10d77a1e2c7cc5a5b0e01d1fd34c2efe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

10d77a1e2c7cc5a5b0e01d1fd34c2efe_JaffaCakes118
Size

608KB
MD5

10d77a1e2c7cc5a5b0e01d1fd34c2efe
SHA1

91e32ea48f55e47210bb0bce80c4405d738afc5a
SHA256

bcce8197fc45873ba184e88f7a96509eee98bdc722ac61b01c5c33d9d93d535d
SHA512

6661bbd057be5f742eefc377d710105bd22c7b9fee0a77079dd21800fe0931f9b96926f9a8f4d2fd888ee4f37be7f15d79908327f95e1b67886d0bee6b2096b0
SSDEEP

6144:tuaP4PwUaYKI5M0U35091aofl+kRbY7yraLRAlhgJHzpk0QT/wXY/nkfbEzc8Q76:tug4PvxbNhjgJlxXYcfF/LcEl+GM

Score

1^/10

Malware Config

Signatures

Files

10d77a1e2c7cc5a5b0e01d1fd34c2efe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec5b4fb8dd8c76cf8ef71c34db92526b

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8e:18:34:16:de:03:f9:76:e8:a4:d7:48:a2:9e:0c:de
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29/04/2015, 00:00

Not After

28/04/2016, 23:59

Subject

CN=RTPK,O=RTPK,POSTALCODE=214000,STREET=UL. KONENKOVA\, 4\, 68,L=SMOLENSK,ST=SMOLENSK REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a4:92:9c:84:d2:58:9e:bf:14:39:17:82:46:26:bb:58:71:29:d0:9c
Signer

Actual PE Digest

a4:92:9c:84:d2:58:9e:bf:14:39:17:82:46:26:bb:58:71:29:d0:9c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

SetWindowsHookExW
GetDCEx
ChangeDisplaySettingsA
CharLowerW
GetClipboardViewer
DefWindowProcW
GetWindowDC
EnumDisplaySettingsExA
SetMenuItemInfoA
wvsprintfW
GetWindowWord
CallMsgFilterA
AllowForegroundActivation
GetWindowThreadProcessId
GetNextDlgGroupItem
GetMenuItemInfoW
SetInternalWindowPos
DrawCaption
DeleteMenu
IsGUIThread
SetFocus
UnregisterClassA
GetWindowModuleFileNameA
RegisterClassA
SetProgmanWindow
GetWindowModuleFileNameW
ChildWindowFromPointEx
SetCapture
GetMessageW
SetProcessWindowStation
GetMonitorInfoA
AppendMenuA
SetThreadDesktop
SetSystemCursor
LoadImageA
GetNextDlgTabItem
DestroyAcceleratorTable
IsZoomed
DrawTextW
OemToCharW
ToAsciiEx
MessageBoxTimeoutA
MonitorFromRect
IsCharLowerA
SendMessageCallbackA
SetActiveWindow
CopyImage
BeginPaint
ShowScrollBar
EnableMenuItem
ModifyMenuW
CharLowerBuffW
CharNextW
RegisterClipboardFormatA
CallWindowProcA
ReleaseDC
SetForegroundWindow
IsDialogMessageA
GetMenuItemInfoA
DragDetect
EnumWindowStationsA
CharPrevA
SetCursorPos
FindWindowA
GetMenu
ShowWindow
GetWindowTextW
LoadBitmapA
SetDlgItemTextA
wsprintfA
DispatchMessageA
GetGUIThreadInfo
OpenInputDesktop
RegisterClassW
UnhookWindowsHook
PrivateExtractIconExW
GetWindowLongW
WaitMessage
ModifyMenuA
SetScrollInfo
CloseWindowStation
CharToOemA
PrivateExtractIconsW
GetClassInfoA
GetKeyboardLayoutNameA
PostMessageA
CharUpperW
GetInputState
GetClipboardOwner
TranslateAcceleratorA
PtInRect
GetScrollBarInfo
SetWindowsHookA
CascadeChildWindows
OemToCharA
RealChildWindowFromPoint
IntersectRect
GrayStringW
GetPropA
SetClassLongW
ChangeDisplaySettingsExA
SetCaretPos
GetWindowTextW
GetWindowWord
GetAncestor

kernel32

SetFileApisToOEM
GetStartupInfoW
DosPathToSessionPathA
SetTimerQueueTimer
FlushInstructionCache
ActivateActCtx
SetCommConfig
SetLocaleInfoA
lstrcmpW
SetLocaleInfoW
UpdateResourceA
CloseProfileUserMapping
GlobalFix
SetEvent
GetVolumePathNameW
LocalUnlock
GetStringTypeA
InitAtomTable
CommConfigDialogA
EnumResourceTypesW
TerminateThread
WriteTapemark
GetModuleFileNameW
GetVolumeInformationA
CommConfigDialogW
GetProcessPriorityBoost
GetStartupInfoA
CallNamedPipeA
CreateProcessW
IsValidCodePage
IsProcessorFeaturePresent
ReadConsoleOutputCharacterW
ReleaseSemaphore
GetTapeStatus
AddRefActCtx
CreateThread
EndUpdateResourceW
GetVolumePathNameA
SignalObjectAndWait
GetPriorityClass
FileTimeToDosDateTime
GetFileSizeEx
FindAtomA
GetTimeFormatW
GetLogicalDrives
CopyFileExW
LCMapStringW
GetConsoleWindow
EnumUILanguagesW
SetComputerNameExA
EnumResourceLanguagesA
GetVolumePathNamesForVolumeNameA
SetLastError
GetCommConfig
WriteConsoleInputA
GetDriveTypeW
TransactNamedPipe
IsBadCodePtr
LCMapStringA
ResetWriteWatch
GetCommProperties
WritePrivateProfileSectionW
ExpandEnvironmentStringsW
BuildCommDCBW
GetConsoleKeyboardLayoutNameA
VirtualQueryEx
GetPrivateProfileStructA
GetLargestConsoleWindowSize
GetCurrentProcess
GetSystemTimeAdjustment
GetACP
EnumCalendarInfoA
BuildCommDCBAndTimeoutsW
MoveFileW
GetLastError
GetProcessHeap
GetLastError
TlsAlloc
VirtualQuery
LoadLibraryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

comdlg32

GetOpenFileNameW
FindTextW

oleaut32

VarCyFromBool

gdi32

XFORMOBJ_bApplyXform
CreateDiscardableBitmap
PolyPolygon

comctl32

ImageList_Replace
FlatSB_SetScrollInfo
ImageList_Read
ImageList_ReplaceIcon

Exports

Exports

��O�aÿ��d~��a L��`�=!�c#'kP�-#�@c��Lt��z!�Y��%n˰z��VA`ʶÃ�P��ea:-�3��& qª��WFSB5��k��b�RzpQ�؉��M��Z�0��`;f��L�P��r�s�,t] �� Ԩ�K�p/P��z�� a��W��ä��.��g蹏�t㣒��T�� w�on}9��'��b�� .�t��ٲ�d�*�ժ��p�/�8̧̣��*��R+�f��ڏ��g��(Gm�&�[Y5�R�ǿ�]P��qE��R� Z:=��*23� 7��C��n��y�K��rt��Y�)#�X'�;��B ��%a\ΥF[��[�%4w��V0�h#��H��t2��:K��WGa��S��ɺf�Λ}a�B��7s�4��o�!�cJ`��j1�2n��>:g^L6��d�v+r�&"ﻳW � �=��8q2��f-�$ :�u�M�z�|��[�L9�q�g;6��y��;VX�,��k]i��R Z�}��mID�#��MēYW�,��5V��Ld��X�tV5c?/'�)W ��5�հY�1> Ău��E��r�-�U#Y�C@j��c�7�p��H^��ǔ"�b j&��8��R��qZ�� 2ި��ƶ�+ٌ��mZ})J�rJ��g��C�&�~a��G&��`E\��_7�e$4�*��ϑ��p~�#�D�)7��Ox��c�0_��J$�,-L�*��&&5e��K��A��S, 4\:E1��*6Yѐ��Y��q;-��u!��'*�� F��j��\��@��{mEk�h�ދ.�}]�|ܰ��4Q�J��7U{t0�M�Г-�^��h6>��hf�� D0�� (�M��r2�_w�x�V@E@3�-IZ^K6��W�1�hG�\�T��a��M�ǖ��mt�1Ƅ@ ��⭯�\5y�5��`�!�7��e�iS7Z��z��?�^��Nr�ǆۚ*� V��gsg��%%"�� B��T��zط�ROLs��)��g>Pi�*��RLaI��ǷK��ʚ�7N�QB� pC�7_��ֲ3�}y��[u��e��)3��~��l��5�C��~��_��T:Z�j.ώe�\��M��8@��J4�L_?��7}Oj�nh5.��I��x��r��7�}��>Υ/f"��D��~o ��f�ܪd��ue,ss�9+�f�#�/�`��4�l#�V�W� �-eX��!.� 0O7ٿ7{�;B�fv�!�O��n��l@�H��'�ʌ�K��(1�#D�.P��66'�R� ��6Y��Z��Y��$`�Y��)/U�� '�o��R� �PF=|j��А��*~Әm!��wN� �3��BZ h}Q�O�:�<�B��go�g'��lf4�\ p��諴\��=AG�%T�,��od<w�u��1X�IAH}J�� 3�m��I��^}u�|h��&�и�j�"�b<Kkub.�~��a'�lWs;x�� Vb�'��)K�%z�E�յ��.w ֩z�v��gZ7.<Vw�C�K!J*��q^�[-�"/*0�c��B��6��X��YS6��14��R��"��6+"ބ��hր �g�cp��= 5��J��}��Z��DąV�s��j=�=�Pq�r�Ñv��\� B�n��A{ V B�ЬԦ�*��E��Å�H<"�=(J�Ї��e"��S� ��0.�e�x��|l$}�~��)ۦF�h o{}�)4:I�� )ਝ��+��%\y�t��P��A�Lt��|uI�m��Tq��m�Qv�a��w�ݐW��Q��x]��Sc P�E�h=��J�m��nJ��`+��N'�L�-<F8��W��e.�cq��J@t?��8�]�u_�>I�}��O̅�q�W��S�w��/'d@�� X�x��9X��+\��X��)��Q�6��\��=��#Ns�TO ,cŀ��T��~��'ԗ�g��7*o��s��b�ߍ0�8�'�aCA�2��W��(}H��3臅�F��k�KQn&L��g��08��z��i8��G'�t3x��:p��A��0vQU�M�I6U� c��X��Y�#Y��ѐ�tqe�n��{�ozl��z6+��#�1��E�!L�M��'h��5܍�iK��Dx�;� +l�!��[��e��UR9юY��."ps#��J�0��Tvx#��<�qz�M *�l��AN��7��ב�3��j�� >��t �Q=Q��D�� "h��ᨳF��ڏ�y��-3E 5Q��[��j��S��ኢ��|�>Q� ��&�6,��BR|`�?*6�]S�Z9�ڍ�}��'�wgn$_S7e�ׄ��m�2��$:��ƌ�#�z�M��W$�JLQe��TD�2��c��X>��? ��w��u�&F!��'�_(�+qWa!�Չhl l@8��O.:Q�|)��CY�,/9�Ԇ�w��e��DŘ�¾MS:֦�u��Ym��f-��T��Dt��B5~��c��-[jU�u��s��kՎ��Iђ��Պ�C��v��<Z�VDB��!0�[�k�D�j�u��!�y�� wT�"�ӷ�-��{�֛��#��*8��w�]n��H��Վ��Z�g��W�$�/��"%⃀�'�;+_��V�C�;�'��"�1��S!��s�L�� ]�)�ˢ��D��0�M1�a��k��1l��

Sections

CODE
Size: 441KB - Virtual size: 441KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 904B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec5b4fb8dd8c76cf8ef71c34db92526b

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

8e:18:34:16:de:03:f9:76:e8:a4:d7:48:a2:9e:0c:deCertificate

Extended Key Usages

Key Usages

a4:92:9c:84:d2:58:9e:bf:14:39:17:82:46:26:bb:58:71:29:d0:9cSigner

Headers

File Characteristics

Imports

user32

kernel32

comdlg32

oleaut32

gdi32

comctl32

Exports

Exports

Sections

CODE Size: 441KB - Virtual size: 441KB

DATA Size: 19KB - Virtual size: 19KB

BSS Size: - Virtual size: 904B

.idata Size: 5KB - Virtual size: 4KB

.text0 Size: 13KB - Virtual size: 13KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 62KB - Virtual size: 62KB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

8e:18:34:16:de:03:f9:76:e8:a4:d7:48:a2:9e:0c:de
Certificate

a4:92:9c:84:d2:58:9e:bf:14:39:17:82:46:26:bb:58:71:29:d0:9c
Signer

CODE
Size: 441KB - Virtual size: 441KB

DATA
Size: 19KB - Virtual size: 19KB

BSS
Size: - Virtual size: 904B

.idata
Size: 5KB - Virtual size: 4KB

.text0
Size: 13KB - Virtual size: 13KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 62KB - Virtual size: 62KB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 53KB - Virtual size: 53KB