074a18a643754adcad5e651a11243838_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

074a18a643754adcad5e651a11243838_JaffaCakes118
Size

96KB
MD5

074a18a643754adcad5e651a11243838
SHA1

17a8f94e512299d053922c5cf0cf0f864ea5b311
SHA256

a33a36e3b133d3d7c15850509f747fbfe1e4ad95cd121d214e2922771c8a27f0
SHA512

8d5126989eb155a8c03970f23f7ab2bdaa48d78b002661127b97168546fa9f54577def300b6c9961beb1a3129089d04b2d0634afcb90fd77e89074d1933a0266
SSDEEP

1536:JW8fbhSkvO/SdCV2Ex8pSN8NH75TbYVrGqOC72wIndMYnhFePEb3vkNH75Tt:JZbckvODihB0VrGqOC72wInuMhqSshBt

Score

1^/10

Malware Config

Signatures

Files

074a18a643754adcad5e651a11243838_JaffaCakes118
.exe windows:4 windows x86 arch:x86

72e4eb7caefe9d851363f215501a3f89

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7f:c8:08:71:a6:6f:e6:b0:7d:8c:fc:a5:af:93:01:4d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

18/02/2008, 00:00

Not After

17/02/2009, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:14:88:34:4a:58:da:a7:38:08:0c:d4:ab:d2:d1:05:80:da:5d:86
Signer

Actual PE Digest

b9:14:88:34:4a:58:da:a7:38:08:0c:d4:ab:d2:d1:05:80:da:5d:86

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\QQLive_Dailybuild\src\symbol\QQLiveUp.pdb

Imports

log

?CreateStandardFont@@YAXAAPAUHFONT__@@@Z

mfc80u

ord2381
ord2379
ord2397
ord293
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord3395
ord2388
ord577
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord1118
ord5231
ord5956
ord2362
ord1591
ord4276
ord4716
ord3570
ord3397
ord2311
ord1271
ord3678
ord5727
ord1925
ord4255
ord4480
ord5210
ord3756
ord3943
ord4179
ord2985
ord2638
ord6271
ord1121
ord3824
ord1049
ord334
ord593
ord5113
ord5971
ord1176
ord2011
ord3327
ord4475
ord2832
ord265
ord5562
ord5209
ord5226
ord2239
ord4562
ord3942
ord5222
ord5220
ord2399
ord1911
ord266
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord1908
ord5579
ord2009
ord2054
ord4320
ord6274
ord1123
ord3795
ord6272
ord4008
ord4535
ord1139
ord4032
ord3677
ord1182
ord1178
ord566
ord757
ord4026
ord6063
ord354
ord605
ord1894
ord1634
ord1572
ord6086
ord5609
ord1386
ord3286
ord4119
ord762
ord501
ord709
ord3176
ord4256
ord5199
ord715
ord4238
ord1058
ord1392
ord2169
ord6720
ord1785
ord1542
ord1661
ord1662
ord4884
ord4729
ord4206
ord3635
ord5178
ord4743
ord4574
ord314
ord2365
ord1067
ord6751
ord4347
ord2163
ord1513
ord6273
ord3796
ord6275
ord3339
ord4961
ord1353
ord5171
ord1955
ord1647
ord1646
ord1590
ord5196
ord3198
ord741
ord2086
ord2531
ord1582
ord2725
ord1079
ord6721
ord2829
ord572
ord5911
ord4301
ord1611
ord2708
ord1608
ord2856
ord3940
ord2534
ord1393
ord2640
ord4234
ord2527
ord3311
ord5148
ord3712
ord3204
ord1899
ord3713
ord5067
ord3703
ord764
ord1198
ord2925
ord5908

msvcr80

_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
memset
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcscat_s
wcsncpy_s
_recalloc
free
memcpy_s
malloc
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
wcscpy_s
__CxxFrameHandler3

kernel32

MultiByteToWideChar
GetVersionExW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetModuleHandleW
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
SizeofResource
LoadResource
LoadLibraryExW
FindResourceW
GetLastError
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
RaiseException
FreeLibrary
lstrlenW
GetFileAttributesW
GetProcAddress
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection

user32

EnableWindow
SendMessageW
SetWindowLongW
PostMessageW
InvalidateRect
CharNextW
UnregisterClassA
ShowOwnedPopups
GetWindowRect
AppendMenuW
GetSystemMenu
DrawIcon
GetClientRect
LoadIconW
GetSystemMetrics
IsIconic
IsWindow
SetForegroundWindow

gdi32

CreateFontIndirectW
GetObjectW
GetStockObject

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW

shell32

ShellExecuteW
Shell_NotifyIconW

comctl32

InitCommonControlsEx

ole32

CoRegisterClassObject
CoLoadLibrary
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoRevokeClassObject
StringFromGUID2

oleaut32

VariantInit
VarUI4FromStr
SysFreeString
SysAllocString
DispCallFunc
LoadRegTypeLi
VariantClear
UnRegisterTypeLi
SysStringLen
LoadTypeLi
RegisterTypeLi

msvcp80

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72e4eb7caefe9d851363f215501a3f89

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7f:c8:08:71:a6:6f:e6:b0:7d:8c:fc:a5:af:93:01:4dCertificate

Extended Key Usages

Key Usages

b9:14:88:34:4a:58:da:a7:38:08:0c:d4:ab:d2:d1:05:80:da:5d:86Signer

Headers

File Characteristics

PDB Paths

Imports

log

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp80

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 23KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7f:c8:08:71:a6:6f:e6:b0:7d:8c:fc:a5:af:93:01:4d
Certificate

b9:14:88:34:4a:58:da:a7:38:08:0c:d4:ab:d2:d1:05:80:da:5d:86
Signer

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 23KB