2601b8650a3c21e99e77b0c70dd976cd_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2601b8650a3c21e99e77b0c70dd976cd_JaffaCakes118
Size

2.1MB
MD5

2601b8650a3c21e99e77b0c70dd976cd
SHA1

e015b83443ff1bb2d550c4392d7095d602b1d9f2
SHA256

fefaf79d95f6aeaa2a16c12d8b1bfb453017febc396ffe879ecb7d05abb0247b
SHA512

1f25e7e7ed899c811f732bb9d94be7cda69c4bfbe8a683fda10a83e114e19d4d8fee76e2573b321071ce7016880aaa283ee586fa344828c6c326ae9a7d85b105
SSDEEP

49152:5SQ6pF2spI404sBC0e1Ic+zJTfcTykyML8wq8e2+D2:5cF2p+sw91IH5EyYci

Score

1^/10

Malware Config

Signatures

Files

2601b8650a3c21e99e77b0c70dd976cd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e32f3ec4dbc582054beb058be5e2c8c6

Code Sign

ef:86:5b:35:33:6e:45:2a:58:0e:ca:5b:e0:a4:01:2c
Certificate

Issuer

CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV

Not Before

10-08-2020 00:00

Not After

10-08-2021 23:59

Subject

CN=Proektnij ofis cifrovoj transformacii LLC,O=Proektnij ofis cifrovoj transformacii LLC,POSTALCODE=620107,STREET=ulica Geroev Rossii\, dom 2\, pomeshhenie 20,L=Ekaterinburg,ST=Sverdlovskaja oblast,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:6e:54:ff:9f:9c:e0:f8:ea:cb:e7:a0:ab:56:9d:32
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

06-09-2018 00:00

Not After

05-09-2028 23:59

Subject

CN=GoGetSSL RSA Codesigning CA,O=GoGetSSL,L=Riga,C=LV

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:d3:9a:4b:84:bb:69:03:75:97:0d:87:78:ab:94:2f:e1:0f:f6:fe
Signer

Actual PE Digest

51:d3:9a:4b:84:bb:69:03:75:97:0d:87:78:ab:94:2f:e1:0f:f6:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BUILDMACHINE\TESTMACHINE\MODULES\NEWINSTALLERMODULE\Builders\Thread_1\Release\3cb2c8e06bc0c42e4a88.pdb

Imports

ole32

OleLockRunning
OleCreate
OleSetContainedObject
StringFromCLSID
OleUninitialize
CoInitializeEx
OleInitialize
CoTaskMemFree
CoCreateGuid

winhttp

WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertGetNameStringW
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyRevocation
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CryptDecodeObjectEx
PFXImportCertStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertAddCertificateContextToStore
CertAddStoreToCollection
CertOpenSystemStoreW

kernel32

FindClose
UnmapViewOfFile
GetFileAttributesA
CreateFileA
LockResource
GlobalFree
CloseHandle
LoadResource
FindResourceW
CreateFileMappingW
MapViewOfFile
CreateMutexW
CreateProcessW
GetExitCodeProcess
FindFirstFileW
DeleteFileW
GetFileSize
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetVolumeInformationW
GetSystemDirectoryW
LocalFree
GetComputerNameW
GetDiskFreeSpaceExW
QueryPerformanceFrequency
GetProcAddress
GetModuleHandleW
GlobalMemoryStatus
GetSystemWindowsDirectoryW
QueryPerformanceCounter
MulDiv
ExitProcess
GetTempPathW
GetFileAttributesExW
LoadLibraryW
GetLongPathNameW
ExpandEnvironmentStringsW
GetCurrentDirectoryW
WideCharToMultiByte
SetEndOfFile
SetFilePointer
SizeofResource
CreateDirectoryW
RemoveDirectoryW
CreateFileW
GetFileAttributesW
DeleteCriticalSection
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetVersionExA
FindNextFileW
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
FreeLibrary
SetLastError
GetConsoleCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileSizeEx
HeapFree
WriteFile
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
InterlockedPushEntrySList
IsValidLocale
RtlUnwind
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetModuleFileNameW
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
DecodePointer
RaiseException
CopyFileA
InitializeCriticalSectionAndSpinCount
CreateThread
WaitForSingleObject
GetVersionExW
ReleaseMutex
Sleep
CreateDirectoryA
MultiByteToWideChar
GetConsoleMode
HeapAlloc
GetLastError
TlsGetValue
TlsAlloc
SwitchToThread
GetStringTypeW
CreateMutexA
GetTempPathA
FindFirstFileA
GetDateFormatW
GetTimeFormatW
WriteConsoleW
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapSize
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID

user32

GetWindowLongW
SetWindowLongW
ReleaseDC
GetDC
SetRect
DefWindowProcW
PostQuitMessage
MessageBoxW
EnableMenuItem
BeginPaint
SetActiveWindow
BringWindowToTop
SetFocus
SetForegroundWindow
GetSystemMetrics
SetWindowPos
SetMenu
ShowWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
GetSystemMenu
DestroyWindow
SendMessageW
EndPaint
UpdateWindow

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ConvertSidToStringSidW
LookupAccountNameW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership

shell32

ShellExecuteA

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

shlwapi

PathFileExistsA

wsock32

ioctlsocket
socket
shutdown
setsockopt
sendto
send
recvfrom
recv
listen
getsockopt
ntohl
getpeername
inet_ntoa
connect
closesocket
bind
accept
ntohs
htons
WSACleanup
WSAStartup
WSAGetLastError
select
__WSAFDIsSet
getsockname

ws2_32

getaddrinfo
freeaddrinfo
getnameinfo

gdi32

GetDeviceCaps

Exports

Exports

_Abrwgfiuq@36
_diqjodihqod@12
_dqbquiiqgq@16
_dqhwioqhdoiqdghqiu@12
_dugqyudvbqbkdq@16
_gqgigbuifqiufq@16
_hguiqgdqld@12
_ihdoqhdoiq@12
_iohqobqbqocqoq@4
_jwqdiuqgdiuq@12
_kodioqhdq@16
_mdlqkndoiq@28
_nenvijwbviwq@16
_nlkwqdjqbiduq@16
_qdqohdoqddq@16
_qhdoqdoqdqj@12
_ugiqgdiqbqdd@12
_yeywbelqnlqnf@12

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 338KB - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 638KB - Virtual size: 637KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e32f3ec4dbc582054beb058be5e2c8c6

Code Sign

ef:86:5b:35:33:6e:45:2a:58:0e:ca:5b:e0:a4:01:2cCertificate

Extended Key Usages

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1a:6e:54:ff:9f:9c:e0:f8:ea:cb:e7:a0:ab:56:9d:32Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

51:d3:9a:4b:84:bb:69:03:75:97:0d:87:78:ab:94:2f:e1:0f:f6:feSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

winhttp

crypt32

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

wsock32

ws2_32

gdi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 338KB - Virtual size: 338KB

.data Size: 26KB - Virtual size: 38KB

.rsrc Size: 638KB - Virtual size: 637KB

.reloc Size: 67KB - Virtual size: 66KB

ef:86:5b:35:33:6e:45:2a:58:0e:ca:5b:e0:a4:01:2c
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1a:6e:54:ff:9f:9c:e0:f8:ea:cb:e7:a0:ab:56:9d:32
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

51:d3:9a:4b:84:bb:69:03:75:97:0d:87:78:ab:94:2f:e1:0f:f6:fe
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 338KB - Virtual size: 338KB

.data
Size: 26KB - Virtual size: 38KB

.rsrc
Size: 638KB - Virtual size: 637KB

.reloc
Size: 67KB - Virtual size: 66KB