29e441bee8705801b94bdc766d2a8617_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29e441bee8705801b94bdc766d2a8617_JaffaCakes118
Size

63KB
MD5

29e441bee8705801b94bdc766d2a8617
SHA1

58f65856e85e2b0ce989a792488841b1db62f808
SHA256

62c7df10615124971309e72c0046f3631c6c8e4f06487edb1d46dbe06c01ce7d
SHA512

ce1250317a859b1ded65af03b750690ee0b1f130191be61d387fcb841624251eb1937e71f191770b2a5faf6dd339ddf0faabb8e764ce8e2b8a8e94df84f7140a
SSDEEP

768:6A4lJrav2A4pWSLvbkEHBnu/AlRpzTfMxf8y3SjEQLRt:67DsZ4pWSLvb1HBu/Avtu8PjEOP

Score

1^/10

Malware Config

Signatures

Files

29e441bee8705801b94bdc766d2a8617_JaffaCakes118
.dll windows:4 windows x86 arch:x86

00a357eeac0e69f928468b833c3f169f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f5:86:d6:64:d4:ad:1f:05:52:4f:d9:b3:bc:e3:4c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/05/2012, 00:00

Not After

27/08/2015, 23:59

Subject

CN=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JINHUA 9158 NETWORK SCIENCE AND TECHNOLOGY CO.\,LTD.,L=Jinhua,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:46:92:b6:3f:b7:f8:b4:ca:18:a0:f8:a0:76:2d:aa:28:dd:13:05
Signer

Actual PE Digest

2c:46:92:b6:3f:b7:f8:b4:ca:18:a0:f8:a0:76:2d:aa:28:dd:13:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord801
ord518
ord541
ord1187
ord3584
ord803
ord537
ord6648
ord6883
ord4129
ord924
ord535
ord5608
ord2820
ord1200
ord939
ord941
ord5572
ord2919
ord543
ord3811
ord3337
ord354
ord5186
ord1979
ord665
ord2915
ord860
ord5683
ord4278
ord858
ord2818
ord825
ord540
ord800
ord1182
ord823
ord342
ord1253
ord2764
ord1168

msvcrt

_initterm
free
??1type_info@@UAE@XZ
_onexit
__dllonexit
_snprintf
_mbscmp
strncpy
_mbsnbcpy
malloc
rand
_CxxThrowException
fprintf
fopen
_purecall
sprintf
__CxxFrameHandler
exit
_adjust_fdiv
time
fgets
strchr
strstr
fclose
atoi
_strupr

kernel32

CreateThread
GetExitCodeThread
WaitForSingleObject
OutputDebugStringA
GetTickCount
EnterCriticalSection
GetProcAddress
GetLastError
LoadLibraryA
InitializeCriticalSection
LeaveCriticalSection
FreeLibrary
DeleteCriticalSection
Sleep
GetFileAttributesA
GetModuleFileNameA

user32

SendMessageA
PostMessageA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

msvcp60

??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ

ws2_32

WSAResetEvent
gethostbyname
WSACreateEvent
WSACleanup
WSAStartup
inet_ntoa
inet_addr
WSASetEvent
htons

Exports

Exports

CreateLobbyClient

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00a357eeac0e69f928468b833c3f169f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

1a:f5:86:d6:64:d4:ad:1f:05:52:4f:d9:b3:bc:e3:4cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2c:46:92:b6:3f:b7:f8:b4:ca:18:a0:f8:a0:76:2d:aa:28:dd:13:05Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

msvcp60

ws2_32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 30KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 900B

.rsrc Size: 4KB - Virtual size: 872B

.reloc Size: 4KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

1a:f5:86:d6:64:d4:ad:1f:05:52:4f:d9:b3:bc:e3:4c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2c:46:92:b6:3f:b7:f8:b4:ca:18:a0:f8:a0:76:2d:aa:28:dd:13:05
Signer

.text
Size: 32KB - Virtual size: 30KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 900B

.rsrc
Size: 4KB - Virtual size: 872B

.reloc
Size: 4KB - Virtual size: 2KB