14e50f78c1f5b33a82b4d5b1ea72c5bb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

14e50f78c1f5b33a82b4d5b1ea72c5bb_JaffaCakes118
Size

576KB
MD5

14e50f78c1f5b33a82b4d5b1ea72c5bb
SHA1

8c69b931af6eee5ce90a5c035d2066dc4b5dc9a2
SHA256

443ac413a49c0b13844f482a637f0892e7d8d26d3379df1bf7591f5c0730a323
SHA512

a41e3eafd30e8deed80a3c909e1496b0f297985d78ed35a24898af8b2e99b8313e5d7c2da5016a9b9591687fef533891fe5111aa058e452b219d589e612fa766
SSDEEP

12288:/yp50B7r2HwkHznt0681aHM2ehM1WWwyTJa:e47fxqIOTE

Score

1^/10

Malware Config

Signatures

Files

14e50f78c1f5b33a82b4d5b1ea72c5bb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8c030ff5292c45eabe865670371df8ea

Code Sign

7f:9b:9c:37:ca:d6:bb:bd:3f:c6:05:4f:3d:4f:c9:7a
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20/10/2014, 00:00

Not After

20/10/2015, 23:59

Subject

CN=Radon Battery Technologies,O=Radon Battery Technologies,POSTALCODE=2025,STREET=Dasoupoli Strovolos+STREET=Athinodorou 3,L=Nicosia,ST=Cyprus,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:ef:38:03:bb:31:ca:44:78:e3:e4:1e:fc:26:08:a3:33:7c:b2:40
Signer

Actual PE Digest

bb:ef:38:03:bb:31:ca:44:78:e3:e4:1e:fc:26:08:a3:33:7c:b2:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

wininet

InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetSetOptionA
InternetConnectA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA

ws2_32

inet_ntoa
gethostbyname
WSAStartup
WSACleanup

kernel32

SizeofResource
FindClose
CloseHandle
GetTimeZoneInformation
GetTickCount
PeekNamedPipe
GetMailslotInfo
GetModuleFileNameA
FindResourceW
FindResourceExW
GetDiskFreeSpaceA
CreateFileA
DeleteFileA
FindFirstFileA
FindNextFileA
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
GetFileSize
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
GetSystemTimeAsFileTime
LoadLibraryA
ExpandEnvironmentStringsA
GetFileAttributesA
GetFileType
FreeLibrary
GetCurrentProcess
TerminateProcess
GetVersion
GetModuleHandleA
GetVersionExA
CreateMutexA
OpenMutexA
LocalFree
SetLastError
LocalAlloc
InterlockedIncrement
GlobalAlloc
GlobalLock
GlobalUnlock
FlushInstructionCache
RaiseException
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MulDiv
LoadResource
InitializeCriticalSection
GlobalHandle
GlobalFree
lstrcmpiA
LoadLibraryExA
FindResourceA
IsDBCSLeadByte
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineA
LoadLibraryExW
ExitThread
IsDebuggerPresent
VirtualQuery
VirtualProtect
GetSystemInfo
RtlUnwind
GetStringTypeW
EncodePointer
lstrlenA
DecodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
Sleep
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
GetLastError
OpenThread
CreateThread
LockResource
InterlockedDecrement
GetConsoleMode
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
LoadLibraryW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
IsValidCodePage
GetACP
GetOEMCP
GetConsoleCP
SetFilePointerEx
SetStdHandle
WriteConsoleW
CreateFileW
ReadConsoleW
SetEnvironmentVariableA
lstrcmpA

user32

PeekMessageA
CreateDialogIndirectParamA
IsWindowVisible
FindWindowExA
DispatchMessageA
TranslateMessage
GetMessageA
MapDialogRect
SetWindowContextHelpId
KillTimer
SetTimer
SendDlgItemMessageA
EndDialog
GetMonitorInfoA
MonitorFromWindow
IsDialogMessageA
LoadCursorA
GetWindow
GetDesktopWindow
SetWindowLongA
GetWindowLongA
FillRect
GetSysColor
MapWindowPoints
ScreenToClient
ClientToScreen
GetWindowRect
GetClientRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableA
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextA
GetDlgItem
MoveWindow
DestroyWindow
IsChild
CreateWindowExA
GetClassInfoExA
RegisterClassExA
CallWindowProcA
PostQuitMessage
DefWindowProcA
SendMessageA
RegisterWindowMessageA
SystemParametersInfoA
GetWindowThreadProcessId
GetClassNameA
FindWindowA
GetParent
MessageBoxA
AllowSetForegroundWindow
SetForegroundWindow
GetForegroundWindow
keybd_event
GetKeyboardState
BringWindowToTop
SetWindowPos
IsWindow
AttachThreadInput
PostMessageA
UnregisterClassA
BeginPaint

gdi32

GetObjectA
SelectObject
GetStockObject
GetDeviceCaps
DeleteDC
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC

advapi32

RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegEnumValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
OpenProcessToken
RegCloseKey

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoCreateInstance
CLSIDFromProgID
CoGetClassObject
CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemRealloc

oleaut32

SysStringLen
VariantInit
VariantClear
VariantChangeType
LoadTypeLi
SysFreeString
OleCreateFontIndirect
DispCallFunc
VarUI4FromStr
VariantCopy
SysAllocStringLen
LoadRegTypeLi
SysAllocString

comctl32

InitCommonControlsEx

Sections

.text
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c030ff5292c45eabe865670371df8ea

Code Sign

7f:9b:9c:37:ca:d6:bb:bd:3f:c6:05:4f:3d:4f:c9:7aCertificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

bb:ef:38:03:bb:31:ca:44:78:e3:e4:1e:fc:26:08:a3:33:7c:b2:40Signer

Headers

DLL Characteristics

File Characteristics

Imports

version

wininet

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

Sections

.text Size: 452KB - Virtual size: 451KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 11KB - Virtual size: 24KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 8KB - Virtual size: 7KB

7f:9b:9c:37:ca:d6:bb:bd:3f:c6:05:4f:3d:4f:c9:7a
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

bb:ef:38:03:bb:31:ca:44:78:e3:e4:1e:fc:26:08:a3:33:7c:b2:40
Signer

.text
Size: 452KB - Virtual size: 451KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 11KB - Virtual size: 24KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 8KB - Virtual size: 7KB