06fd17f3e557e3b0884a51086a1ccd9a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

06fd17f3e557e3b0884a51086a1ccd9a_JaffaCakes118
Size

3.9MB
MD5

06fd17f3e557e3b0884a51086a1ccd9a
SHA1

d30b405807d4acb369c5b1375b12d69eb5de6dff
SHA256

b620191294fae07401dba72c2cf5fa2bebbbd9ac42308ef7d3873725fab7c872
SHA512

43080adac8837dc7cc01a585ec3740b69708535c2de45ffae727350c84a51ecaee576c6c5d6fdd57031777f32f10cf465d303cafd9a6c0e83798cc19a1bd153a
SSDEEP

98304:+3XUV8SIyk3SqY9pJfOo3NZn8AnkhFh1+UAofRlAv:+3XhykCqYb9OOt8NF+UJfXAv

Score

1^/10

Malware Config

Signatures

Files

06fd17f3e557e3b0884a51086a1ccd9a_JaffaCakes118
.exe windows:6 windows x86 arch:x86

75b495966efa746896464eca2da24475

Code Sign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12/03/2019, 00:00

Not After

31/12/2028, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ac:42:42:72:07:5b:5d:76:90:fd:5f:41:fe:d2:e6:f3
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/07/2020, 00:00

Not After

03/12/2020, 23:59

Subject

CN=Argo Enterprise\, LLC,O=Argo Enterprise\, LLC,POSTALCODE=199155,STREET=d. 20 litera B pom. 14 per. Dekabristov,L=St. Petersburg,ST=Leningradskaya,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:26:50:b2:d6:57:19:16:9d:26:8e:bb:cd:cb:ee:dc:a0:49:b6:0f
Signer

Actual PE Digest

40:26:50:b2:d6:57:19:16:9d:26:8e:bb:cd:cb:ee:dc:a0:49:b6:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\16e162391906fd18\bin\ReleaseMT\tt-sciter-installer.pdb

Imports

kernel32

EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
GetModuleFileNameW
CreateProcessW
FreeConsole
GetConsoleWindow
AllocConsole
GetTempPathW
GetVersionExW
DeleteFileW
GetTempFileNameW
GetWindowsDirectoryW
GetDriveTypeW
CreateFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
QueryDosDeviceW
VirtualFree
lstrlenW
VirtualAlloc
K32GetProcessImageFileNameW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateDirectoryW
FindFirstFileW
GetFullPathNameW
FindNextFileW
WriteFile
RemoveDirectoryW
FindClose
GetFileAttributesW
SetFileAttributesW
FindResourceExW
MoveFileExW
VerSetConditionMask
Sleep
VerifyVersionInfoW
FlushFileBuffers
ReadFile
SetFilePointer
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetFileInformationByHandle
GetModuleHandleW
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
GetSystemInfo
VirtualQuery
GetFileType
WriteConsoleW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
WaitForSingleObjectEx
DuplicateHandle
CloseHandle
GetCurrentThreadId
TryEnterCriticalSection
GetTickCount
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
WideCharToMultiByte
GetExitCodeThread
GetCurrentThread
SwitchToThread
GetCurrentProcess
SleepEx
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
FormatMessageA
CreateFileA
GetFileAttributesExW
PeekNamedPipe
SetEndOfFile
SetDllDirectoryW
LocalFree
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
GetCommandLineW
SizeofResource
FreeLibrary
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
LoadLibraryW
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree

user32

TranslateMessage
GetMessageW
DispatchMessageW
GetWindowThreadProcessId
GetWindowRect
SetWindowPos
GetForegroundWindow
GetDesktopWindow
SetForegroundWindow
ShowWindow
wsprintfW

shell32

SHGetKnownFolderPath
SHGetFolderPathW

ole32

OleInitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
OleUninitialize

userenv

UnloadUserProfile

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

advapi32

CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegGetValueW
GetTokenInformation
GetAclInformation
GetAce
GetSidSubAuthority
GetSidLengthRequired
SetNamedSecurityInfoW
CopySid
GetNamedSecurityInfoW
InitializeSid
IsValidSid
AddAce
InitializeAcl
GetLengthSid
OpenProcessToken
ConvertSidToStringSidW

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

wininet

InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetReadFile

crypt32

CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject

ws2_32

WSASetLastError
WSAIoctl
WSAStartup
ntohs
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
ioctlsocket
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
socket
WSAGetLastError
setsockopt
WSACleanup

Sections

.text
Size: 963KB - Virtual size: 963KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 235KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75b495966efa746896464eca2da24475

Code Sign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

01Certificate

Key Usages

ac:42:42:72:07:5b:5d:76:90:fd:5f:41:fe:d2:e6:f3Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

40:26:50:b2:d6:57:19:16:9d:26:8e:bb:cd:cb:ee:dc:a0:49:b6:0fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

ole32

userenv

rpcrt4

version

advapi32

oleaut32

wininet

crypt32

ws2_32

Sections

.text Size: 963KB - Virtual size: 963KB

.rdata Size: 235KB - Virtual size: 235KB

.data Size: 20KB - Virtual size: 30KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 45KB - Virtual size: 45KB

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

01
Certificate

ac:42:42:72:07:5b:5d:76:90:fd:5f:41:fe:d2:e6:f3
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

40:26:50:b2:d6:57:19:16:9d:26:8e:bb:cd:cb:ee:dc:a0:49:b6:0f
Signer

.text
Size: 963KB - Virtual size: 963KB

.rdata
Size: 235KB - Virtual size: 235KB

.data
Size: 20KB - Virtual size: 30KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 45KB - Virtual size: 45KB