2a2ab61181c3379e3d017f54accf21da_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2a2ab61181c3379e3d017f54accf21da_JaffaCakes118
Size

2.3MB
MD5

2a2ab61181c3379e3d017f54accf21da
SHA1

a49536b236e1d233e3107a85fc7ca931fdfaa6d9
SHA256

45fe0e704fb3507e9ed39901f3cc0a9d23b359dee20d43ef8c7226b1e0cca472
SHA512

ab82d6fd33f360871ddb98fe109276f7cf5e586ca62031732b2ff54a96b1b2dbdbbb984e0c5064235cc640a367d9795e5cbea866969b28c6ddbfc3d947b66400
SSDEEP

49152:JfaxgHGxEd0ET7vFQ0gVmKvWXfpBc0ZJy8bo5BKA9ylBy:Jfb0ES0rWWXfHcAJO

Score

1^/10

Malware Config

Signatures

Files

2a2ab61181c3379e3d017f54accf21da_JaffaCakes118
.exe windows:5 windows x86 arch:x86

719c26937b0663fb65e1045e01ed8b81

Code Sign

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-09-2019 00:00

Not After

22-09-2020 12:00

Subject

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19-09-2019 00:00

Not After

22-09-2020 12:00

Subject

CN=上海广乐网络科技有限公司,OU=运营部,O=上海广乐网络科技有限公司,ST=上海市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:3a:a9:b0:8f:be:26:80:b4:f8:ef:d1:4f:b2:59:83:10:f4:e4:c5:a2:83:84:3f:df:ba:79:14:af:2d:cb:f6
Signer

Actual PE Digest

b9:3a:a9:b0:8f:be:26:80:b4:f8:ef:d1:4f:b2:59:83:10:f4:e4:c5:a2:83:84:3f:df:ba:79:14:af:2d:cb:f6

Digest Algorithm

sha256

PE Digest Matches

true

03:ad:e5:38:78:80:16:9d:57:5a:4e:e6:46:ea:25:db:b6:9e:2f:80
Signer

Actual PE Digest

03:ad:e5:38:78:80:16:9d:57:5a:4e:e6:46:ea:25:db:b6:9e:2f:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleHandleExW
IsBadReadPtr
LoadLibraryA
ExpandEnvironmentStringsA
GetCommandLineW
GetCurrentProcessId
GetComputerNameExA
CreateEventW
TerminateThread
OpenProcess
GetModuleHandleA
DuplicateHandle
CreateProcessW
Sleep
CopyFileW
ExpandEnvironmentStringsW
GetLocalTime
MultiByteToWideChar
GetFileSizeEx
GetProcessTimes
CreateMutexW
GetCurrentProcess
lstrcmpiW
GetModuleFileNameW
WaitForSingleObject
SetEvent
CreateThread
SetFileAttributesW
DeleteFileW
CreateFileW
CloseHandle
LoadLibraryW
GetModuleHandleW
WideCharToMultiByte
SetErrorMode
WriteProcessMemory
DosDateTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
MulDiv
lstrlenW
OpenMutexW
TerminateProcess
InterlockedDecrement
GetTickCount
ExitProcess
DeleteCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
LoadLibraryExW
GetProcAddress
FreeLibrary
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
WaitForSingleObjectEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
SetConsoleCtrlHandler
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
GetSystemInfo
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
FormatMessageW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
LocalFree
VerSetConditionMask
VerifyVersionInfoA
InitializeCriticalSection
SleepEx
FormatMessageA
WaitForMultipleObjects
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
lstrcpyW
InterlockedIncrement
ReleaseMutex
GetFileSize
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalAlloc
MoveFileExW
GetVersionExW
GlobalLock
GlobalUnlock
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
ResumeThread
SetThreadAffinityMask
GetVolumeInformationW
DeviceIoControl
GetSystemDirectoryW
CreateFileA
GetCurrentThread
GetComputerNameW
FindFirstFileW
WriteFile
GetFileAttributesW
SetNamedPipeHandleState
CreateNamedPipeW
DisconnectNamedPipe
ResetEvent
GetOverlappedResult
TransactNamedPipe
WaitNamedPipeW
ConnectNamedPipe
WriteConsoleW
RtlUnwind
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
GetFullPathNameW
SetEnvironmentVariableA
GetCurrentDirectoryW
RemoveDirectoryW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetACP
GetConsoleMode
ReadConsoleW

user32

MoveWindow
PostQuitMessage
GetClassNameW
GetWindowTextW
GetWindowPlacement
SetWindowPlacement
EnumWindows
SetWinEventHook
GetForegroundWindow
SetLayeredWindowAttributes
SendMessageW
SetWindowTextW
FlashWindowEx
TrackMouseEvent
SetForegroundWindow
LoadMenuW
GetSubMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
PtInRect
wsprintfW
GetSystemMetrics
EnableWindow
PeekMessageW
TranslateMessage
SetTimer
GetWindowLongW
SetWindowLongW
IsWindowVisible
DestroyWindow
ShowWindow
CallWindowProcW
GetWindowRect
SetCursor
GetLastInputInfo
DefWindowProcW
LoadCursorW
RegisterClassExW
CreateWindowExW
UpdateWindow
IsWindow
IsIconic
GetCursorPos
LoadImageW
KillTimer
GetDesktopWindow
GetShellWindow
WindowFromPoint
GetParent
DispatchMessageW
GetPropW
IsZoomed
FindWindowExW
GetMonitorInfoW
MonitorFromWindow
SetWindowPos
PostMessageW
GetWindowThreadProcessId
ClientToScreen
CharPrevW
DrawTextW
MessageBoxW
SetWindowRgn
RegisterWindowMessageW
GetWindowRgn
UpdateLayeredWindow
IsRectEmpty
IntersectRect
GetSysColor
FillRect
SetRect
HideCaret
ShowCaret
GetCaretPos
MapWindowPoints
ScreenToClient
SetCaretPos
GetCaretBlinkTime
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetWindowTextLengthW
IsWindowEnabled
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
InflateRect
UnionRect
OffsetRect
GetMessageW
RegisterClassW
GetClassInfoExW
SetFocus
GetMenu
SetPropW
CreateCaret
GetClientRect
AdjustWindowRectEx
GetWindow
CharNextW
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
LookupAccountNameW
ConvertSidToStringSidA
EnumServicesStatusW
OpenSCManagerW
RegQueryInfoKeyW
RegOpenCurrentUser
GetUserNameA
CheckTokenMembership
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid

ole32

CoInitializeSecurity
CoSetProxyBlanket
OleLockRunning
CLSIDFromProgID
ReleaseStgMedium
CreateStreamOnHGlobal
OleDuplicateData
DoDragDrop
RegisterDragDrop
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoInitialize
StringFromCLSID
CoCreateGuid
CLSIDFromString

oleaut32

VariantClear
SysAllocString
VariantInit
SysAllocStringByteLen
SysFreeString
SysStringByteLen

shlwapi

PathRemoveFileSpecW
PathAppendW
StrStrIW
StrStrW
StrCpyW
PathFindFileNameW
StrStrIA
PathFileExistsA
PathFindFileNameA
PathAppendA
StrIsIntlEqualW

wininet

InternetReadFile
InternetSetOptionW
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpOpenRequestA
HttpQueryInfoA

imagehlp

MakeSureDirectoryPathExists

ws2_32

ntohs
gethostname
ntohl
htonl
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
WSASetLastError
recv
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
socket
setsockopt
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send

wldap32

ord211
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46
ord143
ord60

gdiplus

GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdiplusStartup
GdipSetStringFormatTrimming
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipFillRectangleI
GdipDrawRectangleI
GdipCreateSolidFill
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipSetPenMode
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdiplusShutdown
GdipCreatePen1
GdipFree
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipCloneBrush
GdipDeleteBrush
GdipDeletePen

iphlpapi

GetAdaptersInfo

msimg32

AlphaBlend

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

gdi32

SelectObject
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRectRgn
PtInRegion
CreateDIBSection
CreateRoundRectRgn
CombineRgn
CreatePenIndirect
SaveDC
RestoreDC
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CloseEnhMetaFile
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBitmapBits
GetBitmapBits
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 160KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

719c26937b0663fb65e1045e01ed8b81

Code Sign

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

b9:3a:a9:b0:8f:be:26:80:b4:f8:ef:d1:4f:b2:59:83:10:f4:e4:c5:a2:83:84:3f:df:ba:79:14:af:2d:cb:f6Signer

03:ad:e5:38:78:80:16:9d:57:5a:4e:e6:46:ea:25:db:b6:9e:2f:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wininet

imagehlp

ws2_32

wldap32

gdiplus

iphlpapi

msimg32

version

gdi32

imm32

comctl32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 351KB - Virtual size: 351KB

.data Size: 160KB - Virtual size: 183KB

.gfids Size: 1KB - Virtual size: 1KB

.rsrc Size: 97KB - Virtual size: 96KB

.reloc Size: 94KB - Virtual size: 94KB

03:3d:f7:55:e2:9d:8c:3b:b8:b5:89:6a:e9:e2:b8:54
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

06:4f:f3:c6:27:4b:bb:34:b8:8d:9c:05:58:46:97:94
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

b9:3a:a9:b0:8f:be:26:80:b4:f8:ef:d1:4f:b2:59:83:10:f4:e4:c5:a2:83:84:3f:df:ba:79:14:af:2d:cb:f6
Signer

03:ad:e5:38:78:80:16:9d:57:5a:4e:e6:46:ea:25:db:b6:9e:2f:80
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 351KB - Virtual size: 351KB

.data
Size: 160KB - Virtual size: 183KB

.gfids
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 97KB - Virtual size: 96KB

.reloc
Size: 94KB - Virtual size: 94KB