3145ad76c3943ee3613d40db1440ab1d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3145ad76c3943ee3613d40db1440ab1d_JaffaCakes118
Size

249KB
MD5

3145ad76c3943ee3613d40db1440ab1d
SHA1

294789b18d84c3025bb902d66bf7fd2e08441877
SHA256

ea39b3a4a19a74ee8804b32806b795ae760939ce26058f5032cef90fef07a2af
SHA512

f2f217ee786e40a99ca301d57cc362860257e318765bb414d03ee6290c227dd2bc331b9f0c0f4e9bb5854134feb980cf4433410531cb68fe012262debeb96aa8
SSDEEP

3072:YFNkF3aNHY7RmdE18yoblGF+Xzcxg8HK2/vEgbI/d9ZkfpMOoTw7rlfSlxnF:YA9EiRmdEGyoRzVkfyDYx0

Score

1^/10

Malware Config

Signatures

Files

3145ad76c3943ee3613d40db1440ab1d_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

9715fd72bd4c153b5ac102da54983941

Code Sign

25:d6:15:b4:37:8b:a6:0b:05:81:ce:8f:98:26:ac:7a
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/09/2014, 00:00

Not After

29/11/2015, 23:59

Subject

CN=Korean Intellectual Property Office,O=Korean Intellectual Property Office,L=Seogu,ST=Daejeon,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

af:74:e7:66:b9:f6:35:1f:cc:2a:4b:af:e3:f2:72:cb:03:a0:8a:02
Signer

Actual PE Digest

af:74:e7:66:b9:f6:35:1f:cc:2a:4b:af:e3:f2:72:cb:03:a0:8a:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaFreeVar
__vbaAptOffset
__vbaLateIdCall
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaVarSetVarAddref
__vbaVarCmpNe
__vbaStrCat
ord660
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
ord591
__vbaExitProc
__vbaObjSet
ord595
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord599
ord520
__vbaBoolVar
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
__vbaVarOr
__vbaVarLateMemSt
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
__vbaStrVarVal
__vbaUbound
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
__vbaStrCopy
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
__vbaVarCmpEq
ord104
ord105
__vbaVarDup
__vbaVarLateMemCallLd
__vbaFpI4
__vbaVarCopy
ord617
__vbaLateMemCallLd
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaCastObj
__vbaStrVarCopy
ord619
_allmul
__vbaLateIdSt
_CItan
_CIexp
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr
ord581

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9715fd72bd4c153b5ac102da54983941

Code Sign

25:d6:15:b4:37:8b:a6:0b:05:81:ce:8f:98:26:ac:7aCertificate

Extended Key Usages

Key Usages

af:74:e7:66:b9:f6:35:1f:cc:2a:4b:af:e3:f2:72:cb:03:a0:8a:02Signer

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 195KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 20KB - Virtual size: 18KB

25:d6:15:b4:37:8b:a6:0b:05:81:ce:8f:98:26:ac:7a
Certificate

af:74:e7:66:b9:f6:35:1f:cc:2a:4b:af:e3:f2:72:cb:03:a0:8a:02
Signer

.text
Size: 196KB - Virtual size: 195KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 20KB - Virtual size: 18KB