f1662dad0c4d11b77cca179c40b6776f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f1662dad0c4d11b77cca179c40b6776f_JaffaCakes118
Size

877KB
MD5

f1662dad0c4d11b77cca179c40b6776f
SHA1

568f82cbe7733c9951a1719ffd6ebfd8d2a064b6
SHA256

846daf6161bdbb9cbfbf1237ab3acea029facf0d2ff856cbbae31c2b1c97e173
SHA512

6e0c7b91e4890b4a88ab7be9aed0bcd5ccf3e68ff4030714701119ff8fae3c6f3f05a28c4f4d34758d627a3f3604e447268c8a8ee63c0bea96b4a6d41f528de5
SSDEEP

12288:gN/2oLRqrd2XtqYrFJiTIdhxhSt0UxGIApc4mv+ywwupHqvXf5nCE4dsSmYmq0X5:glSAr64G0UxG9i7jupSXfdL4dxm+Ao6

Score

1^/10

Malware Config

Signatures

Files

f1662dad0c4d11b77cca179c40b6776f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

81638d02019c0bfcaaf23a9c69f2f12c

Code Sign

01
Certificate

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

09:fe:a6
Certificate

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Not Before

14/02/2003, 17:59

Not After

11/02/2004, 17:14

Subject

CN=Panicware\, Inc.,OU=Secure Application Development,O=Panicware\, Inc.,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

ae:16:71:ee:c7:fa:f6:6c:37:91:e5:99:9a:c6:d8:c1:00:f0:5d:fc
Signer

Actual PE Digest

ae:16:71:ee:c7:fa:f6:6c:37:91:e5:99:9a:c6:d8:c1:00:f0:5d:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileMappingA
WaitForSingleObject
CreateProcessA
GetCommandLineA
CloseHandle
UnmapViewOfFile
WriteFile
MapViewOfFile
DeleteFileA
GetTempFileNameA
GetTempPathA
CreateFileA
GetShortPathNameA
GetModuleFileNameA

user32

wsprintfA

Sections

.text
Size: 512B - Virtual size: 510B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 533B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 872KB - Virtual size: 872KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81638d02019c0bfcaaf23a9c69f2f12c

Code Sign

01Certificate

09:fe:a6Certificate

Extended Key Usages

ae:16:71:ee:c7:fa:f6:6c:37:91:e5:99:9a:c6:d8:c1:00:f0:5d:fcSigner

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 512B - Virtual size: 510B

.rdata Size: 1024B - Virtual size: 533B

.data Size: 512B - Virtual size: 20B

.rsrc Size: 872KB - Virtual size: 872KB

01
Certificate

09:fe:a6
Certificate

ae:16:71:ee:c7:fa:f6:6c:37:91:e5:99:9a:c6:d8:c1:00:f0:5d:fc
Signer

.text
Size: 512B - Virtual size: 510B

.rdata
Size: 1024B - Virtual size: 533B

.data
Size: 512B - Virtual size: 20B

.rsrc
Size: 872KB - Virtual size: 872KB