General

Malware Config

Signatures

Files

• 2f40d626409e4776655b1788d851a2c2_JaffaCakes118

  .exe windows:4 windows x86 arch:x86

  de48931a0a8ee3bd9ca02f153ab871b8

  
  

  Code Sign

  da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  08-09-2020 00:00

  Not After

  08-09-2021 23:59

  Subject

  CN=Digital Capital Management Ireland Limited,OU=IT,O=Digital Capital Management Ireland Limited,POSTALCODE=W91 A6PC,STREET=2 Kerdiff Close,L=Naas,ST=Kildare,C=IE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  12-03-2019 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  01-01-2004 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  be:64:98:3e:94:cc:a0:fc:71:43:66:8b:97:39:aa:14:1c:1c:8a:a3

  Signer

  Actual PE Digest

  be:64:98:3e:94:cc:a0:fc:71:43:66:8b:97:39:aa:14:1c:1c:8a:a3

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetProcAddress

  GetVersion

  LoadLibraryA

  VirtualAlloc

  VirtualFree

  VirtualProtect

  GetModuleHandleA

  lstrcmpA

  VerLanguageNameA

  GetPrivateProfileStringW

  lstrcpy

  FindNextVolumeA

  GetThreadPriority

  SetTapePosition

  EnumCalendarInfoExA

  GetStdHandle

  GetNumaHighestNodeNumber

  FindResourceW

  CreateIoCompletionPort

  WriteProfileStringA

  PulseEvent

  LoadLibraryW

  user32

  GetWindowDC

  DisplayExitWindowsWarnings

  ImpersonateDdeClientWindow

  UnregisterMessagePumpHook

  ValidateRect

  BuildReasonArray

  DdeQueryNextServer

  DefRawInputProc

  GetMenuInfo

  LoadRemoteFonts

  GetWindowTextA

  GetCursor

  CreateWindowExW

  DrawTextA

  CallMsgFilterA

  GetCursorFrameInfo

  RegisterLogonProcess

  ToUnicode

  RegisterDeviceNotificationA

  CreatePopupMenu

  UnlockWindowStation

  TranslateAccelerator

  DefMDIChildProcW

  CloseClipboard

  SetMenuItemInfoW

  InvalidateRgn

  MessageBoxExW

  CopyRect

  gdiplus

  GdipTransformPoints

  GdipSetPathGradientSurroundColorsWithCount

  GdipAddPathClosedCurveI

  GdipSetPenMode

  GdipAddPathCurve2

  GdipCreatePath

  GdipAddPathRectangleI

  GdipBitmapGetPixel

  GdipGetPenStartCap

  GdipSetPathGradientCenterColor

  GdipGetPathGradientSurroundColorsWithCount

  GdipIsVisibleRect

  GdipCreateCachedBitmap

  GdipGetStringFormatDigitSubstitution

  GdipCreateMetafileFromStream

  GdipCreateMatrix3

  GdipGetFontCollectionFamilyList

  GdipResetPenTransform

  GdipGetPropertySize

  GdipGetMetafileHeaderFromEmf

  GdipCloneFont

  GdipDrawBezierI

  GdipCreateLineBrushFromRectWithAngleI

  GdipGetAdjustableArrowCapWidth

  GdipAddPathPolygon

  GdipGetFamilyName

  GdipAddPathStringI

  GdipResetClip

  imagehlp

  SymLoadModule64

  SymGetLineNext

  SymMatchString

  ImageAddCertificate

  SymSetSearchPath

  SymGetSymNext64

  SymInitialize

  SymGetLineFromName64

  SplitSymbols

  ImageGetDigestStream

  ImagehlpApiVersionEx

  SymGetLineFromName

  ImagehlpApiVersion

  ImageRvaToSection

  SymGetLineFromAddr

  GetImageUnusedHeaderBytes

  SymGetSymFromAddr64

  MapFileAndCheckSumW

  SymLoadModule

  SymEnumerateModules

  SymFindFileInPath

  SymEnumerateSymbols64

  ImageLoad

  ImageRemoveCertificate

  BindImage

  shell32

  RealShellExecuteExA

  StrRChrA

  StrChrW

  SHDestroyPropSheetExtArray

  SHGetFolderPathW

  SHCreateDirectoryExA

  PathMakeUniqueName

  ExtractIconW

  SHGetMalloc

  PifMgr_OpenProperties

  ILRemoveLastID

  SHGetRealIDL

  ILFindLastID

  ExtractAssociatedIconA

  DragAcceptFiles

  SHStartNetConnectionDialogW

  StrRStrIA

  SHAppBarMessage

  DragQueryFileA

  SHGetPathFromIDList

  IsLFNDrive

  SHBrowseForFolder

  SHLoadNonloadedIconOverlayIdentifiers

  oledlg

  OleUIPasteSpecialA

  OleUIChangeSourceW

  OleUICanConvertOrActivateAs

  OleUIPromptUserA

  OleUIConvertA

  OleUIChangeSourceA

  OleUIObjectPropertiesW

  OleUIChangeIconA

  OleUIObjectPropertiesA

  OleUIInsertObjectW

  OleUIAddVerbMenuW

  OleUIEditLinksA

  OleUIEditLinksW

  OleUIAddVerbMenuA

  OleUIBusyW

  OleUIBusyA

  comdlg32

  GetSaveFileNameA

  GetOpenFileNameA

  ChooseColorW

  ChooseFontW

  ReplaceTextW

  ChooseFontA

  GetFileTitleA

  GetFileTitleW

  PrintDlgW

  PageSetupDlgA

  Ssync_ANSI_UNICODE_Struct_For_WOW

  dwLBSubclass

  PrintDlgExA

  FindTextW

  PageSetupDlgW

  ReplaceTextA

  FindTextA

  LoadAlterBitmap

  version

  VerInstallFileA

  VerFindFileW

  GetFileVersionInfoSizeW

  VerQueryValueW

  VerQueryValueA

  GetFileVersionInfoSizeA

  VerFindFileA

  GetFileVersionInfoW

  oleaut32

  CreateDispTypeInfo

  VarR8Round

  VarI4FromUI2

  VarI1FromR8

  OleIconToCursor

  VarCat

  VarR8Pow

  VarDateFromUI2

  VarDecFromDate

  VarUI4FromDate

  VarCmp

  VarI4FromUI1

  SafeArrayUnaccessData

  VarDateFromI1

  VarI4FromI8

  ole32

  CoCreateObjectInContext

  OleConvertOLESTREAMToIStorage

  CoTreatAsClass

  OleInitialize

  OleDuplicateData

  GetRunningObjectTable

  CoSetState

  CoGetMarshalSizeMax

  StgConvertVariantToProperty

  CoRegisterInitializeSpy

  OleCreateFromDataEx

  CoCreateFreeThreadedMarshaler

  CLSIDFromProgIDEx

  CoSwitchCallContext

  WriteClassStm

  CoFreeLibrary

  HGLOBAL_UserFree

  HPALETTE_UserSize

  OleLoadFromStream

  CreateClassMoniker

  CoCreateInstanceEx

  IsValidIid

  HMETAFILEPICT_UserSize

  HGLOBAL_UserSize

  StgOpenPropStg

  oleacc

  LresultFromObject

  AccessibleObjectFromPoint

  AccessibleObjectFromEvent

  GetOleaccVersionInfo

  AccessibleChildren

  GetStateTextW

  CreateStdAccessibleObject

  AccessibleObjectFromWindow

  GetRoleTextA

  DllUnregisterServer

  WindowFromAccessibleObject

  DllCanUnloadNow

  GetStateTextA

  IID_IAccessible

  winspool.drv

  DeleteMonitorW

  ConfigurePortW

  AddPrinterConnectionW

  AddPortW

  AddPrinterDriverW

  SetFormA

  AddPrintProcessorA

  StartDocPrinterW

  EnumPrinterDriversA

  GetFormA

  SetJobW

  ResetPrinterW

  SetFormW

  DeletePortA

  GetPrinterW

  StartPagePrinter

  AddJobW

  EnumPrintersW

  EnumPrinterDataExA

  DEVICEMODE

  ConvertAnsiDevModeToUnicodeDevmode

  SpoolerPrinterEvent

  DeletePrinterIC

  QueryRemoteFonts

  advapi32

  RegisterTraceGuidsW

  SetThreadToken

  LsaLookupSids

  LsaSetQuotasForAccount

  LsaSetTrustedDomainInfoByName

  LsaRemovePrivilegesFromAccount

  LookupPrivilegeDisplayNameA

  ElfChangeNotify

  CredReadW

  SetPrivateObjectSecurity

  LsaGetSystemAccessAccount

  GetCurrentHwProfileA

  GetTraceEnableLevel

  RegQueryMultipleValuesW

  SetSecurityDescriptorControl

  LsaQuerySecurityObject

  RegEnumKeyExA

  LsaGetUserName

  LookupPrivilegeNameA

  SystemFunction005

  ElfReportEventW

  FreeSid

  WmiQueryGuidInformation

  Sections

  .text

  Size: 936KB - Virtual size: 936KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 93KB - Virtual size: 93KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ