267e71c758d53bf2dba4a8e13989a3f3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

267e71c758d53bf2dba4a8e13989a3f3_JaffaCakes118
Size

77KB
MD5

267e71c758d53bf2dba4a8e13989a3f3
SHA1

1a55af68ea5b8b96c5c382440969615bd9c9c12e
SHA256

b6460802ad84108f6dfe5004e9391c11af5c0d3cbd6a56344ec7606a62d0aaee
SHA512

f4b82760f190d6783151368243fe7dc1631d3842c9bd4bf9fd9aa95dd0b5459131c7c2f07097da04b6c62b22ab1ca1a8a4e951545c031f0855e089f9b968eb75
SSDEEP

1536:YTtYgFPzQyLze+ybO+DfHn+BMhhykDpa7C4:YTtrL++ybO+DfH+BMvykD0N

Score

1^/10

Malware Config

Signatures

Files

267e71c758d53bf2dba4a8e13989a3f3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6204c9389498247accaa84951e07e7a6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

88:16:fa:b5:d9:90:e1:44:9f:b3:74:41:03:3d:b3:64:ac:ce:95:c5
Signer

Actual PE Digest

88:16:fa:b5:d9:90:e1:44:9f:b3:74:41:03:3d:b3:64:ac:ce:95:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\qqpcmgr_proj\QQPCMgr_Public\Basic\Output\BinFinal\QQPCBTU.pdb

Imports

ws2_32

ntohs
htons
ntohl
htonl

kernel32

WideCharToMultiByte
DeleteCriticalSection
GetCurrentThreadId
LeaveCriticalSection
WaitForSingleObject
InterlockedExchange
SetLastError
EnterCriticalSection
GetModuleHandleW
GetLocalTime
HeapReAlloc
HeapDestroy
InitializeCriticalSection
MultiByteToWideChar
Sleep
GetModuleFileNameW
FreeLibrary
GetProcAddress
VirtualQuery
LoadLibraryW
SetEvent
MapViewOfFile
OpenFileMappingW
GetLastError
CreateEventW
OpenEventW
CloseHandle
UnmapViewOfFile
HeapSize
GetFileAttributesW
GetCurrentDirectoryW
InterlockedCompareExchange
HeapAlloc
GetProcessHeap
HeapFree
GetDriveTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW

user32

GetSystemMetrics
SystemParametersInfoW
GetDesktopWindow
SetWindowLongW
GetWindowLongW
EnableWindow
FindWindowExW
SetWindowTextW
SetWindowPos
SendMessageW
GetClientRect
GetWindowRect
IsWindow
GetClassNameW
IsIconic
EqualRect
GetParent
GetWindowTextW
IsWindowVisible
SendMessageTimeoutW
MessageBoxW
FindWindowA

advapi32

RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

msvcr80

_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_CxxThrowException
_encode_pointer
__dllonexit
_unlock
fwrite
strchr
strncpy_s
_snprintf_s
_configthreadlocale
setlocale
_memicmp
fflush
strrchr
??_V@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
_purecall
wcscat_s
??2@YAPAXI@Z
wcscpy_s
_invalid_parameter_noinfo
realloc
memmove
wcsrchr
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
_wtoi
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
wcsncat_s
wcsncpy_s
wcsncpy
_wcsicmp
_controlfp_s
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_vsnwprintf_s
_crt_debugger_hook
memset
memcpy
__CxxFrameHandler3
_invoke_watson

wininet

InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle

shlwapi

PathRemoveFileSpecW
PathAddBackslashW

Sections

.text
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6204c9389498247accaa84951e07e7a6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

88:16:fa:b5:d9:90:e1:44:9f:b3:74:41:03:3d:b3:64:ac:ce:95:c5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

msvcp80

msvcr80

wininet

shlwapi

Sections

.text Size: 24KB - Virtual size: 22KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 24KB - Virtual size: 20KB

.reloc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

88:16:fa:b5:d9:90:e1:44:9f:b3:74:41:03:3d:b3:64:ac:ce:95:c5
Signer

.text
Size: 24KB - Virtual size: 22KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 24KB - Virtual size: 20KB

.reloc
Size: 4KB - Virtual size: 3KB