f7aec53484f8fec3fe3da8837ef515cb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f7aec53484f8fec3fe3da8837ef515cb_JaffaCakes118
Size

65KB
MD5

f7aec53484f8fec3fe3da8837ef515cb
SHA1

60335466eae86c5c4020c5f7da5bc9f6da9cc4cd
SHA256

7e975bcd9585c4e1441b5e0e4b2bd311f9a4137339191e427109dac51017ec3f
SHA512

7805f3a4559aed5c97451a229432753920e218241a0d4e23520c3af892b78587560f20ac637c10bfd3394199884554e448dd699075bc522fcc0f25551a2dc299
SSDEEP

1536:7RJhz2A3xsqhhuPkabf8j21i6SiwprgLGDMPb:7RJhz3Wq+9bExaDqDMD

Score

1^/10

Malware Config

Signatures

Files

f7aec53484f8fec3fe3da8837ef515cb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6bc85232eaf7bcc04ccfbda6bafbc20c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

HashData
SHIsLowMemoryMachine
UrlGetLocationA
UrlIsOpaqueA
PathCommonPrefixA
StrIsIntlEqualA
StrRChrIA
StrCSpnA
PathIsUNCA
ColorHLSToRGB
PathQuoteSpacesA
StrChrIA
PathFindOnPathA
SHRegCreateUSKeyA
PathIsRelativeA
PathSearchAndQualifyA
SHCreateStreamWrapper
PathIsFileSpecA
SHDeleteValueA
StrFormatByteSize64A
SHRegEnumUSKeyA
SHAutoComplete
StrSpnA
SHRegWriteUSValueA
SHRegOpenUSKeyA
PathRemoveBlanksA
StrToIntExA
PathAppendA
AssocQueryStringA
PathMakePrettyA
PathGetDriveNumberA

kernel32

GetTapeParameters
SetSystemTime
Thread32Next
DuplicateHandle
Module32First
GetCommConfig
SleepEx
SetConsoleWindowInfo
SetStdHandle
GetProcessShutdownParameters
GetCurrentDirectoryA
TerminateThread
SetConsoleActiveScreenBuffer
GetSystemDirectoryA
GetNamedPipeHandleStateA
WritePrivateProfileStringA
lstrlen
EnumResourceTypesA
VirtualQueryEx
SetCommMask
ResumeThread
GetTempPathA
GetTickCount
UnlockFileEx
SetConsoleOutputCP
FoldStringA
BackupSeek
FindAtomA
UTRegister
WaitForMultipleObjects
SetVolumeLabelA
GetFullPathNameA
CreateThread
GetUserDefaultLangID
lstrcpy
InterlockedIncrement
SetFileApisToOEM
ReadConsoleA
GlobalLock
GetTimeZoneInformation
SetEnvironmentVariableA
ReadFileEx
GetProfileStringA
GetDefaultCommConfigA
OpenSemaphoreA
CommConfigDialogA
InterlockedCompareExchange
TlsSetValue
GetPrivateProfileStructA
GlobalReAlloc
_llseek
ReadProcessMemory
GetTapeStatus
GlobalAddAtomA
TlsFree
FillConsoleOutputAttribute
GlobalUnWire
IsBadReadPtr
EnumDateFormatsA

user32

GetTopWindow

Sections

.ofoj
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.atk
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fyvwz
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xgv
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bc85232eaf7bcc04ccfbda6bafbc20c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

Sections

.ofoj Size: 22KB - Virtual size: 45KB

.atk Size: 5KB - Virtual size: 10KB

.fyvwz Size: 1KB - Virtual size: 2KB

.xgv Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.ofoj
Size: 22KB - Virtual size: 45KB

.atk
Size: 5KB - Virtual size: 10KB

.fyvwz
Size: 1KB - Virtual size: 2KB

.xgv
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB