3d72f4c999e93b98a22a0ae91be26d4d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d72f4c999e93b98a22a0ae91be26d4d_JaffaCakes118
Size

240KB
MD5

3d72f4c999e93b98a22a0ae91be26d4d
SHA1

11e03f2f7742f944e72bb042507f3cc40e694793
SHA256

0a956db342f052a51697875fcdd50b2f88e7c51c3762ed8184d827970e84b211
SHA512

0580201fd5d49cb04d86fd737414dee8cc3d715ac688bf17ad46982b3f428278a31924902e1e4411ccca8dca02a548b5148e743a47d636fd3f94169f06c4dbe3
SSDEEP

3072:ouTCQw1devYsB9VBWLKCcS6BqjM9CaYGfVTQZHt3A25FmwROxStPE/C6qHv:oYw1MhB9cjcjCaPaA2rKxM0EP

Score

1^/10

Malware Config

Signatures

Files

3d72f4c999e93b98a22a0ae91be26d4d_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

a9a3199e9fb2fe22a7ebbf8e7ec9e547

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Netvork+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

15/02/2009, 00:00

Not After

15/02/2010, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tencent,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

aa:b7:1a:70:be:27:f8:a5:90:a4:68:c3:7f:4d:e0:16:87:07:d5:d7
Signer

Actual PE Digest

aa:b7:1a:70:be:27:f8:a5:90:a4:68:c3:7f:4d:e0:16:87:07:d5:d7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\公司源码\插件完整\TSWebMon-33F\release\qibho.pdb

Imports

kernel32

MultiByteToWideChar
lstrlenA
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GetTickCount
GetTempFileNameA
GetTempPathA
CloseHandle
CreateFileW
ReadFile
GetFileSize
WideCharToMultiByte
DeleteFileA
GetPrivateProfileIntA
CopyFileA
CopyFileW
DeleteFileW
VirtualProtect
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetModuleFileNameA
WaitForSingleObject
SetEvent
lstrcmpiW
CreateThread
CreateEventW
Sleep
IsBadReadPtr
GetThreadLocale
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FindResourceExW
lstrlenW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
ResetEvent
InterlockedExchange
SetFilePointer
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
GetProcessHeap
GetVersionExA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
LCMapStringW
LCMapStringA
HeapSize
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
LoadLibraryW
lstrcpyW
lstrcatA
DeviceIoControl
GetSystemWindowsDirectoryW
lstrcpyA
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
RtlUnwind
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
WriteFile

user32

FindWindowExW
CharNextW
wsprintfW
EnumChildWindows
GetParent
UnregisterClassA
GetClassNameA
RemovePropW
SetPropW
PostMessageW
wsprintfA
SendMessageW
DefWindowProcA
DefWindowProcW
GetWindowTextLengthW
GetWindowTextW
GetFocus
GetWindowTextA
SetWindowTextW
IsWindowVisible
GetPropW
IsWindowUnicode
SetWindowLongW
SetWindowLongA
CallWindowProcW
CallWindowProcA

advapi32

RegDeleteValueW
RegOpenKeyExA
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

ole32

CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
StringFromIID

oleaut32

LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
VariantClear
SysFreeString

shlwapi

SHSetValueA
SHDeleteKeyA
SHDeleteKeyW
SHSetValueW
SHGetValueA

urlmon

URLDownloadToFileA

wininet

InternetCloseHandle
InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetSetOptionW

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9a3199e9fb2fe22a7ebbf8e7ec9e547

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20Certificate

Extended Key Usages

Key Usages

aa:b7:1a:70:be:27:f8:a5:90:a4:68:c3:7f:4d:e0:16:87:07:d5:d7Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

urlmon

wininet

iphlpapi

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 175KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 8KB - Virtual size: 43KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 16KB - Virtual size: 15KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7b:92:ae:b3:83:26:5c:7c:64:53:bd:92:a0:40:a0:20
Certificate

aa:b7:1a:70:be:27:f8:a5:90:a4:68:c3:7f:4d:e0:16:87:07:d5:d7
Signer

.text
Size: 176KB - Virtual size: 175KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 8KB - Virtual size: 43KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 16KB - Virtual size: 15KB