342b6eafbc9f18889a492925a33a2cc5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
342b6eafbc9f18889a492925a33a2cc5_JaffaCakes118
Size 18.1MB
Sample240511-mrr8msfg35
SHA256 90263f5e0ceee73af6ee6ca4dac8e6441c1f5c39607512a954e42887a5a0bb3a
MD5 342b6eafbc9f18889a492925a33a2cc5
SHA1 041fcba34d990603fd63074394c40243312a4dfe
SHA512 d58819cad03fb0625129dd3a7fc3846ead1e028944b6516af8f3ca0261c2619ebda78be0a6f3d4cf87b03556fd10d5d49f695ce829997128d0eee115ebec4da7
SSDEEP 393216:Xm4I12ZQV+9llWqi0a2jVbHp5hAK0w5sXQr+xP9fPACdObQvnQ9ScGnCRByGz/O3:Xm4IcZMQWqzVbpb0IsXQ89npOE1crzm3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx agilenet

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	acprotect

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
static1/unpack001/DriverAssist.exe	agile_net

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack001/$PLUGINSDIR/version.dll
unpack002/out.upx

File Explorer

342b6eafbc9f18889a492925a33a2cc5_JaffaCakes118

.exe 18.1MB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/nsisdl.dll

.dll 15KB
$PLUGINSDIR/version.dll

.dll 22KB
out.upx

.dll 42KB
$TEMP/FXSplash.bmp

489KB
DriverAssist.exe

.exe 14.8MB

342b6eafbc9f18889a492925a33a2cc5_JaffaCakes118

IMPHASH 6007907ce022c4abf2d5a613e7a43459
SHA256 90263f5e0ceee73af6ee6ca4dac8e6441c1f5c39607512a954e42887a5a0bb3a
MD5 342b6eafbc9f18889a492925a33a2cc5
SHA1 041fcba34d990603fd63074394c40243312a4dfe
SHA512 d58819cad03fb0625129dd3a7fc3846ead1e028944b6516af8f3ca0261c2619ebda78be0a6f3d4cf87b03556fd10d5d49f695ce829997128d0eee115ebec4da7
SSDEEP 393216:Xm4I12ZQV+9llWqi0a2jVbHp5hAK0w5sXQr+xP9fPACdObQvnQ9ScGnCRByGz/O3:Xm4IcZMQWqzVbpb0IsXQ89npOE1crzm3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

d1:aa:0c:05:0d:d8:cb:14:52:0f:40:50:e4:a7:27:c7:a9:ab:cd:36:4a:f4:12:bc:cd:86:20:c3:97:1e:8e:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Chains

Jul 21, 2018

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

b6:ed:b1:e6:09:8b:d5:1b:64:3e:bd:f9:bf:75:87:23:9d:9a:42:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Chains

Jul 21, 2018

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Serial Number

07:ef:d3:e3:42:da:05:5a:0d:05:c8:a7:b7:2d:20:a5

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 29, 2018 - Jun 26, 2019

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Serial Number

07:ef:d3:e3:42:da:05:5a:0d:05:c8:a7:b7:2d:20:a5

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 29, 2018 - Jun 26, 2019

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

14259

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW CloseHandle SetFileTime GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW WritePrivateProfileStringW SetFileAttributesW ExpandEnvironmentStringsW LoadLibraryW lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW lstrcpyA lstrcpyW lstrcatW GetSystemDirectoryW GetVersion GetProcAddress LoadLibraryA GetModuleHandleA GetModuleHandleW LoadLibraryExW FreeLibrary lstrcmpiW lstrcmpW WaitForSingleObject GlobalFree GlobalAlloc GetCommandLineW GetExitCodeProcess SetErrorMode GetTempPathW MulDiv DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer MultiByteToWideChar ReadFile GetPrivateProfileStringW WriteFile lstrlenA WideCharToMultiByte

user32

EndDialog ScreenToClient GetWindowRect RegisterClassW EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData CreateWindowExW SystemParametersInfoW GetDlgItem AppendMenuW CreatePopupMenu GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA wvsprintfW DispatchMessageW PeekMessageW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW SetWindowLongW IsWindow OpenClipboard EmptyClipboard TrackPopupMenu FillRect DrawTextW EndPaint FindWindowExW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegEnumValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ord17 ImageList_Destroy ImageList_AddMasked

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH e1c0bd3d5b9f3f5cec7ea773ff66ac6e
SHA256 090c4bc8dc534e97b3877bd5115eb58b3e181495f29f231479f540bab5c01edc
MD5 9301577ff4d229347fe33259b43ef3b2
SHA1 5e39eb4f99920005a4b2303c8089d77f589c133d
SHA512 77dc7a1dedaeb1fb2ccefaba0a526b8d40ea64b9b37af53c056b9428159b67d552e5e3861cbffc2149ec646fdfe9ce94f4fdca51703f79c93e5f45c085e52c79
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisdl.dll

IMPHASH d09878220c1fdc2c2325ac1b89d388da
SHA256 93d03b5b15484e37315f3f0bb1d60a38e666fe714a9a0a28f831f6228c587562
MD5 5fadae311a0c96a8314f463520a08bf3
SHA1 7c4445bd00985050546b473f1892e5e917fbb058
SHA512 045d1bbf9802b204354757c94d0b90fc3b9f490dc3d68b12ec0fc83e127c3544c123df3cabb9a4285742d38fa9bcfaf376c800ba3cbbfd84ac624dc89a1dc4b9
SSDEEP 384:dhyd8Y6pu8ZaLf6Uksnw1g8BUcyHisUOb:dhyd8Y67WGg8B/Eie
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/version.dll

SHA256 31144e8b156fe87317073c48a09abcb033fda8dbdd96986c4abea8c00c00355f
MD5 fbe588b15eb1bd86defade69f796b56f
SHA1 2f63cf44039addddb22c2c0497673b49e6b3ad7a
SHA512 e1a9e29e4c62e77a2ec2c539344f0b5a8cd67ca3fd8dfefb0b0666a992eb2fabadb0034d439c4adbbdffd9c9439f23ee5757fac0ed669d3c9db48f50c677143d
SSDEEP 384:6Qx38r8QfiLpVjOXf4Rrd2IpZn8LI2EdGZ5D6PDo3rsyfyC8n:6Qx38r8Qgp1OvYd2zqGZ5D6PDmXf98
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 d1304316189dc3db78e313740aaa821ff051519683106cc99f6d6e7975e9ce1a
MD5 cc91478c2ab62714323a98a6f701d130
SHA1 55a3ff7a4c5ab64d9f2e793e79ef81eb7ab3744d
SHA512 b08170fe315e7b2ba3b9acc60ccf09bbf294fab1ba93dd3ce5e2be171173a3886a001081767645b4bb69f8feaca4a79ea54b119964a52084b5ac48c54c2c1b99
SSDEEP 768:BCpqOQqw77eQx6Sse06MpLSZ99Oq26PZApE8tOz:IpqOQve0yr0ROq8kz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

515B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

DriverAssist.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e71e9ad7ebebc5b65dcd3a5f6e90041aaf31896fb7733c984b6a603b79f721f4
MD5 a705d4503c5d46b58f9c62ff101a4493
SHA1 7df14bdda16ecbd268566d812bd43963b7b866b0
SHA512 ba47a299e9fa9fe781b09c9e8bd78143dca86af239c1525de70a57eef38736fa7e1934314d81618a7340f6f24ba33383f7e388fa5368274e8885bce1134d8960
SSDEEP 196608:eTXEzqkShkYHM6bETH24CIj88o5JvqN2ud4nLKr4RElS9OK:e6qk+M6b224CA88ojvwBqKrD+7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Digest

02:9f:48:ce:6b:92:0e:e7:9e:7b:a0:55:92:84:25:59:be:bc:f3:fa:81:42:cc:55:b2:dc:3d:27:36:ca:c1:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Chains

Jul 21, 2018

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

78:02:29:db:37:37:3f:ac:7c:09:57:89:e7:38:a4:27:00:58:8a:13

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Chains

Jul 21, 2018

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Serial Number

07:ef:d3:e3:42:da:05:5a:0d:05:c8:a7:b7:2d:20:a5

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 29, 2018 - Jun 26, 2019

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=SafeBytes Software Inc.,OU=DriverAssist,O=SafeBytes Software Inc.,L=Montreal,ST=Quebec,C=CA,1.2.840.113549.1.9.1=#0c15636f6e74616374407361666562797465732e636f6d

Serial Number

07:ef:d3:e3:42:da:05:5a:0d:05:c8:a7:b7:2d:20:a5

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 29, 2018 - Jun 26, 2019

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

15333426

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

z:\B2\R\tempDRIVBuild-20180721061913\Source\drivermanager\DriverManager\bin\Release\Secured\DriverAssist.pdb

342b6eafbc9f18889a492925a33a2cc5_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

kernel32

advapi32

generic

$PLUGINSDIR/nsisdl.dll

kernel32

user32

advapi32

wsock32

generic

$PLUGINSDIR/version.dll

generic

out.upx

generic

$TEMP/FXSplash.bmp

DriverAssist.exe

mscoree

dotnet