fddf01976a230deb8b3feaceecded535_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fddf01976a230deb8b3feaceecded535_JaffaCakes118
Size

2.7MB
MD5

fddf01976a230deb8b3feaceecded535
SHA1

a5349ed3e2f528c4c34552a54dd12d619d445632
SHA256

8d5aa84e2183f2ba8b740214f7b2bda7edd1ad2a6d563983f4ca9e52be342bff
SHA512

2bac758a09659824c2dfff46a85117ffdd0cb659ad4b20e6fd8aded3733d065a2ed43e9bfa4b0d528e1fbf0a78c90a93bd9a3f13905569a140c50ad95d5e53bf
SSDEEP

49152:jv1SuOQrCRT1Z6K5yFyPTeRmTmyCa0xxrXM8tBmPlrB6Segp1u1fWK:r1SjtTn6K52dr/5

Score

1^/10

Malware Config

Signatures

Files

fddf01976a230deb8b3feaceecded535_JaffaCakes118
.exe windows:5 windows x86 arch:x86

aaacab7e8a0439024d6512430312e7f3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/09/2018, 00:00

Not After

01/02/2020, 23:59

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,OU=研发部,O=Beijing Qihu Technology Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-01,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:da:9f:59:1b:3f:77:98:b2:ac:81:df:0d:62:39:52:0d:1f:ff:4d:79:b4:a8:fc:02:a8:82:0a:af:30:84:2c
Signer

Actual PE Digest

34:da:9f:59:1b:3f:77:98:b2:ac:81:df:0d:62:39:52:0d:1f:ff:4d:79:b4:a8:fc:02:a8:82:0a:af:30:84:2c

Digest Algorithm

sha256

PE Digest Matches

true

bb:33:c3:44:2d:dc:d7:c4:03:52:9f:e7:02:00:eb:6a:e3:10:bb:f1
Signer

Actual PE Digest

bb:33:c3:44:2d:dc:d7:c4:03:52:9f:e7:02:00:eb:6a:e3:10:bb:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\se9\src\out\Release\setup.exe.pdb

Imports

advapi32

RegOpenKeyExW
RegCloseKey
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
GetSecurityInfo
SetSecurityInfo
FreeSid
OpenProcessToken
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
GetTokenInformation
DuplicateTokenEx
GetUserNameW
LookupAccountNameW
ConvertSidToStringSidW
RegSetValueExA
RegCreateKeyExA
CreateProcessAsUserW
RegEnumValueW
SystemFunction036
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA

gdi32

GetDIBits
DeleteObject
SetWorldTransform
ModifyWorldTransform
GetDeviceCaps
CreateFontIndirectW
DeleteDC
GetStockObject
SelectObject
GetTextExtentPoint32W
RectVisible
SaveDC
IntersectClipRect
RestoreDC
CreateRectRgnIndirect
SelectClipRgn
GetRgnBox
OffsetRgn
CombineRgn
CreateRectRgn
LPtoDP
SetBkMode
GetCurrentObject
SetLayout
GetLayout
GetObjectW
CreateDIBSection
GdiAlphaBlend
BitBlt
GetRandomRgn
GetObjectType
SetViewportOrgEx
SetGraphicsMode
CreateCompatibleDC

kernel32

InitializeCriticalSection
GetTempPathW
GetCurrentThreadId
MultiByteToWideChar
DeleteFileW
LoadLibraryW
GetProcAddress
GetCurrentProcessId
FreeLibrary
WideCharToMultiByte
GetTempFileNameW
GetTickCount
VirtualQuery
SetUnhandledExceptionFilter
CreateDirectoryW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetFileAttributesW
SetFileAttributesW
LocalFree
CopyFileW
MoveFileW
WaitForMultipleObjects
OpenProcess
CreateProcessW
ExpandEnvironmentStringsW
FreeResource
CreateThread
DeviceIoControl
GetVersionExW
IsBadWritePtr
SetWaitableTimer
TlsSetValue
CreateWaitableTimerW
SetEndOfFile
CancelWaitableTimer
CreateEventW
Sleep
SetEvent
GetDiskFreeSpaceExW
TlsAlloc
ResetEvent
SystemTimeToFileTime
TlsFree
IsBadReadPtr
HeapFree
GetLongPathNameW
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcessHeap
MoveFileExW
GetPrivateProfileStringW
TerminateThread
EnumResourceNamesW
GetFileSize
SetErrorMode
LoadLibraryExW
CreateMutexW
SetLastError
lstrlenW
GetPrivateProfileIntW
GetModuleHandleW
lstrcmpiW
lstrlenA
OutputDebugStringW
DebugBreak
SetInformationJobObject
QueryInformationJobObject
lstrcpynW
AssignProcessToJobObject
SetEnvironmentVariableW
CreateJobObjectW
ResumeThread
IsProcessInJob
GetLogicalDriveStringsW
GetUserDefaultLCID
GetDriveTypeW
GetExitCodeProcess
WritePrivateProfileStringW
GetEnvironmentVariableW
GetFileTime
GetCurrentThread
GetLongPathNameA
UnmapViewOfFile
LeaveCriticalSection
GetCurrentDirectoryW
ReplaceFileW
CreateFileMappingW
MapViewOfFile
SetHandleInformation
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetSystemDirectoryW
GetModuleHandleA
GetNativeSystemInfo
OutputDebugStringA
FormatMessageA
lstrcmpA
lstrcmpiA
GetFileAttributesExW
FindFirstFileExW
TzSpecificLocalTimeToSystemTime
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
GetSystemInfo
GetProcessId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
WritePrivateProfileStructW
FindResourceExW
TlsGetValue
RtlCaptureStackBackTrace
TryEnterCriticalSection
ReadProcessMemory
CompareStringW
GetUserDefaultUILanguage
GetLocaleInfoW
GetWindowsDirectoryW
VirtualProtect
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
CreateFileA
GetTimeZoneInformation
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
WriteConsoleW
EnumSystemLocalesW
IsValidLocale
ReadConsoleW
GetACP
TerminateProcess
VirtualAlloc
GetCommandLineW
VirtualFree
EnterCriticalSection
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
SetFilePointer
InitializeCriticalSectionAndSpinCount
SetFileTime
ReadFile
GetConsoleMode
GetConsoleCP
SetStdHandle
GetFullPathNameW
GetFileType
ExitProcess
FreeLibraryAndExitThread
ExitThread
RtlUnwind
OpenThread
HeapUnlock
HeapWalk
ReleaseMutex
HeapLock
GetSystemTime
LocalFileTimeToFileTime
LoadLibraryExA
InterlockedPushEntrySList
InterlockedPopEntrySList
GetCPInfo
GetStringTypeW
LCMapStringW
EncodePointer
FormatMessageW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateRemoteThread
WaitForSingleObject
GetCurrentProcess
FindResourceW
LoadResource
CloseHandle
LockResource
CreateFileW
WriteFile
SizeofResource
GetUserDefaultLangID

ole32

RevokeDragDrop
RegisterDragDrop
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeEx
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoSetProxyBlanket
PropVariantClear
DoDragDrop

oleaut32

VariantCopy
VarCmp
VarUI4FromStr
VariantInit
SysAllocString
SysStringLen
SysFreeString
VariantChangeType
CreateDispTypeInfo
CreateStdDispatch
VariantClear

psapi

GetProcessImageFileNameW
GetModuleInformation
EnumProcesses
GetModuleFileNameExW

shlwapi

PathFileExistsW
StrCpyW
PathIsDirectoryW
PathGetDriveNumberW
SHSetValueW
SHDeleteKeyW
SHDeleteValueW
StrStrIW
SHGetValueA
PathFindFileNameW
PathRemoveFileSpecW
SHGetValueW
PathAppendW
PathFindFileNameA

user32

TrackMouseEvent
AdjustWindowRectEx
InvalidateRect
GetFocus
ReleaseCapture
UpdateWindow
UpdateLayeredWindow
SetCursor
SendMessageW
GetCapture
InvalidateRgn
InflateRect
DrawIconEx
GetIconInfo
WindowFromDC
DefWindowProcW
CallWindowProcW
GetWindowRect
GetSystemMetrics
SetCapture
SetWindowTextW
RegisterClassExW
DestroyWindow
SetWindowPos
MessageBoxW
LoadStringW
GetMessageExtraInfo
ShowWindow
SetTimer
GetMonitorInfoW
MapWindowPoints
AttachThreadInput
GetForegroundWindow
SetFocus
BringWindowToTop
LoadCursorW
SetWindowLongW
GetClientRect
DrawTextW
KillTimer
PostQuitMessage
GetClassInfoExW
GetParent
SetForegroundWindow
LoadImageW
GetCursorPos
BeginPaint
EndPaint
GetWindowTextW
PostMessageW
FindWindowW
wsprintfW
GetDC
ReleaseDC
UnregisterClassW
GetWindow
SendMessageTimeoutW
IsWindow
GetClassNameW
GetDesktopWindow
RegisterWindowMessageW
PtInRect
GetKeyState
MoveWindow
SystemParametersInfoW
CharUpperW
FindWindowExW
GetShellWindow
IsIconic
CharNextW
GetMessageW
DispatchMessageW
TranslateMessage
GetWindowLongW
GetActiveWindow
GetWindowThreadProcessId
MonitorFromWindow
SetActiveWindow
FillRect
CreateWindowExW
ScreenToClient

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

winmm

timeGetTime

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

rpcrt4

RpcBindingFromStringBindingW
NdrClientCall2
RpcStringBindingComposeW

comctl32

InitCommonControlsEx

gdiplus

GdiplusStartup
GdipCloneImage
GdipBitmapLockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesWrapMode
GdipAlloc
GdipDisposeImage
GdipFree
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits

secur32

GetUserNameExW

netapi32

Netbios

Exports

Exports

?Wide2ASCII@installer@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
GetHandleVerifier

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 649KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 29B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aaacab7e8a0439024d6512430312e7f3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:daCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dcCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

33:90:20:77:61:c4:26:dd:94:50:03:0dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

34:da:9f:59:1b:3f:77:98:b2:ac:81:df:0d:62:39:52:0d:1f:ff:4d:79:b4:a8:fc:02:a8:82:0a:af:30:84:2cSigner

bb:33:c3:44:2d:dc:d7:c4:03:52:9f:e7:02:00:eb:6a:e3:10:bb:f1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

gdi32

kernel32

ole32

oleaut32

psapi

shlwapi

user32

version

winmm

userenv

rpcrt4

comctl32

gdiplus

secur32

netapi32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 649KB - Virtual size: 648KB

.data Size: 102KB - Virtual size: 1.7MB

.gfids Size: 1024B - Virtual size: 864B

.tls Size: 512B - Virtual size: 29B

.rsrc Size: 389KB - Virtual size: 389KB

.reloc Size: 112KB - Virtual size: 112KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

47:33:bb:60:89:e3:2f:cd:22:4d:0e:49:de:b6:63:da
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5b:21:3a:c4:69:7a:65:f6:b7:82:7d:9e:48:92:64:dc
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

33:90:20:77:61:c4:26:dd:94:50:03:0d
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

34:da:9f:59:1b:3f:77:98:b2:ac:81:df:0d:62:39:52:0d:1f:ff:4d:79:b4:a8:fc:02:a8:82:0a:af:30:84:2c
Signer

bb:33:c3:44:2d:dc:d7:c4:03:52:9f:e7:02:00:eb:6a:e3:10:bb:f1
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 649KB - Virtual size: 648KB

.data
Size: 102KB - Virtual size: 1.7MB

.gfids
Size: 1024B - Virtual size: 864B

.tls
Size: 512B - Virtual size: 29B

.rsrc
Size: 389KB - Virtual size: 389KB

.reloc
Size: 112KB - Virtual size: 112KB