28e3cc45466448b7178c5435a2acb299_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

28e3cc45466448b7178c5435a2acb299_JaffaCakes118
Size

3.0MB
MD5

28e3cc45466448b7178c5435a2acb299
SHA1

46e928137a2016b28deb0d9a9d2d9bcec79120ab
SHA256

e7084173329973677f37e9b89efd25a9510c96c1470dbdadc0c35fcdfce3246d
SHA512

8dd9a574be8880bcd3c486633b2859d2b2cd6803650d27d7a8010b7dc2c2f22730c0920e5caedb0635c386d8d3df201df43a7da3efe977d7f807ba8ceecc2293
SSDEEP

49152:zTHftFsFRpMHIOq86x1svs3poAnYFLelQyOWEf7Jp2e3/Csm94rg5WFbx7miv54w:XFFsFRpM3LeBA7Jke3c94rg0BAw

Score

1^/10

Malware Config

Signatures

Files

28e3cc45466448b7178c5435a2acb299_JaffaCakes118
.dll windows:5 windows x86 arch:x86

52321f3b4fd96d2088d14c0d3159bdbd

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

13/07/2016, 09:16

Not After

21/07/2019, 08:09

Subject

CN=深圳市为爱普信息技术有限公司,OU=IT Dept.,O=深圳市为爱普信息技术有限公司,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b6:13:67:b1:7d:5d:a3:53:3e:1d:37:57:90:a1:56:b1:d1:c9:8b:e5
Signer

Actual PE Digest

b6:13:67:b1:7d:5d:a3:53:3e:1d:37:57:90:a1:56:b1:d1:c9:8b:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\pc_code\i4airplayer\ffmpegcore\bin\ffmpegCore.pdb

Imports

kernel32

QueryPerformanceCounter
GetModuleFileNameA
GetModuleHandleA
PeekNamedPipe
FreeLibrary
GetCurrentProcess
GetTickCount
GetProcessTimes
LoadLibraryW
GetConsoleMode
GetStdHandle
GetProcAddress
SetConsoleCtrlHandler
GetTempPathA
GlobalAlloc
GlobalLock
QueryPerformanceFrequency
GlobalUnlock
OutputDebugStringW
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
LockResource
LoadResource
CreateMutexA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
SizeofResource
FindResourceA
VirtualQuery
CreateThread
DeleteFileA
OutputDebugStringA
WaitForMultipleObjects
GetLastError
GetFileAttributesA
Sleep
ReleaseMutex
CreateMutexW
CloseHandle
CreateEventW
ResetEvent
SetEvent
GlobalFree
WaitForSingleObject
IsProcessorFeaturePresent

user32

CopyIcon
MoveWindow
PostThreadMessageW
PeekMessageW
TranslateMessage
GetMessageW
GetWindowRect
GetCursorInfo
GetDC
ReleaseDC
GetIconInfo
ClientToScreen
DrawIcon
DestroyIcon
EnumDisplayMonitors
GetMonitorInfoW
GetCursorPos

gdi32

RealizePalette
SelectPalette
GetStockObject
CreateDIBitmap
DeleteObject
GetDIBits
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
GetBitmapBits
GetObjectW
CreateDCW
CreateCompatibleBitmap
DeleteDC

ole32

CoCreateInstance
CoTaskMemFree

msvcr100

??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
sprintf_s
memmove
??_U@YAPAXI@Z
malloc
_beginthreadex
printf
fopen
??3@YAXPAX@Z
_isnan
fwrite
fclose
??2@YAPAXI@Z
_purecall
strncmp
_endthreadex
??_V@YAXPAX@Z
abort
fputc
strncat
ceil
qsort
strerror
fputs
strstr
strchr
fflush
_errno
strtol
strncpy
strtok
strrchr
vfprintf
_localtime64
getenv
?what@exception@std@@UBEPBDXZ
getchar
perror
sscanf
signal
atoi
_wfopen
fopen_s
setvbuf
fread
strcpy_s
ftell
fseek
wcscpy_s
strncpy_s
strcspn
_gmtime64
fgets
strftime
_hypot
_vsnwprintf
_vsnwprintf_s
_vsnprintf
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
free
calloc
__iob_func
fprintf
_snprintf
_time64
_kbhit
_read
_write
sprintf
_wassert
asctime
_strdup
atof
strncat_s
_stricmp
realloc
_snprintf_s
strtoul
isspace
memcpy
memset
rand
srand
_vsnprintf_s
_itoa
floor
_CIpow
_CIlog10
__CxxFrameHandler3
_CIsqrt
_CxxThrowException
_CIexp
_CIlog
_getch

msvcp100

??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ

sdl2

SDL_DestroyMutex
SDL_CreateThread
SDL_WaitThread
SDL_SetTextureBlendMode
SDL_setenv
SDL_CondSignal
SDL_CreateCond
SDL_OpenAudioDevice
SDL_CreateWindow
SDL_UpdateTexture
SDL_UnlockTexture
SDL_ShowCursor
SDL_MixAudioFormat
SDL_CondWaitTimeout
SDL_SetWindowSize
SDL_GetRendererInfo
SDL_SetRenderDrawColor
SDL_PauseAudioDevice
SDL_UnlockMutex
SDL_LockTexture
SDL_PumpEvents
SDL_DestroyCond
SDL_RenderCopyEx
SDL_CloseAudioDevice
SDL_PeepEvents
SDL_getenv
SDL_RenderFillRect
SDL_QueryTexture
SDL_GetPixelFormatName
SDL_Quit
SDL_CreateWindowFrom
SDL_MapRGB
SDL_GetError
SDL_PushEvent
SDL_MixAudio
SDL_CreateRenderer
SDL_RenderClear
SDL_CreateMutex
SDL_Delay
SDL_memset
SDL_OpenAudio
SDL_CloseAudio
SDL_PauseAudio
SDL_RenderPresent
SDL_UpdateWindowSurface
SDL_DestroyTexture
SDL_DestroyRenderer
SDL_RenderCopy
SDL_CreateTexture
SDL_SetHint
SDL_FillRect
SDL_UpdateYUVTexture
SDL_GetWindowSurface
SDL_DestroyWindow
SDL_Init
SDL_WaitEvent
SDL_RenderSetLogicalSize
SDL_LockMutex
SDL_CondWait

avcodec-57

av_bsf_alloc
av_bsf_free
av_bsf_get_by_name
av_bsf_init
av_bsf_next
av_bsf_receive_packet
av_bsf_send_packet
av_codec_get_lowres
av_codec_get_max_lowres
av_codec_get_pkt_timebase
av_codec_is_decoder
av_codec_is_encoder
av_codec_next
av_codec_set_chroma_intra_matrix
av_codec_set_lowres
av_codec_set_pkt_timebase
av_copy_packet_side_data
av_free_packet
av_get_audio_frame_duration
av_get_exact_bits_per_sample
av_init_packet
av_lockmgr_register
av_new_packet
av_packet_alloc
av_packet_copy_props
av_packet_free
av_packet_get_side_data
av_packet_move_ref
av_packet_new_side_data
av_packet_ref
av_packet_rescale_ts
av_packet_unref
av_parser_change
av_parser_close
av_parser_init
av_rdft_calc
av_rdft_end
av_rdft_init
avcodec_alloc_context3
avcodec_close
avcodec_copy_context
avcodec_decode_audio4
avcodec_decode_subtitle2
avcodec_default_get_buffer2
avcodec_descriptor_get
avcodec_descriptor_get_by_name
avcodec_descriptor_next
avcodec_encode_subtitle
avcodec_encode_video2
avcodec_find_best_pix_fmt_of_2
avcodec_find_decoder
avcodec_find_decoder_by_name
avcodec_find_encoder
avcodec_find_encoder_by_name
avcodec_flush_buffers
avcodec_free_context
avcodec_get_class
avcodec_get_context_defaults3
avcodec_get_name
avcodec_open2
avcodec_parameters_alloc
avcodec_parameters_copy
avcodec_parameters_free
avcodec_parameters_from_context
avcodec_parameters_to_context
avcodec_receive_frame
avcodec_receive_packet
avcodec_register_all
avcodec_send_frame
avcodec_send_packet
avpicture_fill
avsubtitle_free

avfilter-6

av_buffersink_get_channel_layout
av_buffersink_get_channels
av_buffersink_get_format
av_buffersink_get_frame
av_buffersink_get_frame_flags
av_buffersink_get_frame_rate
av_buffersink_get_h
av_buffersink_get_hw_frames_ctx
av_buffersink_get_sample_aspect_ratio
av_buffersink_get_sample_rate
av_buffersink_get_time_base
av_buffersink_get_type
av_buffersink_get_w
av_buffersink_set_frame_size
av_buffersrc_add_frame
av_buffersrc_add_frame_flags
av_buffersrc_close
av_buffersrc_get_nb_failed_requests
av_buffersrc_parameters_alloc
av_buffersrc_parameters_set
avfilter_get_by_name
avfilter_get_class
avfilter_graph_alloc
avfilter_graph_alloc_filter
avfilter_graph_config
avfilter_graph_create_filter
avfilter_graph_free
avfilter_graph_parse2
avfilter_graph_parse_ptr
avfilter_graph_queue_command
avfilter_graph_request_oldest
avfilter_graph_send_command
avfilter_graph_set_auto_convert
avfilter_init_str
avfilter_inout_alloc
avfilter_inout_free
avfilter_link
avfilter_next
avfilter_pad_count
avfilter_pad_get_name
avfilter_pad_get_type
avfilter_register_all

avformat-57

av_codec_get_id
av_codec_get_tag2
av_dump_format
av_filename_number_test
av_find_best_stream
av_find_input_format
av_format_inject_global_side_data
av_format_set_audio_codec
av_format_set_data_codec
av_format_set_subtitle_codec
av_format_set_video_codec
av_guess_codec
av_guess_format
av_guess_frame_rate
av_guess_sample_aspect_ratio
av_iformat_next
av_interleaved_write_frame
av_new_program
av_oformat_next
av_pkt_dump_log2
av_program_add_stream_index
av_read_frame
av_read_pause
av_read_play
av_register_all
av_sdp_create
av_seek_frame
av_stream_get_codec_timebase
av_stream_get_end_pts
av_stream_get_parser
av_stream_get_recommended_encoder_configuration
av_stream_get_side_data
av_stream_new_side_data
av_write_frame
av_write_trailer
avformat_alloc_context
avformat_alloc_output_context2
avformat_close_input
avformat_find_stream_info
avformat_free_context
avformat_get_class
avformat_match_stream_specifier
avformat_network_init
avformat_new_stream
avformat_open_input
avformat_query_codec
avformat_seek_file
avformat_transfer_internal_stream_timing_info
avformat_write_header
avio_alloc_context
avio_check
avio_close
avio_close_dyn_buf
avio_closep
avio_context_free
avio_enum_protocols
avio_feof
avio_find_protocol_name
avio_flush
avio_open
avio_open2
avio_open_dyn_buf
avio_printf
avio_r8
avio_read
avio_seek
avio_size
avio_w8
avio_write

avutil-55

av_add_q
av_asprintf
av_audio_fifo_alloc
av_audio_fifo_realloc
av_audio_fifo_size
av_audio_fifo_write
av_bprint_chars
av_bprint_finalize
av_bprint_init
av_bprintf
av_buffer_create
av_buffer_default_free
av_buffer_ref
av_buffer_unref
av_calloc
av_compare_ts
av_default_item_name
av_dict_copy
av_dict_free
av_dict_get
av_dict_parse_string
av_dict_set
av_dict_set_int
av_display_rotation_get
av_display_rotation_set
av_expr_eval
av_expr_free
av_expr_parse
av_fast_malloc
av_fifo_alloc
av_fifo_freep
av_fifo_generic_read
av_fifo_generic_write
av_fifo_realloc2
av_fifo_size
av_fifo_space
av_find_nearest_q_idx
av_fopen_utf8
av_force_cpu_flags
av_frame_alloc
av_frame_clone
av_frame_copy
av_frame_copy_props
av_frame_free
av_frame_get_buffer
av_frame_move_ref
av_frame_ref
av_frame_unref
av_free
av_freep
av_get_bits_per_pixel
av_get_bytes_per_sample
av_get_channel_description
av_get_channel_layout
av_get_channel_layout_nb_channels
av_get_channel_layout_string
av_get_channel_name
av_get_cpu_flags
av_get_default_channel_layout
av_get_known_color_name
av_get_media_type_string
av_get_packed_sample_fmt
av_get_picture_type_char
av_get_pix_fmt
av_get_pix_fmt_name
av_get_sample_fmt
av_get_sample_fmt_name
av_get_sample_fmt_string
av_get_standard_channel_layout
av_get_token
av_gettime_relative
av_hwdevice_ctx_create
av_hwdevice_ctx_create_derived
av_hwdevice_find_type_by_name
av_hwdevice_get_type_name
av_hwdevice_iterate_types
av_hwframe_ctx_alloc
av_hwframe_ctx_init
av_hwframe_transfer_data
av_image_fill_arrays
av_image_fill_max_pixsteps
av_image_get_buffer_size
av_int_list_length_for_size
av_log
av_log2
av_log_default_callback
av_log_format_line
av_log_get_flags
av_log_get_level
av_log_set_callback
av_log_set_flags
av_log_set_level
av_malloc
av_mallocz
av_match_name
av_max_alloc
av_mul_q
av_opt_child_class_next
av_opt_eval_flags
av_opt_eval_int
av_opt_find
av_opt_get_key_value
av_opt_next
av_opt_set
av_opt_set_bin
av_opt_set_dict
av_opt_set_dict2
av_opt_set_from_string
av_opt_set_int
av_opt_set_sample_fmt
av_opt_show2
av_parse_cpu_caps
av_parse_ratio
av_parse_time
av_parse_video_rate
av_parse_video_size
av_pix_fmt_desc_get
av_pix_fmt_desc_get_id
av_pix_fmt_desc_next
av_realloc_array
av_realloc_f
av_reallocp_array
av_reduce
av_rescale
av_rescale_delta
av_rescale_q
av_rescale_q_rnd
av_rescale_rnd
av_sample_fmt_is_planar
av_samples_alloc
av_samples_get_buffer_size
av_samples_set_silence
av_strcasecmp
av_strdup
av_strerror
av_strlcat
av_strlcatf
av_strlcpy
av_strndup
av_strstart
av_strtod
av_strtok
av_usleep

swresample-2

swr_alloc
swr_alloc_set_opts
swr_convert
swr_free
swr_get_class
swr_get_delay
swr_init
swr_set_compensation

swscale-4

sws_alloc_context
sws_freeContext
sws_getCachedContext
sws_getContext
sws_get_class
sws_isSupportedInput
sws_isSupportedOutput
sws_scale

ws2_32

htonl
ntohl
gethostbyname
recvfrom
sendto
WSAStartup
getaddrinfo
ntohs
WSACleanup
bind
socket
freeaddrinfo
WSASetLastError
WSAIoctl
WSAGetLastError
getsockname
send
htons
select
shutdown
recv
__WSAFDIsSet
closesocket
listen
accept

avdevice-57

av_input_audio_device_next
av_input_video_device_next
av_output_audio_device_next
av_output_video_device_next
avdevice_free_list_devices
avdevice_list_input_sources
avdevice_list_output_sinks
avdevice_register_all

psapi

GetProcessMemoryInfo

iphlpapi

GetAdaptersInfo

winmm

timeGetTime

libplist2

plist_array_get_size
plist_new_data
plist_array_get_item
plist_new_string
plist_to_bin
plist_get_data_val
plist_new_array
plist_free
plist_get_node_type
plist_dict_set_item
plist_dict_get_item
plist_get_real_val
plist_array_append_item
plist_from_bin
plist_to_xml
plist_new_bool
plist_new_real
plist_new_dict
plist_new_uint
plist_dict_get_size
plist_get_uint_val
plist_get_bool_val
plist_get_string_val

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

52321f3b4fd96d2088d14c0d3159bdbd

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5Certificate

Extended Key Usages

Key Usages

b6:13:67:b1:7d:5d:a3:53:3e:1d:37:57:90:a1:56:b1:d1:c9:8b:e5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

ole32

msvcr100

msvcp100

sdl2

avcodec-57

avfilter-6

avformat-57

avutil-55

swresample-2

swscale-4

ws2_32

avdevice-57

psapi

iphlpapi

winmm

libplist2

advapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 1.6MB - Virtual size: 1.7MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 31KB - Virtual size: 30KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

6b:66:9b:73:b2:5f:87:63:b3:33:78:e5
Certificate

b6:13:67:b1:7d:5d:a3:53:3e:1d:37:57:90:a1:56:b1:d1:c9:8b:e5
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 1.6MB - Virtual size: 1.7MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 31KB - Virtual size: 30KB