04edf759052d05c68e58d1874f236647_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

04edf759052d05c68e58d1874f236647_JaffaCakes118
Size

646KB
MD5

04edf759052d05c68e58d1874f236647
SHA1

0d6a3f9e46d40a082aa7bcdb226f7d9c78f2d18c
SHA256

132e6528764da05ce38602227d747ab012e5debbc3a1f345142c28792772ab4a
SHA512

187aaefce33c6b0d521a77de491287a5a3cdd352e55eb3b3e0d0f6f0b903c34a4d97155f5e1471748d61c372960e7c2cdf0cb4d3bdb3c05a2fc13b9362ba34a4
SSDEEP

12288:Pf+oZf0McvBP7+i+Xm/fsUkfvpZ9EevG2aYaEPK69Fu/yzFNpGLH0Mq73EDnuf:Pkki+XmMlfaVU53WH0pcg

Score

1^/10

Malware Config

Signatures

Files

04edf759052d05c68e58d1874f236647_JaffaCakes118
.exe windows:4 windows x86 arch:x86

61ae76980f6b386df3f05195dc0d6603

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8d:4e:f9:6c:4d:a8:4d:aa:fc:02:5b:ab:63:f7:0d:55:2b:4e:53:9b
Signer

Actual PE Digest

8d:4e:f9:6c:4d:a8:4d:aa:fc:02:5b:ab:63:f7:0d:55:2b:4e:53:9b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mstordb.pdb

Imports

msvcrt

_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_except_handler3
_XcptFilter
_exit
_c_exit
swprintf
?terminate@@YAXXZ
_onexit
__dllonexit
memset
_beginthread
_wtol
wcscpy
swscanf
_wcsdup
wcsstr
_setjmp3
longjmp
strncmp
_wsplitpath
_wcsnicmp
_vsnwprintf
wcsrchr
_wtoi64
_wtoi
wcstod
strtod
_iob
fprintf
fread
fflush
fwrite
strncpy
abort
sprintf
calloc
_wcsicmp
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
realloc
??1exception@@UAE@XZ
wcstoul
wcscmp
wcsncmp
wcschr
wcslen
??2@YAPAXI@Z
__CxxFrameHandler
malloc
memmove
??3@YAXPAX@Z
_CxxThrowException
free
_CIpow

kernel32

GetStartupInfoW
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LoadLibraryW
GetVersionExA
GetProcAddress
GetModuleHandleA
LockFile
LockFileEx
UnlockFileEx
GetFileInformationByHandle
SetEndOfFile
GetCommandLineW
GetCurrentThreadId
Sleep
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
lstrcpynW
GetModuleFileNameW
CreateThread
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
GetLastError
LCMapStringW
GetUserDefaultLCID
lstrlenW
lstrlenA
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesW
CloseHandle
ReadFile
SetFilePointer
CreateFileW
MoveFileW
DeleteFileW
GlobalUnlock
GlobalLock
GetTempFileNameW
GetTempPathW
WriteFile
HeapFree
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapCreate
SystemTimeToFileTime
MultiByteToWideChar
GlobalFree
GlobalAlloc
GetDiskFreeSpaceExW
lstrcmpiW
FlushFileBuffers
CompareStringW
CreateEventW
SetEvent
WaitForSingleObject
UnlockFile

user32

ReleaseDC
GetDC
GetDesktopWindow
LoadImageA
FindWindowA
CharNextW
PostThreadMessageA
DispatchMessageA
GetMessageA
SetTimer
LoadStringW

gdi32

GetDIBits
DeleteObject
GetObjectW

advapi32

RegQueryValueExW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

CoTaskMemFree
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateGuid
StringFromGUID2
CreateStreamOnHGlobal
CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoCreateInstance

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SafeArrayDestroy
VariantTimeToSystemTime
VariantChangeTypeEx
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarBstrCmp

wininet

InternetOpenUrlW
InternetCloseHandle
InternetOpenW
HttpQueryInfoW
InternetErrorDlg

shlwapi

PathFindExtensionW

Exports

Exports

_resetstkoflw

Sections

.text
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

61ae76980f6b386df3f05195dc0d6603

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

8d:4e:f9:6c:4d:a8:4d:aa:fc:02:5b:ab:63:f7:0d:55:2b:4e:53:9bSigner

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

user32

gdi32

advapi32

ole32

oleaut32

wininet

shlwapi

Exports

Exports

Sections

.text Size: 583KB - Virtual size: 582KB

.data Size: 12KB - Virtual size: 17KB

.cdata Size: 512B - Virtual size: 4B

.rsrc Size: 49KB - Virtual size: 52KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

8d:4e:f9:6c:4d:a8:4d:aa:fc:02:5b:ab:63:f7:0d:55:2b:4e:53:9b
Signer

.text
Size: 583KB - Virtual size: 582KB

.data
Size: 12KB - Virtual size: 17KB

.cdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 49KB - Virtual size: 52KB