e88faa969496f5ae1f7c49cd85ee82f8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e88faa969496f5ae1f7c49cd85ee82f8_JaffaCakes118
Size 173KB
Sample240408-2blhgsgh8v
SHA256 5be7e5e76a44652a138718ebbc0fc909be751902485c1c718869a6ee71799026
MD5 e88faa969496f5ae1f7c49cd85ee82f8
SHA1 c9a6c3713a1d5c53f507e5d60c6ce8f5f5ce7e27
SHA512 2069e9c0e16da82cefd465b22c9fa3ca9ffec27ab40b2d809516e98c8cacf12b9c60fc4ecd17ccd3dd246973a5d8ce09515967f020431161fa3cc6fe7923bdfe
SSDEEP 3072:rBEpwbYFUs+QJTEgQfDD0mDf5RL2ctvrUV98Xnu:uLF9IgQNDf5wArw8+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e88faa969496f5ae1f7c49cd85ee82f8_JaffaCakes118

.dll 173KB

e88faa969496f5ae1f7c49cd85ee82f8_JaffaCakes118

IMPHASH bae1019f0ed020e5c6fce4b4500a54d6
SHA256 5be7e5e76a44652a138718ebbc0fc909be751902485c1c718869a6ee71799026
MD5 e88faa969496f5ae1f7c49cd85ee82f8
SHA1 c9a6c3713a1d5c53f507e5d60c6ce8f5f5ce7e27
SHA512 2069e9c0e16da82cefd465b22c9fa3ca9ffec27ab40b2d809516e98c8cacf12b9c60fc4ecd17ccd3dd246973a5d8ce09515967f020431161fa3cc6fe7923bdfe
SSDEEP 3072:rBEpwbYFUs+QJTEgQfDD0mDf5RL2ctvrUV98Xnu:uLF9IgQNDf5wArw8+
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=PopFolder,OU=Software Development Department,O=PopFolder,L=KyoungGi-do,ST=Gwangmyeong-si\ ,C=KR

Serial Number

35:19:8a:09:f8:df:1a:89:a8:00:16:d1:4d:27:25:99

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 14, 2006 - Dec 14, 2007

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Minor OS version

Major OS version

Entry point

52029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA GetShortPathNameA FreeLibrary SizeofResource LoadResource FindResourceA GetLastError LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte HeapDestroy GetProcAddress LoadLibraryA lstrcpyA lstrcatA DeleteFileA CloseHandle WriteFile CreateFileA TerminateProcess GetCurrentThreadId lstrcmpA FlushInstructionCache GetCurrentProcess GlobalUnlock GlobalLock GlobalAlloc Sleep CreateThread WaitForSingleObject WinExec MultiByteToWideChar SetStdHandle IsBadCodePtr IsBadReadPtr SetFilePointer GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount UnhandledExceptionFilter TlsGetValue SetLastError TlsFree TlsAlloc HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate LCMapStringW LCMapStringA ExitProcess GetOEMCP GetACP GetCPInfo RaiseException GetVersion GetCommandLineA ExitThread TlsSetValue ResumeThread RtlUnwind GetLocalTime GetSystemTime GetTimeZoneInformation GetFileAttributesA lstrlenW InterlockedDecrement EnterCriticalSection InterlockedIncrement LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection ReadFile WideCharToMultiByte GetModuleFileNameA DisableThreadLibraryCalls CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile FlushFileBuffers HeapReAlloc HeapAlloc HeapFree LocalFree

user32

wsprintfA CharUpperA CharNextA LoadStringA GetDesktopWindow GetWindowRect GetFocus GetWindow ShowWindow DestroyWindow GetClientRect CreateWindowExA ReleaseCapture FindWindowExA GetWindowTextLengthA GetWindowTextA SetWindowTextA RegisterWindowMessageA GetDlgItem InvalidateRgn InvalidateRect SetCapture SendMessageA GetClassInfoExA LoadCursorA RegisterClassExA CreateAcceleratorTableA GetParent GetClassNameA RedrawWindow SetWindowPos BeginPaint FillRect EndPaint GetDC ReleaseDC IsChild SetFocus GetSysColor CallWindowProcA GetWindowLongA DefWindowProcA SetWindowLongA IsWindow

gdi32

GetStockObject GetObjectA DeleteObject CreateCompatibleBitmap CreateCompatibleDC SelectObject BitBlt DeleteDC GetDeviceCaps CreateSolidBrush

advapi32

RegQueryValueExA RegEnumValueA RegQueryInfoKeyA RegEnumKeyExA RegOpenKeyExA RegDeleteKeyA RegSetValueExA RegDeleteValueA RegCreateKeyExA RegCloseKey

ole32

CreateStreamOnHGlobal OleLockRunning StringFromCLSID CLSIDFromString CLSIDFromProgID StringFromIID CoCreateFreeThreadedMarshaler CoInitialize CoUninitialize OleInitialize OleUninitialize CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoGetMalloc

oleaut32

SysAllocString SysStringLen LoadRegTypeLi RegisterTypeLi VariantCopy VariantChangeType OleCreateFontIndirect SysAllocStringLen SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SysStringByteLen SysAllocStringByteLen VariantInit VarUI4FromStr SysFreeString LoadTypeLi VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

e88faa969496f5ae1f7c49cd85ee82f8_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

advapi32

ole32

oleaut32

generic