0b5c3780c43fa6c3600b6d269c579c88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b5c3780c43fa6c3600b6d269c579c88_JaffaCakes118
Size

539KB
MD5

0b5c3780c43fa6c3600b6d269c579c88
SHA1

0af164bb5c6bb0fa0cc3f938565205be6af4b2c0
SHA256

1203de663f62a2db3e80a9b011be44723b8f6b604875132704ade922462afa77
SHA512

08b9a942ee5ac2cbab319711b7a6f6fb8169690796490f775de1ef21cf577204eced8a6a18175b2be23904293516deda484285e11967a867d576b6f99d8617d6
SSDEEP

12288:flmjtRrk8r+HAysUrjAO/VDJMeRpTcsi1BwxR+KJYYyt2y9VP4YZXCdhzTimizBh:Av8qzZ4vs9J19MQP2WCMkcvP

Score

1^/10

Malware Config

Signatures

Files

0b5c3780c43fa6c3600b6d269c579c88_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dcdbf39e6892d981a5ea032b055c70d9

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:6f:03:49:d2:1f:37:5a:cf:79:31:91
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/04/2020, 09:56

Not After

25/04/2023, 09:56

Subject

CN=Biz Secure Labs Pvt. Ltd,O=Biz Secure Labs Pvt. Ltd,L=Pune,ST=Maharashtra,C=IN,1.2.840.113549.1.9.1=#0c1a737570706f727440696e646961616e746976697275732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c3:e4:ed:01:3f:0a:23:fa:4a:11:61:cc:d0:85:87:50:8e:0b:f5:1e
Signer

Actual PE Digest

c3:e4:ed:01:3f:0a:23:fa:4a:11:61:cc:d0:85:87:50:8e:0b:f5:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA
StrStrIA
SHGetValueA
PathSetDlgItemPathA
PathRemoveFileSpecA
PathFindExtensionA
PathIsDirectoryA
PathFileExistsA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wininet

HttpQueryInfoA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
InternetAttemptConnect
InternetReadFile

kernel32

GetCurrentProcess
RaiseException
InterlockedExchange
LocalAlloc
FormatMessageA
SetLastError
lstrlenA
OpenEventA
ExitThread
SearchPathA
MultiByteToWideChar
SystemTimeToFileTime
GetPriorityClass
SetPriorityClass
GetComputerNameA
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
FileTimeToLocalFileTime
GetEnvironmentVariableA
GetSystemTime
GetFileTime
FileTimeToSystemTime
GetFileAttributesW
GetExitCodeThread
TerminateThread
ResumeThread
SuspendThread
GetSystemDirectoryA
GetShortPathNameA
RemoveDirectoryA
QueryDosDeviceA
Module32First
GetBinaryTypeA
MoveFileA
Module32Next
GetWindowsDirectoryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetPrivateProfileIntA
GetLogicalDriveStringsA
CopyFileA
SetUnhandledExceptionFilter
CreateEventA
GetLocalTime
CreateMutexA
WinExec
GetVersionExA
MoveFileExA
EnterCriticalSection
DeleteFileA
LeaveCriticalSection
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcessId
IsBadCodePtr
GetStringTypeW
GetVersion
CreateToolhelp32Snapshot
Process32First
OpenProcess
TerminateProcess
Process32Next
GetTickCount
CreateThread
SetEvent
CreateProcessA
Sleep
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CreateFileA
ReadFile
CloseHandle
GetFileSize
GetLastError
GetVolumeInformationA
GetDriveTypeA
FindFirstFileA
FindNextFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
FreeLibrary
GetPrivateProfileSectionA
GetPrivateProfileStringA
GetFileAttributesA
LocalFree
GetProcessHeap
HeapAlloc
HeapFree
WritePrivateProfileStringA
SetFileAttributesA
GetTempPathA
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
SetStdHandle
GetStdHandle
GetTempPathW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryA
WideCharToMultiByte
IsBadReadPtr
PeekNamedPipe
CreateFileW
FlushViewOfFile
GetFileInformationByHandle
SetFilePointer
SetHandleCount
IsBadWritePtr
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
lstrcpyA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
lstrcatA
lstrcpynA
GlobalUnlock
GlobalLock
lstrcmpA
GlobalFree
GlobalFlags
InitializeCriticalSection
DeleteCriticalSection
TlsAlloc
GlobalHandle
GlobalReAlloc
GlobalAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
WriteFile
FlushFileBuffers
SetEndOfFile
RtlUnwind
ExitProcess
HeapReAlloc
GetFileType
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
GetACP
HeapSize
HeapDestroy
HeapCreate
VirtualFree

user32

GetKeyState
ReleaseDC
CopyRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetWindowLongA
GetWindowLongA
GetWindow
GetForegroundWindow
GetLastActivePopup
GetMessagePos
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
DestroyWindow
DefWindowProcA
GetDlgCtrlID
GetMenuItemID
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetParent
GetTopWindow
AdjustWindowRectEx
GetFocus
DispatchMessageA
PeekMessageA
GetSysColor
MapWindowPoints
IsWindowEnabled
GetNextDlgTabItem
ToAscii
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
ClientToScreen
TabbedTextOutA
DrawTextA
GrayStringA
GetClassNameA
LoadStringA
PostQuitMessage
GetSysColorBrush
PtInRect
LoadCursorA
SetCursor
MessageBeep
KillTimer
MoveWindow
ScreenToClient
SetWindowPos
LoadMenuA
GetSubMenu
GetCursorPos
SetMenuItemInfoA
TrackPopupMenu
GetWindowTextA
SetForegroundWindow
UpdateWindow
wsprintfA
BeginPaint
FillRect
EndPaint
SetTimer
EndDialog
LoadBitmapA
GetDC
GetClientRect
SetDlgItemTextA
GetDlgItem
InvalidateRect
SetWindowTextA
ExitWindowsEx
DialogBoxParamA
ShowWindow
FindWindowA
PostMessageA
MessageBoxA
GetWindowRect
AppendMenuA
CreatePopupMenu
LoadIconA
EnableWindow
SendMessageA
DestroyMenu
CreateWindowExA
GetSystemMetrics
SetDlgItemInt
SetFocus
GetDlgItemTextA
GetKeyboardState
EnableMenuItem

gdi32

Escape
ExtTextOutA
RectVisible
PtVisible
CreatePen
TextOutA
GetDeviceCaps
CreateFontA
SetTextColor
GetStockObject
SetBkColor
CreateSolidBrush
StretchBlt
DeleteObject
CreateCompatibleDC
SelectObject
GetObjectA
SetBkMode
GetClipBox
CreateBitmap
DeleteDC
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx

comdlg32

GetOpenFileNameA

advapi32

RegEnumValueA
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegCreateKeyA
SetFileSecurityA
SetSecurityDescriptorDacl
DeleteAce
InitializeAcl
IsValidSecurityDescriptor
RegOpenKeyExA
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
LookupAccountSidA
RegDeleteKeyA
RegQueryInfoKeyA
AdjustTokenPrivileges
RegOpenKeyA
RegDeleteValueA
GetAce
EqualSid
AddAce
AddAccessAllowedAce
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
FreeSid
GetUserNameA
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation

shell32

ExtractIconA
DragQueryFileW
DragFinish
ShellExecuteExA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
Shell_NotifyIconA
ShellExecuteA

comctl32

ord17
InitCommonControlsEx
ImageList_Destroy

netapi32

NetShareEnum
NetShareGetInfo
NetApiBufferFree

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcdbf39e6892d981a5ea032b055c70d9

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

10:6f:03:49:d2:1f:37:5a:cf:79:31:91Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

c3:e4:ed:01:3f:0a:23:fa:4a:11:61:cc:d0:85:87:50:8e:0b:f5:1eSigner

Headers

File Characteristics

Imports

shlwapi

version

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

comctl32

netapi32

winspool.drv

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 64KB - Virtual size: 62KB

.data Size: 12KB - Virtual size: 3.0MB

.rsrc Size: 40KB - Virtual size: 39KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

10:6f:03:49:d2:1f:37:5a:cf:79:31:91
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

c3:e4:ed:01:3f:0a:23:fa:4a:11:61:cc:d0:85:87:50:8e:0b:f5:1e
Signer

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 64KB - Virtual size: 62KB

.data
Size: 12KB - Virtual size: 3.0MB

.rsrc
Size: 40KB - Virtual size: 39KB