34cb7ef2b524e1178d6415b868c52ae9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

34cb7ef2b524e1178d6415b868c52ae9_JaffaCakes118
Size

617KB
MD5

34cb7ef2b524e1178d6415b868c52ae9
SHA1

a8373429f90ac5cc1b4a594e436318f70563e0e9
SHA256

130275f1dba3c9f390a5994cb20970a1455f0195900d5f14a8c4a275aa356e87
SHA512

64f8a99700f801c823ac1c6aee5b53b5a2192d00f69d699a9cf3890e54cb4eeed72f5a71d2fc87ced7c54ef1a95740aba65fd91c0fb8797dd267c578b267570c
SSDEEP

6144:zLKY4/pFCORV3sYzQyd7mxF07vx/qpNCL/wKJqSBEua+nkoWCpjruyrv19Cudz8k:zLKJjuYIF0Dso7wOqQnBjB7C2Awal9c

Score

1^/10

Malware Config

Signatures

Files

34cb7ef2b524e1178d6415b868c52ae9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d769215192c0c2d9bcee72f8433897c

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4e
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

16/03/2015, 00:00

Not After

15/03/2016, 23:59

Subject

CN=IT-SERVIS,O=IT-SERVIS,POSTALCODE=350000,STREET=NOVOKUZNECHNAYA\, 84,L=KRASNODAR,ST=KRASNODAR REGION,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:73:5f:89:c6:3e:bd:da:c0:b6:ee:d3:b9:5c:bc:ad:c0:ab:29:bf
Signer

Actual PE Digest

16:73:5f:89:c6:3e:bd:da:c0:b6:ee:d3:b9:5c:bc:ad:c0:ab:29:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
CloseHandle
GetLastError
GetModuleHandleA
VirtualAllocEx
OpenMutexW
GetTickCount
GetConsoleMode
SetConsoleMode
FindClose
GetFileAttributesA
VirtualFree
ReadConsoleInputA
GetLocaleInfoA
HeapSize
ReadFile
SetEndOfFile
SetFilePointer
LCMapStringW
LCMapStringA
RaiseException
GetCPInfo
ExitProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
GetProcAddress
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
HeapFree
WriteFile
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapAlloc
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
CreateFileA
HeapReAlloc
SetStdHandle
FlushFileBuffers
MultiByteToWideChar
VirtualProtect
GetSystemInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

user32

LoadIconA
LoadCursorA
MessageBoxA

gdi32

CreateCompatibleBitmap
CreateCompatibleDC

shell32

SHCreateShellItem

ole32

CoCreateGuid

oleaut32

SysAllocString

ws2_32

send
setsockopt
WSAGetLastError

Sections

.text
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 468KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.addex77
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d769215192c0c2d9bcee72f8433897c

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4eCertificate

Extended Key Usages

Key Usages

16:73:5f:89:c6:3e:bd:da:c0:b6:ee:d3:b9:5c:bc:ad:c0:ab:29:bfSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

ws2_32

Sections

.text Size: 88KB - Virtual size: 84KB

.rdata Size: 468KB - Virtual size: 467KB

.data Size: 4KB - Virtual size: 9KB

.addex77 Size: 28KB - Virtual size: 26KB

.rsrc Size: 20KB - Virtual size: 16KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

49:cf:f2:29:0b:ab:f3:51:00:9a:74:69:3e:4c:90:4e
Certificate

16:73:5f:89:c6:3e:bd:da:c0:b6:ee:d3:b9:5c:bc:ad:c0:ab:29:bf
Signer

.text
Size: 88KB - Virtual size: 84KB

.rdata
Size: 468KB - Virtual size: 467KB

.data
Size: 4KB - Virtual size: 9KB

.addex77
Size: 28KB - Virtual size: 26KB

.rsrc
Size: 20KB - Virtual size: 16KB