e9ae41196f57fb97a123cc6d8ca50ce4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e9ae41196f57fb97a123cc6d8ca50ce4_JaffaCakes118
Size

53KB
MD5

e9ae41196f57fb97a123cc6d8ca50ce4
SHA1

24b3050ceed59d94daa03cf74d5dda61e7c857d9
SHA256

8f948355218d411881a9da340d82e4059f338945cb6421073703d18c3cad3339
SHA512

b24fae573b98fd3f8904c29e53af295f2c224613192417aadb60d73bd15a3384266f18e5826b5bf0b038539049a5a9033a18fa3e0aa75e539d2e5d2a93976b67
SSDEEP

768:Lhb+PCQMRuUXoTYRfXT7JPzdfdLi1qddnCayt7L3Pzz:LhbsClRuUXoTYR77J7pNCB5Tzz

Score

1^/10

Malware Config

Signatures

Files

e9ae41196f57fb97a123cc6d8ca50ce4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2cb2bbfa81aa1debd3e6d362848a37c8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f5:80:fb:2e:ae:5b:14:d6:00:2c:29:69:81:09:e9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

08/10/2004, 00:00

Not After

08/10/2005, 23:59

Subject

CN=America Online\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=WAOL Firewall Trust v1,O=America Online\, Inc.,L=Dulles,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\strauss2_lp\1180a\cprd32\AOL\misc\coreclient\shellmon\shellmon.pdb

Imports

shlwapi

PathFindFileNameA

msimg32

GradientFill

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

msvcr71

_except_handler3
__set_app_type
__dllonexit
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_onexit
atol
atoi
_itoa
strrchr
_splitpath
strstr
localtime
asctime
_mkdir
_ultoa
time
strlen
strcat
memcpy
memset
strcmp
strcpy
malloc
free
strncpy
_controlfp

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

user32

LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadCursorA
PostQuitMessage
DefWindowProcA
SetTimer
GetWindowThreadProcessId
GetDesktopWindow
CreateWindowExA
RegisterWindowMessageA
FindWindowA
KillTimer
PostMessageA
SendMessageTimeoutA
DialogBoxParamA
SendDlgItemMessageA
wsprintfA
IsDlgButtonChecked
GetDlgItemTextA
EndDialog
SetWindowTextA
SetDlgItemTextA
CheckDlgButton
GetWindowTextA
GetSysColor
DrawTextA
DrawFocusRect
FillRect
RegisterClassExA

gdi32

GetNearestColor
GetDeviceCaps
DeleteObject
SelectObject
CreateSolidBrush
SelectClipRgn
CreateRoundRectRgn
LPtoDP
DeleteDC
BitBlt
SetTextColor
SetBkMode
CreateCompatibleBitmap
CreateCompatibleDC
SetBkColor

kernel32

GetVersionExA
lstrcpyA
lstrcpynA
lstrlenA
WritePrivateProfileStringA
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemPowerStatus
WaitForDebugEvent
DebugActiveProcess
CreateThread
GetStartupInfoA
CloseHandle
SetEvent
OpenEventA
GetLastError
OpenMutexA
FindClose
FindFirstFileA
CreateProcessA
Sleep
CreateMutexA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTickCount
ReadProcessMemory
ContinueDebugEvent
GetModuleHandleA
_lclose
_lopen
_llseek
_lcreat
_lwrite
lstrcatA
GetModuleFileNameA
SetCurrentDirectoryA
SetProcessShutdownParameters
CopyFileA
FindNextFileA
GetExitCodeProcess
OpenProcess
Module32First
Module32Next
WritePrivateProfileSectionA
GetLocalTime

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cb2bbfa81aa1debd3e6d362848a37c8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0aCertificate

Extended Key Usages

Key Usages

54:f5:80:fb:2e:ae:5b:14:d6:00:2c:29:69:81:09:e9Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

shlwapi

msimg32

version

msvcr71

advapi32

user32

gdi32

kernel32

Sections

.text Size: 20KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 12KB - Virtual size: 8KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

54:f5:80:fb:2e:ae:5b:14:d6:00:2c:29:69:81:09:e9
Certificate

.text
Size: 20KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 12KB - Virtual size: 8KB