10ea66306a0d4a862b1be7407627113f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
10ea66306a0d4a862b1be7407627113f_JaffaCakes118
Size 1.8MB
Sample240503-tp1wbsdf85
SHA256 a05cdf9cbfb06e7f9e5a7ef45df729ea31912bad30fc5534232c6f4f3ed95d08
MD5 10ea66306a0d4a862b1be7407627113f
SHA1 158a90ae4b5374975b75e86e1c88c4a234616904
SHA512 9e3e83b12d3bde88eb92382f10dfe2ebbd9baf2b9caf88c64d88d8a044b2b3c1861c1603b7ad30cc5564f32d122647e178a42fac410a515265450df8180041f9
SSDEEP 49152:OvMW2NU1HlwupfJT4QAXQmH5nb80q5VWy7EeNW:O0hNOFwuPAXQmH5noPtQAW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

10ea66306a0d4a862b1be7407627113f_JaffaCakes118

.exe 1.8MB

10ea66306a0d4a862b1be7407627113f_JaffaCakes118

IMPHASH daf574f3040b477b1ee15e12a0c73af8
SHA256 a05cdf9cbfb06e7f9e5a7ef45df729ea31912bad30fc5534232c6f4f3ed95d08
MD5 10ea66306a0d4a862b1be7407627113f
SHA1 158a90ae4b5374975b75e86e1c88c4a234616904
SHA512 9e3e83b12d3bde88eb92382f10dfe2ebbd9baf2b9caf88c64d88d8a044b2b3c1861c1603b7ad30cc5564f32d122647e178a42fac410a515265450df8180041f9
SSDEEP 49152:OvMW2NU1HlwupfJT4QAXQmH5nb80q5VWy7EeNW:O0hNOFwuPAXQmH5noPtQAW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d8:b4:99:e6:ec:11:bb:1c:3c:7f:20:e7:3b:c6:1e:87:b9:15:31:6e:86:f6:02:59:5e:c6:5b:c2:10:9c:9f:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Chains

May 5, 2016

PE Signature issue

Digest

56:4e:56:97:00:f3:68:41:20:b8:b3:b3:b7:86:d5:ac:c7:3e:0e:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Chains

May 5, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Serial Number

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Oct 29, 2014 - Dec 27, 2016

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Serial Number

0e:9b:a4:4e:f6:f3:8d:46:6f:03:b8:51:56:e1:8f:82

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 22, 2016 - Dec 27, 2016

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:16:c0:09:98:dc:c6:8f:a2:7d:25:c3:86:36:a8:83:bb

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 3, 2015 - Mar 3, 2026

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

888832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtectEx GetLastError CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW SetFilePointer CreateFileA ExitProcess GetLocalTime MultiByteToWideChar SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA GetPrivateProfileStringA EnterCriticalSection DeleteFileA MoveFileA CreateProcessA GetStartupInfoA GetCommandLineA GetCurrentThreadId ReadFile GetFileSize GetProcessHeap FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation LoadLibraryW FreeLibrary SetConsoleCtrlHandler FatalAppExitA IsValidCodePage GetOEMCP GetACP QueryPerformanceCounter HeapDestroy HeapCreate GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetLocaleInfoW GetStdHandle WriteFile IsProcessorFeaturePresent CompareStringW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo LCMapStringW HeapAlloc GetDateFormatA GetTimeFormatA GetModuleHandleW HeapFree GetSystemTimeAsFileTime GetStartupInfoW RaiseException RtlUnwind ReadProcessMemory LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx CreateEventA SetEvent CloseHandle GetModuleHandleA WritePrivateProfileStringA GetCommandLineW FormatMessageA LocalFree InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange DeleteCriticalSection SetEndOfFile SetFilePointerEx CreateFileW FindClose RemoveDirectoryW DeleteFileW DeviceIoControl GetFullPathNameW FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryExW CopyFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileInformationByHandle GetFileAttributesExW GetFileTime SetFileTime MoveFileExW GetDiskFreeSpaceExW CreateDirectoryW AreFileApisANSI

user32

BeginPaint EndPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA DialogBoxParamA GetWindowTextLengthA GetWindowTextA SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage UnpackDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow SendMessageA SetPropA EnumThreadWindows GetPropA WaitForInputIdle SetTimer GetMessageA TranslateMessage DispatchMessageA MessageBoxA FreeDDElParam

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

comdlg32

GetOpenFileNameA GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

Name

.text

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

756KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

132KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

896KB

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10ea66306a0d4a862b1be7407627113f_JaffaCakes118

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

shell32

generic