2fc1961913414ef5453945a923d95ecd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2fc1961913414ef5453945a923d95ecd_JaffaCakes118
Size

123KB
MD5

2fc1961913414ef5453945a923d95ecd
SHA1

0a61ccaff598a2923c67ccb8e97e30dca61073b1
SHA256

906e1a566a3ab87e3158ffbaffa09ac8917ed41c1e53a8df45ca6d87d0bf7c0d
SHA512

9a887c947411015f6b0b8e4154f67780724c35128536526cd0c50fdc7cff5205b16591769972b651a966c30261e8daa163493899fc38adf930deb376bad2e4dd
SSDEEP

3072:98JJKD8yGGpqeHScU+qHARolZKarmTAu1gX0e7Uj+7GcLmW:98P/HprjgCEA/1ZG6mW

Score

1^/10

Malware Config

Signatures

Files

2fc1961913414ef5453945a923d95ecd_JaffaCakes118
.zip
windowstab_uc.exe
.exe windows:4 windows x86 arch:x86

7275f1df6395b218cbd51e227d002cc6

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:a6:83:fe:84:27:fd:3b:e9:fd:80:53:5a:e9:4d:79
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

24/03/2014, 00:00

Not After

23/05/2015, 23:59

Subject

CN=DOTPITCH.INC,OU=IT Team,O=DOTPITCH.INC,L=Gangnam,ST=SEOUL,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/02/2015, 00:00

Not After

03/03/2026, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:df:0b:e5:dc:ff:7f:d2:77:27:96:29:a2:da:9e:ff:f9:d0:0c:84
Signer

Actual PE Digest

69:df:0b:e5:dc:ff:7f:d2:77:27:96:29:a2:da:9e:ff:f9:d0:0c:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
lstrcmpiA
WriteFile
CreateFileA
CreateDirectoryA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
GetCurrentDirectoryA
WideCharToMultiByte
GetPrivateProfileStringA
GetVersionExA
GetVersion
CreateProcessA
GetExitCodeProcess
GetProcAddress
GetModuleHandleA
Process32Next
GetCurrentProcessId
OpenProcess
Process32First
CreateToolhelp32Snapshot
SetLastError
CreateRemoteThread
DuplicateHandle
DeviceIoControl
GetFileSize
FindClose
FindFirstFileA
RemoveDirectoryA
FindNextFileA
SetFileAttributesA
GetTempFileNameA
GetModuleFileNameA
FreeLibrary
LoadLibraryA
TerminateProcess
LoadLibraryExA
Sleep
SetEnvironmentVariableA
CompareStringW
lstrcpyA
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
FlushFileBuffers
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetStdHandle
GetStdHandle
SetHandleCount
SetFilePointer
ReadFile
SetEndOfFile
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapReAlloc
RaiseException
ExitProcess
GetCommandLineA
GetStartupInfoA
GetFileType
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapAlloc
HeapFree
RtlUnwind
LocalFree
GetFullPathNameA
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
lstrcmpA
lstrlenW
CloseHandle
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
lstrlenA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
CopyFileA
DeleteFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
CreateMutexA
GetLastError
CreateEventA
WaitForSingleObject
CompareStringA

user32

RegisterWindowMessageA
GetClassInfoExA
GetWindowTextLengthA
RegisterClassExA
GetWindowLongA
GetWindowTextA
SetWindowTextA
SetWindowLongA
DefWindowProcA
LoadCursorA
FindWindowA
EnumChildWindows
FindWindowExA
GetWindow
CallWindowProcA
GetSysColor
SetFocus
GetFocus
IsChild
ReleaseDC
GetDC
EndPaint
FillRect
BeginPaint
GetClientRect
GetWindowThreadProcessId
GetWindowRect
SystemParametersInfoA
MapWindowPoints
PeekMessageA
TranslateMessage
DispatchMessageA
GetDlgItem
SendMessageA
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
wsprintfA
CreateWindowExA
DestroyWindow
CreateAcceleratorTableA
GetDesktopWindow
GetParent
GetClassNameA
RedrawWindow
SetWindowPos
IsWindow

gdi32

DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteDC
GetDeviceCaps
CreateSolidBrush
GetObjectA
GetStockObject
BitBlt

advapi32

RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
OpenServiceA
CreateServiceA
OpenSCManagerA
CloseServiceHandle
QueryServiceStatus
ChangeServiceConfig2A
RegEnumKeyExA

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CLSIDFromString
CoCreateGuid
CoUninitialize
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
OleLockRunning
CLSIDFromProgID
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
OleCreateFontIndirect
SysAllocStringLen
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString

urlmon

URLDownloadToFileA

wininet

InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetQueryDataAvailable
DeleteUrlCacheEntry

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 212KB - Virtual size: 209KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7275f1df6395b218cbd51e227d002cc6

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

16:a6:83:fe:84:27:fd:3b:e9:fd:80:53:5a:e9:4d:79Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03Certificate

Extended Key Usages

Key Usages

69:df:0b:e5:dc:ff:7f:d2:77:27:96:29:a2:da:9e:ff:f9:d0:0c:84Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

wininet

iphlpapi

Sections

.text Size: 212KB - Virtual size: 209KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 24KB - Virtual size: 36KB

.rsrc Size: 4KB - Virtual size: 680B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

16:a6:83:fe:84:27:fd:3b:e9:fd:80:53:5a:e9:4d:79
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

11:21:06:a0:81:d3:3f:d8:7a:e5:82:4c:c1:6b:52:09:4e:03
Certificate

69:df:0b:e5:dc:ff:7f:d2:77:27:96:29:a2:da:9e:ff:f9:d0:0c:84
Signer

.text
Size: 212KB - Virtual size: 209KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 24KB - Virtual size: 36KB

.rsrc
Size: 4KB - Virtual size: 680B