5b572e474edebd9fc174c73929f59b76_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
5b572e474edebd9fc174c73929f59b76_JaffaCakes118
Size 84.6MB
Sample241019-hjfgnaseph
SHA256 36cefeac9bd80864a1a4544ebf761d40de095e1f8dc1d222e9361125483208d2
MD5 5b572e474edebd9fc174c73929f59b76
SHA1 470151b65737f963a678c1648f5d0704fe89e2a6
SHA512 f9dd24972a824d1e2523787c377694d0839cabd8e87aa42f0ee5d2e1af62ffc77e23faae5b962cd37c53f475a51d75c09e5d91fac2c197d1461f4056972724ce
SSDEEP 1572864:UmO53AWhxwP2U9w280TAr2teXtQsC/9XeU6EQVTUXM7z78/3QMMDrQ:/tGUS280TBERY1DBQt178PK
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

5b572e474edebd9fc174c73929f59b76_JaffaCakes118

.exe 84.6MB

5b572e474edebd9fc174c73929f59b76_JaffaCakes118

IMPHASH d27c7385b6029743cb2ef24c08e61370
SHA256 36cefeac9bd80864a1a4544ebf761d40de095e1f8dc1d222e9361125483208d2
MD5 5b572e474edebd9fc174c73929f59b76
SHA1 470151b65737f963a678c1648f5d0704fe89e2a6
SHA512 f9dd24972a824d1e2523787c377694d0839cabd8e87aa42f0ee5d2e1af62ffc77e23faae5b962cd37c53f475a51d75c09e5d91fac2c197d1461f4056972724ce
SSDEEP 1572864:UmO53AWhxwP2U9w280TAr2teXtQsC/9XeU6EQVTUXM7z78/3QMMDrQ:/tGUS280TBERY1DBQt178PK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

f6:86:12:d6:05:5f:dd:a8:25:62:6c:80:20:c3:df:1b:f2:82:30:2e:63:26:1f:09:5c:ea:4d:85:40:05:87:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jan 12, 2017

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

f1:0f:f6:59:f9:55:06:e8:9e:b4:78:e1:89:fa:74:c0:c0:f0:8e:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jan 12, 2017

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

45:98:a2:8d:fd:dc:bc:31:de:d0:f2:98:07:c5:a7:43

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Jul 26, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

45:98:a2:8d:fd:dc:bc:31:de:d0:f2:98:07:c5:a7:43

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Jul 26, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Serial Number

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

552144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\xl9_client\xl9_install\pdb\Product_Release\ThunderInstall.pdb

wininet

InternetOpenUrlA InternetOpenW InternetCloseHandle

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSAAsyncSelect WSAStartup WSACleanup gethostbyname inet_addr htons socket connect send WSAGetLastError closesocket recv

kernel32

DeleteFileW GetFileAttributesW MoveFileExW FindFirstFileW UnmapViewOfFile MapViewOfFile OpenFileMappingW SizeofResource GetSystemDefaultLCID WaitForMultipleObjects TerminateThread CreateThread InterlockedIncrement GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetSystemDirectoryW SetDllDirectoryW GetVersionExW CreateFileMappingW FileTimeToSystemTime SetFilePointer WriteFile GetFileSize GetPrivateProfileStringA GetPrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileSectionW GetLocalTime TerminateProcess OpenProcess GetCurrentProcessId ResetEvent GetCurrentDirectoryW SetCurrentDirectoryW IsBadCodePtr VirtualQuery FindResourceExW DuplicateHandle ReleaseMutex HeapAlloc HeapFree VirtualFree GetProcessHeap lstrcpynW VirtualAlloc GetFileInformationByHandle GetVolumeInformationW CreateFileA ReadFile CreateDirectoryW WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetLocaleInfoA SetStdHandle GetDateFormatA RemoveDirectoryW GetCurrentDirectoryA PeekNamedPipe GetFullPathNameW GetTimeZoneInformation QueryPerformanceCounter GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount IsValidCodePage GetOEMCP GetModuleFileNameA GetStdHandle GetModuleHandleA HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetStringTypeW GetCPInfo LCMapStringW LCMapStringA GetFileType FileTimeToLocalFileTime GetSystemTimeAsFileTime ExitThread RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedExchange HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange MoveFileW SetEndOfFile CopyFileW FindNextFileW GetDriveTypeA FindClose ResumeThread GetVersionExA EnumResourceNamesW GetFileSizeEx SetPriorityClass DeviceIoControl lstrcpyA GetFileAttributesA CreateDirectoryA lstrcatA GetSystemDirectoryA GetVolumeInformationA WritePrivateProfileStringA SetEnvironmentVariableA CompareStringW CompareStringA GetCurrentProcess GetCurrentThread CloseHandle CreateProcessW LocalFree GetStartupInfoW GetExitCodeProcess WaitForSingleObject RaiseException EnterCriticalSection LeaveCriticalSection GetProcAddress DeleteCriticalSection InitializeCriticalSection WritePrivateProfileStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateEventW OpenEventW SetEvent FreeLibrary LoadLibraryW GetModuleHandleW ExitProcess SetFileAttributesW CreateFileW GetDiskFreeSpaceExW LoadResource LockResource GlobalHandle GlobalFree GetTempPathW GetTickCount GetACP GlobalLock GlobalUnlock GetModuleFileNameW MulDiv lstrcmpW GetLastError OutputDebugStringW DebugBreak lstrlenA Sleep SetLastError lstrlenW GetCurrentThreadId InterlockedDecrement FindResourceW GlobalAlloc FlushInstructionCache GetLogicalDriveStringsW GetDriveTypeW OpenMutexW CreateMutexW GetTimeFormatA

user32

BeginPaint DestroyAcceleratorTable SetFocus GetWindow GetFocus RedrawWindow MessageBoxW GetDesktopWindow SetWindowLongW GetWindowLongW PostMessageW EndPaint CharUpperW PostThreadMessageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW PostQuitMessage UpdateLayeredWindow SetRect EqualRect IsRectEmpty CallWindowProcW DestroyWindow FillRect UnregisterClassA MsgWaitForMultipleObjects DrawFocusRect DrawIcon GetWindowDC DrawTextW GetDlgCtrlID SetCursor ShowCursor SetRectEmpty OffsetRect UnionRect PtInRect GetActiveWindow ShowWindow IsWindowVisible IsWindow GetClassInfoExW LoadCursorW wvsprintfW DestroyIcon LoadImageW CopyRect GetTopWindow MonitorFromWindow GetMonitorInfoW SendMessageW CreateAcceleratorTableW MapWindowPoints SetWindowContextHelpId MapDialogRect GetWindowRect GetSystemMetrics BringWindowToTop DefWindowProcW RegisterClassExW CreateWindowExW GetSysColor CharNextW MoveWindow SetWindowPos wsprintfW GetClientRect ClientToScreen ScreenToClient GetDC ReleaseDC InvalidateRect InvalidateRgn SetCapture IsChild GetParent GetDlgItem GetClassNameW EnableWindow IsWindowEnabled KillTimer SetTimer UpdateWindow FindWindowW CreateDialogIndirectParamW DialogBoxIndirectParamW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW ReleaseCapture

gdi32

SetDIBitsToDevice StretchDIBits SetWindowOrgEx OffsetWindowOrgEx GetWindowOrgEx ExtSelectClipRgn ExtTextOutW SetBkColor LineTo CreatePen MoveToEx CreateRectRgnIndirect SetTextColor SetBkMode SelectClipRgn CreateRectRgn GetClipBox IntersectClipRect CreateFontIndirectW CombineRgn GetTextMetricsW SetViewportOrgEx GetTextExtentPoint32W GetStockObject CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject DeleteDC CreateDIBSection ExcludeClipRect GetObjectW

advapi32

RegCreateKeyExW GetNamedSecurityInfoW GetAclInformation GetAce GetSidLengthRequired InitializeSid GetSidSubAuthority EqualSid CopySid IsValidSid SetNamedSecurityInfoW InitializeAcl AddAce RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegCloseKey ConvertStringSidToSidW GetLengthSid SetTokenInformation CreateProcessAsUserW OpenThreadToken OpenProcessToken DuplicateTokenEx

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderPathW SHCreateDirectoryExW ord680 ShellExecuteExW SHGetFileInfoW ShellExecuteW CommandLineToArgvW SHGetFolderPathW Shell_NotifyIconW SHGetSpecialFolderPathA

ole32

CoUninitialize OleUninitialize CoRevokeClassObject CoRegisterClassObject CoTaskMemFree OleInitialize CreateStreamOnHGlobal CoTaskMemAlloc CoCreateInstance CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning StringFromGUID2 CoInitialize

oleaut32

RegisterTypeLi UnRegisterTypeLi LoadTypeLi LoadRegTypeLi OleCreateFontIndirect VariantClear VariantInit SysAllocString SysAllocStringLen SysFreeString SysStringLen

shlwapi

StrStrW SHSetValueW StrCmpNW PathIsDirectoryW SHGetValueW PathIsRootW StrCpyNW PathRemoveBlanksW StrCmpW PathFindFileNameW PathGetDriveNumberW PathAppendW PathCombineW StrCmpIW PathFileExistsW PathFindExtensionW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

userenv

UnloadUserProfile

iphlpapi

GetAdaptersInfo

imm32

ImmDisableIME

gdiplus

GdipGetImageWidth GdipDisposeImage GdipAlloc GdipFree GdipGetImageHeight GdipLoadImageFromStream GdiplusStartup GdipDeleteGraphics GdipCreateFromHDC GdipDrawImageRectI GdipCloneImage

Sharing

General

Malware Config

Signatures

File Explorer

5b572e474edebd9fc174c73929f59b76_JaffaCakes118

wininet

version

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

userenv

iphlpapi

imm32

gdiplus

generic