a716d9eeea5b456cfdec69a1b34ccc96_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a716d9eeea5b456cfdec69a1b34ccc96_JaffaCakes118
Size 985KB
Sample240403-1awrdsdf36
SHA256 890c9830635eb1674ed15a65790905fbe3ad80eb087ee7433e6da159ddc5cb00
MD5 a716d9eeea5b456cfdec69a1b34ccc96
SHA1 e757774843c0305a05ee18159f180ae71511c45b
SHA512 d5516c9b71a21db1867c7861ec472626de5969bf1293eea7a8964830401435cc0b73f9673e768b6652a8611a539331911aa3df6527c3a5daf61cf43ac25a1104
SSDEEP 24576:yQHyDJBjAObi4M2rIDTU4fmj6J/d28+buJqQlxTB8mv:yQSdBfbiyrIDovj6ldnkQlVB3
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a716d9eeea5b456cfdec69a1b34ccc96_JaffaCakes118

.exe 985KB

a716d9eeea5b456cfdec69a1b34ccc96_JaffaCakes118

IMPHASH bc70c4fa605f17c85050b7c7b6d42e44
SHA256 890c9830635eb1674ed15a65790905fbe3ad80eb087ee7433e6da159ddc5cb00
MD5 a716d9eeea5b456cfdec69a1b34ccc96
SHA1 e757774843c0305a05ee18159f180ae71511c45b
SHA512 d5516c9b71a21db1867c7861ec472626de5969bf1293eea7a8964830401435cc0b73f9673e768b6652a8611a539331911aa3df6527c3a5daf61cf43ac25a1104
SSDEEP 24576:yQHyDJBjAObi4M2rIDTU4fmj6J/d28+buJqQlxTB8mv:yQSdBfbiyrIDovj6ldnkQlVB3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

60:8a:d8:eb:c4:a9:d6:c8:d7:62:67:6b:06:50:09:1f:fa:49:d1:20:c1:4d:0b:9e:6b:d9:1e:a5:2c:e3:fd:2d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Mar 27, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 31, 2019 - Feb 3, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

26572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA GlobalAlloc ExpandEnvironmentStringsA LoadResource WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA _llseek SetCurrentDirectoryA GetTempFileNameA ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime SetFilePointer GetWindowsDirectoryA lstrcmpA _lclose GlobalLock GetCurrentProcess FreeResource FreeLibrary Sleep GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess OutputDebugStringA RtlUnwind GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA ReadFile

gdi32

GetDeviceCaps

user32

GetDC SendMessageA SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowRect MessageBoxA GetWindowLongA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SetWindowLongA GetSystemMetrics

msvcrt

memset ?terminate@@YAXXZ _controlfp memcpy _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _acmdln _initterm _amsg_exit __p__commode _XcptFilter _errno _vsnprintf __setusermatherr

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

a716d9eeea5b456cfdec69a1b34ccc96_JaffaCakes118

PE Signature issue

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

cabinet

version

generic