07dd54d40c9074a8abfaf7e39569dbdc_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

07dd54d40c9074a8abfaf7e39569dbdc_JaffaCakes118
Size

1.0MB
MD5

07dd54d40c9074a8abfaf7e39569dbdc
SHA1

acaa34b2f4c99e656e037bacb8046436f95323e3
SHA256

9c398d28e8fb13679c473e9c0e85002f8076d89a810304197c997e72032114bb
SHA512

7f74f57192b52d0aca65c66b9b40531a247066cfe7674a04a326b3274d2425498931530d77bdae7e86118e40d061dc828ae8c5276daaf287c2e94715ba9ba554
SSDEEP

24576:FlJoabCo30tTZ+6nlDPzGl4UIzN6poSK0CI23ljFNmu:6/PTYWUIz8p7eVjFV

Score

1^/10

Malware Config

Signatures

Files

07dd54d40c9074a8abfaf7e39569dbdc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2409184ad6a667e4c514a21b76ee92c5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:e8:c4:ec:4e:b9:5f:54:95:2b:da:4a:37:ae:9a:48
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

10-10-2007 00:00

Not After

09-10-2008 23:59

Subject

CN=AhnLab\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information System Team,O=AhnLab\, Inc.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:17:64:6a:31:0b:80:61:09:08:80:fc:9e:2e:c6:36:5d:46:10:05
Signer

Actual PE Digest

3b:17:64:6a:31:0b:80:61:09:08:80:fc:9e:2e:c6:36:5d:46:10:05

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

SetFilePointer
GetLocalTime
OutputDebugStringA
WriteConsoleA
GetStdHandle
GetCurrentProcessId
GetCurrentThreadId
lstrlenA
InterlockedIncrement
WideCharToMultiByte
InterlockedDecrement
LocalFree
FormatMessageA
MultiByteToWideChar
GetVersionExA
lstrcmpiA
GetVersion
GetSystemInfo
GetModuleHandleA
lstrcmpA
LocalAlloc
lstrcpynA
lstrlenW
IsBadStringPtrW
IsBadStringPtrA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetWindowsDirectoryA
HeapFree
HeapAlloc
GetProcessHeap
SetCurrentDirectoryA
WaitForMultipleObjects
ResetEvent
ResumeThread
SuspendThread
GetCurrentDirectoryA
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetUserDefaultLangID
LoadLibraryExA
GetSystemDirectoryA
DeleteFileA
GetLastError
GetTempFileNameA
RemoveDirectoryA
MulDiv
CloseHandle
CreateFileA
LoadLibraryA
SetLastError
GetDriveTypeA
GetFileAttributesA
CreateDirectoryA
CreateDirectoryW
CreateFileW
GetFileSize
WriteFile
SizeofResource
LockResource
LoadResource
FindResourceA
GetStartupInfoA
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
ReleaseMutex
CreateEventA
SetEvent
PulseEvent
WaitForSingleObject
ReadFile

mfc42

ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3370
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4424
ord3640
ord800
ord609
ord693
ord765
ord795
ord641
ord1641
ord540
ord567
ord324
ord825
ord3663
ord3626
ord2414
ord2302
ord4234
ord1105
ord823
ord858
ord1168
ord5805
ord2860
ord4710
ord2642
ord2982
ord4376
ord4224
ord2817
ord6199
ord4160
ord4284
ord535
ord6007
ord3998
ord2379
ord3693
ord755
ord5787
ord5788
ord5794
ord5277
ord470
ord5875
ord3089
ord6453
ord4673
ord4274
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord561
ord3499
ord2515
ord355
ord939
ord2818
ord860
ord537
ord2621
ord1134
ord656
ord2725
ord3610
ord3619
ord2289
ord2370
ord5981
ord3874
ord2859
ord4277
ord5683
ord772
ord500
ord5860
ord922
ord699
ord5593
ord397
ord4278
ord1576
ord5583
ord668
ord1980
ord3181
ord4058
ord2781
ord2770
ord941
ord356
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6172
ord5873
ord5789
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3571
ord640
ord5785
ord6021
ord1640
ord323
ord2405
ord6174
ord4275
ord2864
ord2380
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4402
ord1776
ord4078
ord6055
ord2582
ord3698
ord3402
ord4407
ord3573
ord3721
ord3574
ord4396
ord2575
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord5265
ord2754
ord4853
ord6142

msvcrt

wcscspn
wcspbrk
iswdigit
iswspace
wcscmp
_wcsicmp
wcscoll
_wcsicoll
_wtoi
strchr
strrchr
_strrev
strstr
strspn
strcspn
strpbrk
isdigit
isspace
strcmp
_stricmp
strcoll
_stricoll
calloc
_lrotr
_lrotl
realloc
printf
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_setmbcp
__CxxFrameHandler
_mbscmp
_mbsicmp
__p___argc
__p___argv
_mbsnbcat
_mbsnbcpy
free
malloc
memset
_vsnprintf
memcpy
strlen
strncmp
_makepath
_splitpath
wcslen
_mbscoll
_mbsicoll
_mbsspn
_mbscspn
_mbsupr
_mbslwr
_purecall
_mbsrev
_mbsinc
_ismbcspace
memmove
_mbschr
_mbsstr
_mbspbrk
_mbsrchr
vsprintf
_mbclen
sprintf
wcsspn
wcsstr
_wcsrev
wcsrchr
wcschr
atoi
_ismbcdigit
_mbsnbcmp

user32

GetCursorPos
ScreenToClient
PtInRect
SetCursor
LoadCursorA
GetClassLongA
LoadBitmapA
RegisterWindowMessageA
GrayStringA
DrawTextA
TabbedTextOutA
CharNextA
CharPrevA
IsRectEmpty
CharToOemA
OemToCharA
CharUpperW
CharLowerW
CharNextW
wsprintfW
CharUpperA
wsprintfA
CharLowerA
LoadStringA
GetParent
CopyRect
GetDC
ReleaseDC
GetDesktopWindow
EnableWindow
InflateRect
GetClientRect
SendMessageA
MsgWaitForMultipleObjects
PostMessageA
IsWindow

gdi32

GetTextExtentPoint32A
PtVisible
RectVisible
CreateBitmap
ExtTextOutA
Escape
BitBlt
GetBkColor
CreateCompatibleDC
GetMapMode
CreateCompatibleBitmap
GetDeviceCaps
DeleteObject
CreatePen
RoundRect
GetStockObject
GetObjectA
TextOutA
CreateSolidBrush
CreateFontIndirectA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
RegFlushKey
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumValueA

shell32

ShellExecuteA
FindExecutableA
ShellExecuteExA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

oleaut32

SysAllocStringLen
SysReAllocStringLen

Sections

.text
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2409184ad6a667e4c514a21b76ee92c5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

6e:e8:c4:ec:4e:b9:5f:54:95:2b:da:4a:37:ae:9a:48Certificate

Extended Key Usages

Key Usages

3b:17:64:6a:31:0b:80:61:09:08:80:fc:9e:2e:c6:36:5d:46:10:05Signer

Headers

File Characteristics

Imports

version

kernel32

mfc42

msvcrt

user32

gdi32

advapi32

shell32

oleaut32

Sections

.text Size: 224KB - Virtual size: 220KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 68KB - Virtual size: 68KB

.rsrc Size: 84KB - Virtual size: 80KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

6e:e8:c4:ec:4e:b9:5f:54:95:2b:da:4a:37:ae:9a:48
Certificate

3b:17:64:6a:31:0b:80:61:09:08:80:fc:9e:2e:c6:36:5d:46:10:05
Signer

.text
Size: 224KB - Virtual size: 220KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 84KB - Virtual size: 80KB