eb6ab67e8f25558ebb772e83dd87ff07_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eb6ab67e8f25558ebb772e83dd87ff07_JaffaCakes118
Size

240KB
MD5

eb6ab67e8f25558ebb772e83dd87ff07
SHA1

17272eca30329ebf010e1fdaa27581e07851ad0b
SHA256

05368f4bd8499f8683121e51d4dd50e56a5b9917b6d7083eedaa13646e540458
SHA512

701f4490b0c2bcfc5e7fe6e7096fbcfcaf23c4789979517e2da9cac7cefa374e4e9d60fed977fb8864dc593d64523abfccaa6dabdff92b4e9da1b7ee8603dab3
SSDEEP

6144:B6saVvS0clFrSwIg3eQFO0+PdpRzFbfEg3Ba:B6saZ5c3rnICL0PdjzpBa

Score

1^/10

Malware Config

Signatures

Files

eb6ab67e8f25558ebb772e83dd87ff07_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c03f1b8a7121083bcdf75dbd90761ff2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:4a:2e:93:ab:7f:7c:5b:74:2e:02:fb:80:05:84:af:98:94:fb:49
Signer

Actual PE Digest

1f:4a:2e:93:ab:7f:7c:5b:74:2e:02:fb:80:05:84:af:98:94:fb:49

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins_Trunk\workspace\QQRepair_For_10\qqpcmgr_proj\Basic\Output\BinFinal\QQRepair.pdb

Imports

ws2_32

htonl
ntohs
htons
ntohl

kernel32

CreateDirectoryW
ExpandEnvironmentStringsW
DeleteFileW
WriteFile
CreateFileW
GetLastError
OpenEventW
GetSystemDirectoryW
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetExitCodeProcess
LockResource
LoadResource
SizeofResource
FindResourceW
DeleteCriticalSection
GetModuleHandleExW
WTSGetActiveConsoleSessionId
SetLastError
ProcessIdToSessionId
InterlockedDecrement
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
InterlockedCompareExchange
GetSystemDefaultLangID
InterlockedExchange
VirtualQuery
lstrlenW
InterlockedIncrement
FreeLibrary
SwitchToThread
SetFilePointer
FindResourceExW
RaiseException
GetVersionExA
HeapDestroy
HeapReAlloc
HeapSize
HeapFree
GetProcessHeap
TerminateProcess
GetStartupInfoW
UnhandledExceptionFilter
LocalFree
GetVersionExW
Sleep
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetTickCount
LeaveCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
LoadLibraryW
CreateFileA
IsDebuggerPresent
GetFileSize
ReadFile
GetCommandLineW
GetModuleFileNameW
HeapAlloc
GetModuleHandleW
SetErrorMode
GetProcAddress
InitializeCriticalSection
lstrcpynW
VirtualAllocEx
SetUnhandledExceptionFilter
WriteProcessMemory
EnterCriticalSection
GetCurrentThreadId
CreateEventW
SearchPathW
GetCurrentProcessId
OpenProcess
CreateProcessW
CloseHandle
WaitForSingleObject
GetCurrentProcess
OpenFileMappingW
SetEvent
GetLocalTime
UnmapViewOfFile
MapViewOfFile
QueryPerformanceCounter
lstrcmpiW

user32

IsWindow
FindWindowA
SendMessageTimeoutW
FindWindowW
GetWindowThreadProcessId
UnregisterClassA

advapi32

RegQueryValueExA
RegOpenKeyW
RegOpenKeyA
RegDeleteValueW
RegEnumValueA
RegQueryInfoKeyA
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegFlushKey
RegDeleteKeyW
ConvertSidToStringSidW
LookupAccountSidW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetKeySecurity
RegGetKeySecurity
OpenProcessToken
GetTokenInformation
RegOpenKeyExA
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

shell32

SHCreateDirectoryExW
CommandLineToArgvW

oleaut32

VariantClear

shlwapi

StrStrIW
SHDeleteKeyW
PathAppendA
PathAppendW
PathFileExistsW
StrStrIA
PathRemoveFileSpecW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imm32

ImmDisableIME

msvcp80

?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

msvcr80

_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
fclose
fflush
strncpy_s
fwrite
strrchr
_memicmp
wcsncat_s
strchr
_except_handler3
??3@YAXPAX@Z
_snwprintf_s
memset
wcschr
free
malloc
_wtol
wcscpy_s
memcpy
wcslen
_strnicmp
__CxxFrameHandler3
??_V@YAXPAX@Z
atoi
_stricmp
strtok_s
strcpy_s
wcsnlen
_invalid_parameter_noinfo
tolower
_wcsnicmp
_snprintf_s
_wcsicmp
wcscat_s
strnlen
wcsncpy_s
??2@YAPAXI@Z
swprintf_s
_wtoi
toupper
memmove_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_purecall
_wsplitpath_s
swscanf_s
wcsrchr
_wtoi64
_vsnprintf_s
_vsnwprintf_s
memcpy_s
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm

psapi

EnumProcesses
GetModuleFileNameExW
GetProcessMemoryInfo
GetModuleBaseNameW
EnumProcessModules

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c03f1b8a7121083bcdf75dbd90761ff2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

1f:4a:2e:93:ab:7f:7c:5b:74:2e:02:fb:80:05:84:af:98:94:fb:49Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

version

imm32

msvcp80

msvcr80

psapi

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 92KB - Virtual size: 100KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

1f:4a:2e:93:ab:7f:7c:5b:74:2e:02:fb:80:05:84:af:98:94:fb:49
Signer

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 92KB - Virtual size: 100KB