f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118

General

Target
f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118
Size 494KB
Sample240417-frl83afh91
SHA256 11742b1b7437e34b15baafe3e44a7cf5a14d9b149ddb87499c42dd9fdbd5661a
MD5 f51892f6d4ee376d5b2472d51e5a6729
SHA1 e68bc433795b01e2844f70dabaf512a519daadcd
SHA512 f878b9f065894e0fe6449c0c1ca7fee4f1aacebc8925067d4af053bd7af0972dbce9a47814d864387fad13d7dad60352596c9975a177a1111aa5e79f6f0ad92f
SSDEEP 12288:mnKfyxV2ImdvPGBFfi8WuJ6+1x0KCYT88VtX0n:WKfwV2HtPgFfN9/pD4
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118

.exe 494KB

f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118

IMPHASH 503c81acb87199818c1429592fa85736
SHA256 11742b1b7437e34b15baafe3e44a7cf5a14d9b149ddb87499c42dd9fdbd5661a
MD5 f51892f6d4ee376d5b2472d51e5a6729
SHA1 e68bc433795b01e2844f70dabaf512a519daadcd
SHA512 f878b9f065894e0fe6449c0c1ca7fee4f1aacebc8925067d4af053bd7af0972dbce9a47814d864387fad13d7dad60352596c9975a177a1111aa5e79f6f0ad92f
SSDEEP 12288:mnKfyxV2ImdvPGBFfi8WuJ6+1x0KCYT88VtX0n:WKfwV2HtPgFfN9/pD4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

87:c8:cb:3c:64:4b:4d:ec:60:57:91:bf:f6:10:13:83:d8:a1:c0:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=FIRSERIA\, S.L.,OU=IT,O=FIRSERIA\, S.L.,L=Badalona,ST=Barcelona,C=ES

Chains

Jun 9, 2014

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=FIRSERIA\, S.L.,OU=IT,O=FIRSERIA\, S.L.,L=Badalona,ST=Barcelona,C=ES

Serial Number

73:c4:78:0f:ac:0c:d4:97:b0:77:87:32:fb:8a:f6:73

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Jul 24, 2013 - Jul 24, 2014

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 23, 2013 - Sep 23, 2024

Minor OS version

1

Major OS version

5

Entry point

58650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize CreateDirectoryW WaitForSingleObject WriteFile CreateFileW GetTempPathW GetLastError CloseHandle FindFirstFileW OpenProcess GetVersionExW GetProcAddress GetModuleFileNameW FindClose RemoveDirectoryW FindNextFileW DeleteFileW SetFilePointer SystemTimeToFileTime WideCharToMultiByte ReadFile MultiByteToWideChar GetCurrentDirectoryW LocalFileTimeToFileTime SetEndOfFile CreateFileA WriteConsoleW LoadLibraryW GetFileAttributesW GetModuleHandleW SetStdHandle HeapReAlloc IsValidLocale EnumSystemLocalesA InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCPInfo ExitProcess GetSystemTimeAsFileTime HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType HeapCreate GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapSize GetUserDefaultLCID GetLocaleInfoA GetProcessHeap

user32

MessageBoxW wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW

psapi

EnumProcesses GetModuleBaseNameW EnumProcessModules

Sharing

General

Malware Config

Signatures

File Explorer

f51892f6d4ee376d5b2472d51e5a6729_JaffaCakes118

PE Signature issue

kernel32

user32

advapi32

psapi

generic