bded13697ad628e93f7168b1588790d0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bded13697ad628e93f7168b1588790d0_JaffaCakes118
Size

94KB
MD5

bded13697ad628e93f7168b1588790d0
SHA1

2c21caf1f5e29817708119be44d4d83bb54158f2
SHA256

6079f69fba083783c838a35249533b8a7be3d07572631967da51668fc26199a0
SHA512

db84f4d9a2cb6fcb0b94671a4b4e3cde6acad73cd735a34d433692a4ae3e9e053127045dc332059f3309fe6cd770cb0eef3d8053be6626f5b8f9c36248921689
SSDEEP

1536:I603uATvV9FkcCTEIJpLaSpdWAWd/VdLdjc/RWPrAIvojYlo2hn/OS1Ryk4xzAVD:vGFTvLF9uMNt4ZOEIv0Ylo2hn2bxzAVD

Score

1^/10

Malware Config

Signatures

Files

bded13697ad628e93f7168b1588790d0_JaffaCakes118
.dll windows:6 windows x86 arch:x86

5c539dcf34e7709d3d7c811fc235ee10

Code Sign

b7:93:55:41:1b:9b:3f:fc:e2:c5:59:33:2a:fa:0f:4c
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/03/2019, 00:00

Not After

07/03/2023, 23:59

Subject

CN=Mark Straver,O=Mark Straver,POSTALCODE=57333,STREET=Östra Järnvägsgatan 1A,L=Tranås,ST=Jönköpingslän,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

01/08/2030, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:1a:e0:89:da:b9:b1:c2:b2:0e:80:e7:f0:4d:ba:c1:88:3e:02:54:61:7c:94:7f:4a:ad:95:0f:9c:d2:0a:78
Signer

Actual PE Digest

71:1a:e0:89:da:b9:b1:c2:b2:0e:80:e7:f0:4d:ba:c1:88:3e:02:54:61:7c:94:7f:4a:ad:95:0f:9c:d2:0a:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\mozdev\obj-pm-x86-release\security\nss\lib\softoken\legacydb\nssdbm3.pdb

Imports

nss3

PORT_DestroyCheapArena
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
PORT_ArenaStrdup_Util
SECITEM_CompareItem_Util
PR_NewMonitor
PR_DestroyMonitor
PR_EnterMonitor
PR_ExitMonitor
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgHasFlag
NSSUTIL_ArgReadLong
PORT_InitCheapArena
NSSUTIL_ArgParseSlotFlags
NSSUTIL_ArgParseSlotInfo
NSSUTIL_MkSlotString
NSSUTIL_ArgParseModuleSpec
NSSUTIL_MkModuleSpec
NSSUTIL_ArgParseCipherFlags
NSSUTIL_MkNSSString
PR_LoadLibraryWithFlags
PR_FindFunctionSymbol
PR_GetLibraryFilePathname
PR_CallOnce
PR_GetDirectorySeparator
NSS_Get_SEC_ObjectIDTemplate_Util
PR_Now
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
SECOID_Init
PR_Free
SECITEM_HashCompare
PL_CompareValues
PL_HashTableDestroy
PL_NewHashTable
PR_FindSymbol
PR_UnloadLibrary
PR_LoadLibrary
SECITEM_ItemsAreEqual_Util
PORT_Realloc_Util
DER_SetUInteger
PR_htonl
NSS_Get_SEC_OctetStringTemplate_Util
PR_ntohl
PR_GetEnvSecure
SECOID_GetAlgorithmTag_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDByTag_Util
SECOID_FindOIDTag_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_QuickDERDecodeItem_Util
PR_Unlock
PR_Lock
SECITEM_AllocItem_Util
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PR_DestroyLock
PR_NewLock
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_DupItem_Util
SECITEM_CopyItem_Util
PORT_ArenaZAlloc_Util
DER_DecodeTimeChoice_Util
PORT_ArenaAlloc_Util
PORT_FreeArena_Util
PORT_NewArena_Util
PORT_GetError_Util
PORT_SetError_Util
PORT_Strdup_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PR_smprintf_free
PR_smprintf
PR_MkDir
PR_Access
PR_Delete
PR_Write
PR_Read
PR_Close
PR_OpenFile
PR_GetError
PR_SetError
NSSBase64_EncodeItem_Util
SECOID_Shutdown
PORT_Free_Util
PORT_ZAlloc_Util
NSSUTIL_Quote
PORT_Alloc_Util

mozglue

free
strdup
malloc
calloc

kernel32

FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

vcruntime140

memcpy
memcmp
memset
strrchr
memmove
__std_type_info_destroy_list
_except_handler4_common

api-ms-win-crt-string-l1-1-0

strcpy
tolower
strncmp
strlen
strcmp
isdigit

api-ms-win-crt-runtime-l1-1-0

_errno
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
abort
_cexit
_crt_atexit
_getpid

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_unlink

api-ms-win-crt-stdio-l1-1-0

_open
_read
_write
_close
fwrite
__acrt_iob_func
_get_osfhandle
_lseek

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

legacy_AddSecmodDB
legacy_DeleteSecmodDB
legacy_Open
legacy_ReadSecmodDB
legacy_ReleaseSecmodDBData
legacy_SetCryptFunctions
legacy_Shutdown

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5c539dcf34e7709d3d7c811fc235ee10

Code Sign

b7:93:55:41:1b:9b:3f:fc:e2:c5:59:33:2a:fa:0f:4cCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

71:1a:e0:89:da:b9:b1:c2:b2:0e:80:e7:f0:4d:ba:c1:88:3e:02:54:61:7c:94:7f:4a:ad:95:0f:9c:d2:0a:78Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

nss3

mozglue

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 73KB - Virtual size: 72KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 1020B

.gfids Size: 512B - Virtual size: 20B

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 2KB - Virtual size: 1KB

b7:93:55:41:1b:9b:3f:fc:e2:c5:59:33:2a:fa:0f:4c
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

71:1a:e0:89:da:b9:b1:c2:b2:0e:80:e7:f0:4d:ba:c1:88:3e:02:54:61:7c:94:7f:4a:ad:95:0f:9c:d2:0a:78
Signer

.text
Size: 73KB - Virtual size: 72KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 1020B

.gfids
Size: 512B - Virtual size: 20B

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 2KB - Virtual size: 1KB