323b1b690436eab7716863196314f0f7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

323b1b690436eab7716863196314f0f7_JaffaCakes118
Size

322KB
MD5

323b1b690436eab7716863196314f0f7
SHA1

2035765319ac195fa2bdb4168e3099a0b0c70846
SHA256

14e5a5bcec1e4c302b88b9bc0473e41ad45e420a3809184796984333c1c79834
SHA512

9f6eb3f501332fa65383a5dfe6ba6e546130c326870a23dc2b3095c7b21ac5fcd1c81adf54e25d66268f082f6b5675bd476368db12ac4a611609d3c40887aa61
SSDEEP

6144:DHCPV552mF9TdJj+ukn5AgCl4kXWqaCTuAamcicvyiM4D8KrpQxnCfuVLz:TyV552mF9J4jGjDczbm2VDSCmVLz

Score

1^/10

Malware Config

Signatures

Files

323b1b690436eab7716863196314f0f7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ac1b74efc3fddb0114adb60865f2a1cb

Code Sign

1f:f6:d9:ed:57:4e:c2:a0:99:38:9b:4b:de:6c:6d:c4
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/02/2015, 00:00

Not After

25/02/2016, 23:59

Subject

CN=Consortium Group ltd,O=Consortium Group ltd,POSTALCODE=00152,STREET=CORNER OF GR.MARLBOROUGH UN GR.GEORGE STR.+STREET=3RD FLOOR\, C&h TOWERS\,,L=ROSEAU,ST=ROSEAU,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

af:0a:bc:4f:62:21:6a:9f:bb:31:fd:d0:f7:90:61:ca:29:7d:fa:da
Signer

Actual PE Digest

af:0a:bc:4f:62:21:6a:9f:bb:31:fd:d0:f7:90:61:ca:29:7d:fa:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

VerQueryValueW

wininet

HttpEndRequestA

kernel32

WriteFile
GetTickCount
VirtualAlloc
CreateFileA
ReadFile
GetLastError
CreateFileMappingA
InterlockedDecrement
FreeLibrary
FindResourceA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
CreateEventA
CompareStringA
CloseHandle
QueryPerformanceCounter
CreateThread
GetCommandLineW
SetFilePointer
FlushFileBuffers
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapFree
GetSystemTimeAsFileTime
GetVersion
GetCurrentThreadId
GetModuleHandleW
SetErrorMode
ExitProcess
TlsGetValue
GetModuleHandleA
GetVersionExA
GetStartupInfoA
GetProcAddress
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
GetStringTypeW
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
DeleteFileW

user32

IsDialogMessageA
IsChild
InvalidateRect
GetWindowLongA
GetSystemMenu
PtInRect
IsIconic
IsRectEmpty
IsWindow
RemovePropA
SetMenu
SetMenuItemInfoA
GetClassNameA
GetClassInfoA
GetCapture
CreateWindowExA
MessageBoxA
GetKeyboardType
LoadStringA
CharNextA
ShowWindow
RegisterClipboardFormatA
GetSystemMetrics
SetPropA
SetRect
SetScrollInfo
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
IntersectRect
IsWindowEnabled
IsWindowVisible
IsZoomed
GetClientRect
RegisterClassExA
CreateDialogParamA
GetScrollPos

gdi32

GetLogColorSpaceW
ExcludeClipRect
DeleteObject
SetAbortProc
CreatePenIndirect
GetClipBox
TextOutW
DeleteMetaFile
OffsetWindowOrgEx
CreateFontIndirectA
DeleteEnhMetaFile
Rectangle
CreatePen

comdlg32

GetOpenFileNameA
ChooseFontA
ReplaceTextW
FindTextW
GetSaveFileNameA

advapi32

GetUserNameA
AllocateAndInitializeSid
RegCloseKey
RegSetValueExW

shell32

ShellExecuteA
StrStrIA

ole32

CoInitialize
CoUninitialize

oleaut32

VariantInit
VarRound
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayPutElement
SysAllocStringLen
SysReAllocStringLen
SysFreeString

Sections

.text
Size: 268KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac1b74efc3fddb0114adb60865f2a1cb

Code Sign

1f:f6:d9:ed:57:4e:c2:a0:99:38:9b:4b:de:6c:6d:c4Certificate

Extended Key Usages

Key Usages

af:0a:bc:4f:62:21:6a:9f:bb:31:fd:d0:f7:90:61:ca:29:7d:fa:daSigner

Headers

File Characteristics

Imports

comctl32

version

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 268KB - Virtual size: 265KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 28KB - Virtual size: 26KB

1f:f6:d9:ed:57:4e:c2:a0:99:38:9b:4b:de:6c:6d:c4
Certificate

af:0a:bc:4f:62:21:6a:9f:bb:31:fd:d0:f7:90:61:ca:29:7d:fa:da
Signer

.text
Size: 268KB - Virtual size: 265KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 28KB - Virtual size: 26KB