121b20aee0879c08b157f657b2d272b0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

121b20aee0879c08b157f657b2d272b0_JaffaCakes118
Size

242KB
MD5

121b20aee0879c08b157f657b2d272b0
SHA1

5c24eb2bb6e943577891e12b28ea3095bd088c02
SHA256

4f34e13d84c17d3256de56c7f0b0b3977d9a7b7503215952f68cac5db3b029ad
SHA512

24a2da67897b42a11878ea95ed89ca7d348f00887109e891a492e86fffc7ccc98d1489b313a16e9bf26cd5327cf70cca6ab8c7950708feb4106343ea859f478d
SSDEEP

6144:h+M3sle/af1irTedPEm3Gbw489nasHhsuf:h+WsMO1tFEm3T489nasBxf

Score

1^/10

Malware Config

Signatures

Files

121b20aee0879c08b157f657b2d272b0_JaffaCakes118
.dll windows:6 windows x86 arch:x86

f62703f3be4a59d359a62952d431248f

Code Sign

3d:56:ba:23:44:98:c1:5c:23:83:f5:f9:9e:6d:e0:73
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

01/06/2015, 00:00

Not After

31/05/2016, 23:59

Subject

CN=MOSCOW COMPANY,O=MOSCOW COMPANY,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bf:ce:db:3f:eb:29:21:79:67:9d:3f:93:b7:c5:ff:a4:0e:4b:2a:e5
Signer

Actual PE Digest

bf:ce:db:3f:eb:29:21:79:67:9d:3f:93:b7:c5:ff:a4:0e:4b:2a:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sqlite3

sqlite3_file_control
sqlite3_reset
sqlite3_finalize
sqlite3_column_int
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_bind_text
sqlite3_bind_int
sqlite3_bind_blob
sqlite3_prepare_v2
sqlite3_open
sqlite3_free
sqlite3_mprintf
sqlite3_busy_timeout
sqlite3_exec
sqlite3_close

nssutil3

SECOID_GetAlgorithmTag_Util
PORT_Alloc_Util
PORT_Free_Util
PORT_SetError_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
PORT_NewArena_Util
PORT_ArenaZAlloc_Util
SECITEM_CopyItem_Util
PORT_ZAlloc_Util
SECITEM_CompareItem_Util
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgGetLabel
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_ArgFetchValue
_NSSUTIL_EvaluateConfigDir
PORT_Strdup_Util
SECOID_FindOIDByMechanism
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
DER_Encode_Util
_SGN_VerifyPKCS1DigestInfo
NSS_Get_SEC_OctetStringTemplate_Util
SEC_QuickDERDecodeItem_Util
_NSSUTIL_GetSecmodName
NSSUTIL_DoModuleDBFunction
UTIL_SetForkState
SECOID_Shutdown
SECOID_Init
DER_SetUInteger
SECITEM_HashCompare
PORT_ArenaAlloc_Util
PORT_GetError_Util
PORT_ArenaGrow_Util
PORT_Realloc_Util
SECOID_DestroyAlgorithmID_Util
PORT_ZFree_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
DER_GetInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1DecodeItem_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_DupItem_Util
SECITEM_AllocItem_Util
PORT_FreeArena_Util

plc4

PL_strncasecmp
PL_strcasecmp

plds4

PL_NewHashTable
PL_HashTableDestroy
PL_HashTableAdd
PL_HashTableRemove
PL_HashTableLookup
PL_HashTableLookupConst
PL_CompareValues
PL_HashTableEnumerateEntries

nspr4

PR_CallOnce
PR_SetError
PR_Free
PR_snprintf
PR_GetEnv
PR_LoadLibraryWithFlags
PR_UnloadLibrary
PR_FindFunctionSymbol
PR_GetLibraryFilePathname
PR_Lock
PR_Unlock
PR_GetDirectorySeparator
PR_SecondsToInterval
PR_NewLock
PR_DestroyLock
PR_Sleep
PR_smprintf_free
PR_IntervalNow
PR_MillisecondsToInterval
PR_GetCurrentThread
PR_Now
PR_Access
PR_NewMonitor
PR_DestroyMonitor
PR_EnterMonitor
PR_ExitMonitor
PR_smprintf

kernel32

SetFileAttributesW
GetFileAttributesExW
CloseHandle
CreateFileW
FlushFileBuffers
HeapSize
WriteConsoleW
SetStdHandle
HeapReAlloc
OutputDebugStringW
LoadLibraryExW
RtlUnwind
SetEnvironmentVariableA
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
CompareStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetModuleFileNameW
WriteFile
GetStdHandle
GetProcessHeap
AreFileApisANSI
GetModuleHandleExW
ExitProcess
WideCharToMultiByte
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DecodePointer
EncodePointer
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MultiByteToWideChar
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapFree
GetLastError
IsProcessorFeaturePresent
IsDebuggerPresent
GetTempPathA

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

Sections

.text
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f62703f3be4a59d359a62952d431248f

Code Sign

3d:56:ba:23:44:98:c1:5c:23:83:f5:f9:9e:6d:e0:73Certificate

Extended Key Usages

Key Usages

bf:ce:db:3f:eb:29:21:79:67:9d:3f:93:b7:c5:ff:a4:0e:4b:2a:e5Signer

Headers

DLL Characteristics

File Characteristics

Imports

sqlite3

nssutil3

plc4

plds4

nspr4

kernel32

Exports

Exports

Sections

.text Size: 184KB - Virtual size: 184KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 808B

.reloc Size: 9KB - Virtual size: 9KB

3d:56:ba:23:44:98:c1:5c:23:83:f5:f9:9e:6d:e0:73
Certificate

bf:ce:db:3f:eb:29:21:79:67:9d:3f:93:b7:c5:ff:a4:0e:4b:2a:e5
Signer

.text
Size: 184KB - Virtual size: 184KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 808B

.reloc
Size: 9KB - Virtual size: 9KB