f10e64cfd6eab1b2bd224bc1ce358143_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f10e64cfd6eab1b2bd224bc1ce358143_JaffaCakes118
Size

146KB
MD5

f10e64cfd6eab1b2bd224bc1ce358143
SHA1

d8b623f6ebfea42b3286e4c0c3ba637ffabcb704
SHA256

6bd4a6c48e0460650096c0ed0749ee88cd44914317f7f63157d7c613d3d2c90a
SHA512

379cbee05128cf04f07f8f13bd436658cfeeb698ad894352faa100fd4b55d636504f62b5e283a469f6c10253cc1bea1e2cf924637148fa298aa1fd70854a2716
SSDEEP

3072:2tUDcFjIT45Pg+X4zy/77jt4VE+t9EIsfX:uecFMT4ZX3/jaVEUC7fX

Score

1^/10

Malware Config

Signatures

Files

f10e64cfd6eab1b2bd224bc1ce358143_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a22727a65ddebc709b37d7529073b514

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cd:62:60:0b:ec:f8:44:1a:33:33:68:81:8c:32:46:d0:8e:6c:94:05
Signer

Actual PE Digest

cd:62:60:0b:ec:f8:44:1a:33:33:68:81:8c:32:46:d0:8e:6c:94:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAddExtensionW
PathAppendW
SHSetValueW
wnsprintfW

advapi32

RegOpenKeyW
RegCloseKey

kernel32

ReadFile
WriteFile
CloseHandle
SetFilePointer
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
DeleteFileW
DeleteFileA
GetVersionExW
SizeofResource
GetSystemDirectoryW
LoadResource
FindResourceW
lstrcpynW
LoadLibraryW
GetDllDirectoryW
SetCurrentDirectoryW
SetErrorMode
GetModuleHandleW
GetSystemInfo
GetNativeSystemInfo
FreeResource
lstrcmpiW
GetCurrentProcessId
lstrlenW
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
LocalFree
ExitProcess
LocalAlloc
LockResource
GetSystemTimeAsFileTime

gdi32

GetObjectW
CreateFontIndirectW
DeleteObject

user32

CheckRadioButton
UpdateWindow
PostMessageW
GetParent
SetWindowLongW
LoadStringW
IsDlgButtonChecked
GetDlgItem
GetWindowTextLengthW
GetDlgItemTextW
SetDlgItemTextW
GetWindow
GetWindowLongW
GetClassNameW
SendMessageW

shell32

ord680
ShellExecuteA
SHGetFolderPathAndSubDirW

comctl32

ord412
ord413
ord410
PropertySheetW

ole32

CoUninitialize
CoCreateInstance
CoInitialize

cabinet

ord23
ord22
ord20

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a22727a65ddebc709b37d7529073b514

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

cd:62:60:0b:ec:f8:44:1a:33:33:68:81:8c:32:46:d0:8e:6c:94:05Signer

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

advapi32

kernel32

gdi32

user32

shell32

comctl32

ole32

cabinet

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 24B

.rsrc Size: 130KB - Virtual size: 130KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

cd:62:60:0b:ec:f8:44:1a:33:33:68:81:8c:32:46:d0:8e:6c:94:05
Signer

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 24B

.rsrc
Size: 130KB - Virtual size: 130KB