f4a4543eada5049f3cdb90c31fc96932_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f4a4543eada5049f3cdb90c31fc96932_JaffaCakes118
Size

432KB
MD5

f4a4543eada5049f3cdb90c31fc96932
SHA1

031140bfa0de84afbfd1dafe5df8713b4a786bbc
SHA256

fe1b2bf630f760f0bde79251a503d2d03182c04bf50233e1a7b7846ab3bb378f
SHA512

3cca9aa0c4bcfbf35598b96589f2b133b18c5e7f0717ad18231c0a04d9345a13b8106e0790860e801a3a76c0c063a2e6bbd8dcfb493a6c3491851537cd21fba0
SSDEEP

6144:MEqrne9v8BCbJvaqBjdh88CUPQVQmIDt8AtGWzh5/Q1xNeezAQEq++mhkJ7Eoh:tqrne9UBEAmQVZIp8yRyxNfA9jZkJIoh

Score

1^/10

Malware Config

Signatures

Files

f4a4543eada5049f3cdb90c31fc96932_JaffaCakes118
.exe windows:4 windows x86 arch:x86

23a14da16fb6327df441d3bf4659dd24

Code Sign

79:63:d1:30:76:d3:3d:54:b2:c8:f3:0f:d7:80:a4:4e
Certificate

Issuer

CN=qjlswolapyl

Not Before

13/12/2011, 16:34

Not After

13/06/2012, 22:00

Subject

CN=Neryu

4f:f8:32:4e:b0:56:c8:2b:12:df:e7:7d:33:15:a4:31:44:e1:8a:03
Signer

Actual PE Digest

4f:f8:32:4e:b0:56:c8:2b:12:df:e7:7d:33:15:a4:31:44:e1:8a:03

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindowAsync
GetDlgItemInt

ole32

OleGetAutoConvert
CoRegisterMessageFilter

oleaut32

CreateTypeLi

kernel32

TlsGetValue
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetACP
SetThreadLocale
GetOEMCP
GetModuleHandleA
GetProcAddress
ExitProcess
GetLastError
RemoveDirectoryA
GetStartupInfoA
GetCommandLineA
GetVersion
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
VirtualAlloc
HeapReAlloc
GetCPInfo

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xgiafn
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

hvgu
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23a14da16fb6327df441d3bf4659dd24

Code Sign

79:63:d1:30:76:d3:3d:54:b2:c8:f3:0f:d7:80:a4:4eCertificate

4f:f8:32:4e:b0:56:c8:2b:12:df:e7:7d:33:15:a4:31:44:e1:8a:03Signer

Headers

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 5KB - Virtual size: 92KB

xgiafn Size: 298KB - Virtual size: 298KB

hvgu Size: 100KB - Virtual size: 100KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 2KB

79:63:d1:30:76:d3:3d:54:b2:c8:f3:0f:d7:80:a4:4e
Certificate

4f:f8:32:4e:b0:56:c8:2b:12:df:e7:7d:33:15:a4:31:44:e1:8a:03
Signer

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 5KB - Virtual size: 92KB

xgiafn
Size: 298KB - Virtual size: 298KB

hvgu
Size: 100KB - Virtual size: 100KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 2KB