DestroyWindow
CharNextW
wvsprintfW
LoadStringW
DestroyMenu
EndDialog
DrawTextW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
MapWindowPoints
SendMessageW

gdi32

CreateCompatibleBitmap
GetMapMode
CreateBitmap
GetObjectW
DeleteDC
SetTextColor
SetBkMode
DPtoLP
DeleteObject
SetBkColor
CreateCompatibleDC
BitBlt
SetMapMode
StretchBlt
SelectObject

advapi32

CryptReleaseContext
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
GetUserNameW
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptGetHashParam
CryptAcquireContextW
CryptDestroyKey
CryptGetKeyParam
CryptDeriveKey
CryptEncrypt
RegSetValueExA
CryptDecrypt
RegQueryValueExW
RegCreateKeyW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA

shell32

SHGetFolderPathW
ShellExecuteExW
Shell_NotifyIconW

ole32

OleRun
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CreateStreamOnHGlobal
CoUninitialize

oleaut32

VariantClear
GetErrorInfo
OleLoadPicture
SysAllocString
SysFreeString
VarUI4FromStr

netapi32

NetLocalGroupGetMembers
NetApiBufferFree

shlwapi

PathSearchAndQualifyW

comctl32

InitCommonControlsEx

psapi

EnumProcesses
EnumProcessModules
GetModuleFileNameExW

urlmon

URLDownloadToFileW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

HttpSendRequestW
InternetConnectW
InternetQueryDataAvailable
HttpOpenRequestW
HttpQueryInfoW
InternetOpenW
InternetCloseHandle
InternetReadFile

Sections

.text
Size: 360KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64679233ba8ecc9bfadeca7f707254b4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

51:9f:1e:2f:73:eb:9c:0f:7d:fa:ac:48:16:b2:92:d3Certificate

Extended Key Usages

Key Usages

6d:58:1c:b2:8c:3f:13:23:0e:93:4a:22:e6:5a:61:e3:bb:41:ff:7cSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

netapi32

shlwapi

comctl32

psapi

urlmon

version

wininet

Sections

.text Size: 360KB - Virtual size: 357KB

.rdata Size: 104KB - Virtual size: 101KB

.data Size: 12KB - Virtual size: 30KB

.rsrc Size: 40KB - Virtual size: 37KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

51:9f:1e:2f:73:eb:9c:0f:7d:fa:ac:48:16:b2:92:d3
Certificate

6d:58:1c:b2:8c:3f:13:23:0e:93:4a:22:e6:5a:61:e3:bb:41:ff:7c
Signer

.text
Size: 360KB - Virtual size: 357KB

.rdata
Size: 104KB - Virtual size: 101KB

.data
Size: 12KB - Virtual size: 30KB

.rsrc
Size: 40KB - Virtual size: 37KB