1d0ee27dc1f6247e187add8fea64dccc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
1d0ee27dc1f6247e187add8fea64dccc_JaffaCakes118
Size 347KB
Sample240506-seygsaag68
SHA256 11dbb0d25c5dbed3206c8ee321988d003c090f142b00ac97e64fc888600ddda7
MD5 1d0ee27dc1f6247e187add8fea64dccc
SHA1 579eec32750fadaf555d9b4ba058210c5406f006
SHA512 7e36189a31dd2b1e29df9435700a97c70334dc3bfa72bb3fb087f26b9753ead265f0b7f591e30f50a58cde7267923a6fa81ccbc9b850f06dc544f30718be6e3f
SSDEEP 6144:eIcKOnEJ8C8Ska8qKpekm+eVEb5D4ZZ1Xax:eWJ8st8q0m+f501Xax
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1d0ee27dc1f6247e187add8fea64dccc_JaffaCakes118

.dll 347KB

1d0ee27dc1f6247e187add8fea64dccc_JaffaCakes118

IMPHASH 0da924c88bf2c5078c6da45f83d97f5a
SHA256 11dbb0d25c5dbed3206c8ee321988d003c090f142b00ac97e64fc888600ddda7
MD5 1d0ee27dc1f6247e187add8fea64dccc
SHA1 579eec32750fadaf555d9b4ba058210c5406f006
SHA512 7e36189a31dd2b1e29df9435700a97c70334dc3bfa72bb3fb087f26b9753ead265f0b7f591e30f50a58cde7267923a6fa81ccbc9b850f06dc544f30718be6e3f
SSDEEP 6144:eIcKOnEJ8C8Ska8qKpekm+eVEb5D4ZZ1Xax:eWJ8st8q0m+f501Xax
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

36:69:f6:6f:71:19:45:6e:ef:ba:9d:5f:37:a4:82:fd:3b:6a:f1:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Exciting Apps,O=Exciting Apps,L=Philadelphia,ST=Pennsylvania,C=US

Chains

Jul 4, 2014

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Exciting Apps,O=Exciting Apps,L=Philadelphia,ST=Pennsylvania,C=US

Serial Number

53:46:82:e2:d4:42:ec:8e:a3:32:08:56:df:22:14:dc

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Mar 18, 2014 - Mar 25, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 10, 2010 - May 10, 2015

Minor OS version

Major OS version

Entry point

149573

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gdiplus

GdipDeleteBrush GdipCreateSolidFill GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCloneBrush GdipDeleteGraphics GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipFree GdipCreateHBITMAPFromBitmap GdipDeletePath GdiplusShutdown GdiplusStartup GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillPath GdipAddPathArcI GdipClosePathFigure GdipAlloc GdipCreatePath GdipCreateFromHDC GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectRectI GdipDrawImageRectI GdipFillRectangleI GdipGraphicsClear GdipSetPageUnit

wininet

InternetSetCookieW InternetGetCookieExW

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetOEMCP GetACP IsValidCodePage GetStartupInfoW GetFileType SetFilePointerEx GetConsoleMode WriteFile GetStdHandle GetModuleHandleExW ExitProcess GetCommandLineA LockResource HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadResource SizeofResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress GetVersion GlobalAlloc GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess RaiseException GetCurrentThreadId GetLastError SetLastError Sleep LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection MulDiv lstrcmpW LoadLibraryW GetModuleFileNameW GetModuleHandleA GetModuleHandleW OutputDebugStringA GetFileAttributesW DecodePointer FreeLibrary TerminateProcess CloseHandle CreateFileW InitializeCriticalSection InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls GetVersionExW lstrcmpiW LoadLibraryExW LoadLibraryA EncodePointer GetThreadLocale SetThreadLocale TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree RtlUnwind WideCharToMultiByte GetStringTypeW SetStdHandle FlushFileBuffers WriteConsoleW EnterCriticalSection

user32

GetActiveWindow GetMonitorInfoW MonitorFromPoint TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsWindowVisible CopyRect MapWindowPoints AdjustWindowRectEx GetWindowRect GetWindowDC GetMenu UpdateLayeredWindow LoadCursorW GetWindow GetClassNameW FindWindowExW GetParent GetDesktopWindow SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient ClientToScreen GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem SetWindowPos MoveWindow DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW PostMessageW SendMessageW RegisterWindowMessageW IsChild

gdi32

ExtTextOutW SetBkMode GetTextExtentPoint32W GetObjectW SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush

advapi32

RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey

ole32

CoCreateInstance CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize OleLockRunning CoTaskMemRealloc CreateStreamOnHGlobal

oleaut32

VariantChangeType SysAllocStringByteLen SysStringByteLen SysAllocString SysAllocStringLen SysFreeString VariantInit VariantClear SysStringLen LoadTypeLi LoadRegTypeLi DispCallFunc UnRegisterTypeLi OleCreateFontIndirect VariantCopy VarUI4FromStr RegisterTypeLi

shlwapi

PathFileExistsW PathAddBackslashW PathRemoveFileSpecW

urlmon

CoInternetGetSession CreateUri

Sharing

General

Malware Config

Signatures

File Explorer

1d0ee27dc1f6247e187add8fea64dccc_JaffaCakes118

PE Signature issue

gdiplus

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

urlmon

generic