General

Malware Config

Signatures

Files

• fab07fe70d8bff909875addcb6d6941e_JaffaCakes118

  .exe windows:4 windows x86 arch:x86

  27ba7c774af997b6078c3ab771763eac

  
  

  Code Sign

  59:c1:5f:4a:d8:c8:ca:6b:bc:5f:47:6b:1a:90:4c:a8

  Certificate

  Issuer

  CN=AnVir Software

  Not Before

  31-12-2007 21:00

  Not After

  31-12-2012 21:00

  Subject

  CN=AnVir Software

  Extended Key Usages

  ExtKeyUsageCodeSigning

  df:a5:16:fc:75:79:1f:83:0f:f5:bf:76:89:ed:f2:c6:80:d9:4c:1a

  Signer

  Actual PE Digest

  df:a5:16:fc:75:79:1f:83:0f:f5:bf:76:89:ed:f2:c6:80:d9:4c:1a

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrlenA

  lstrcatA

  UnmapViewOfFile

  CloseHandle

  WriteFile

  GetFileSize

  GetTempFileNameA

  GetTempPathA

  lstrcpyA

  GetLastError

  MapViewOfFile

  CreateFileMappingA

  CreateFileA

  FormatMessageA

  CreateProcessA

  DeleteFileA

  GetModuleFileNameA

  ExitProcess

  GetModuleHandleA

  user32

  MessageBoxA

  wsprintfA

  setupapi

  SetupIterateCabinetA

  Sections

  .text

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ