e6e24a393a82aa0c4b8fd59578535e41_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
e6e24a393a82aa0c4b8fd59578535e41_JaffaCakes118
Size 502KB
Sample240408-hp9bxsbb77
SHA256 8943ee46dfdee3fe2e08b0bc619054ddf10eb8f387fa439ff42bc783441405be
MD5 e6e24a393a82aa0c4b8fd59578535e41
SHA1 8c2216686edb54a79384af7b4134c5b1a234e87b
SHA512 4fd9fdbb66248a0906c8629874d1f15552933094f5d421617e3d201d18147ca460e880751c51457d3dde786ce9eab09d7067837680eb640fde6766783a7eb56a
SSDEEP 12288:xPYPemooAhjygA1oGcwGtBcNd5N4gaSiBRJV1Msu:pqTfj15GrqdQk+JS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

e6e24a393a82aa0c4b8fd59578535e41_JaffaCakes118

.exe 502KB

e6e24a393a82aa0c4b8fd59578535e41_JaffaCakes118

IMPHASH e1eb14d2b9b63299ef24644e625b9baf
SHA256 8943ee46dfdee3fe2e08b0bc619054ddf10eb8f387fa439ff42bc783441405be
MD5 e6e24a393a82aa0c4b8fd59578535e41
SHA1 8c2216686edb54a79384af7b4134c5b1a234e87b
SHA512 4fd9fdbb66248a0906c8629874d1f15552933094f5d421617e3d201d18147ca460e880751c51457d3dde786ce9eab09d7067837680eb640fde6766783a7eb56a
SSDEEP 12288:xPYPemooAhjygA1oGcwGtBcNd5N4gaSiBRJV1Msu:pqTfj15GrqdQk+JS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

e5:ff:3b:28:8b:b8:28:1f:29:38:89:b1:4c:b5:d7:aa:9f:a9:c0:1a:f4:0e:f1:a4:6e:0c:ae:9d:86:b5:5c:1f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Apr 4, 2024

PE Signature issue

Digest

83:cc:23:82:68:00:1e:94:7c:97:bc:bd:6d:1b:a0:95:8b:54:8e:02

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

May 23, 2018

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

12032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sukulevut_zoxudo51\cumev97\poki\jija\vupuzunorap-cavim-4\rido.pdb

kernel32

EnumResourceNamesW GetNativeSystemInfo lstrlenA CopyFileExW GetStringTypeA InterlockedIncrement ReadConsoleA GlobalLock FreeEnvironmentStringsA GetModuleHandleW GetPrivateProfileStringW WriteFile SetCommState GetCommandLineA GlobalAlloc GetPrivateProfileIntA LoadLibraryW GetSystemWindowsDirectoryA GetConsoleAliasExesLengthW GlobalFlags GetExitCodeProcess IsDBCSLeadByte ReadFile SetThreadPriority GetNamedPipeHandleStateW LCMapStringA GetPrivateProfileIntW InterlockedExchange GetStartupInfoA GetLastError GetProcAddress CopyFileA GetPrivateProfileStringA OpenWaitableTimerA LoadLibraryA GetFileType SetCurrentDirectoryW SetThreadIdealProcessor HeapWalk FindAtomA Process32NextW CreateIoCompletionPort QueryMemoryResourceNotification GetCPInfoExA TlsAlloc DeleteFileW ReadConsoleOutputCharacterW GetSystemTime InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW HeapValidate IsBadReadPtr RaiseException RtlUnwind TerminateProcess GetCurrentProcess IsDebuggerPresent GetACP GetOEMCP GetCPInfo IsValidCodePage TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetLastError QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStdHandle HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA FlushFileBuffers WideCharToMultiByte GetConsoleCP GetConsoleMode DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount LCMapStringW GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP SetFilePointer CloseHandle CreateFileA

user32

GetComboBoxInfo

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

e6e24a393a82aa0c4b8fd59578535e41_JaffaCakes118

PE Signature issue

PE Signature issue

kernel32

user32

winhttp

generic