386cd00002d95e8ad326ccf7848330e9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
386cd00002d95e8ad326ccf7848330e9_JaffaCakes118
Size 347KB
Sample240512-ftrassde26
SHA256 04835ce38b6f326214152425eef1b8d90e0572a762e3cf5b020d9c91d294de92
MD5 386cd00002d95e8ad326ccf7848330e9
SHA1 d0894c250236fabe2946244f0faaa3ab34392ca4
SHA512 3743c940253d2c5ecc5d82f583ee35e725b920467cf17cd7ca40589579c6320b75a7d24897c90afdb2293f1f478cc37883e136f80c70a0b1ee2ee34cfcd5a1cb
SSDEEP 6144:zIcKOnEJ8C8Ska8qKpekm+eVCb5D4Zv1XaA:zWJ8st8q0m+15S1XaA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

386cd00002d95e8ad326ccf7848330e9_JaffaCakes118

.dll 347KB

386cd00002d95e8ad326ccf7848330e9_JaffaCakes118

IMPHASH 0da924c88bf2c5078c6da45f83d97f5a
SHA256 04835ce38b6f326214152425eef1b8d90e0572a762e3cf5b020d9c91d294de92
MD5 386cd00002d95e8ad326ccf7848330e9
SHA1 d0894c250236fabe2946244f0faaa3ab34392ca4
SHA512 3743c940253d2c5ecc5d82f583ee35e725b920467cf17cd7ca40589579c6320b75a7d24897c90afdb2293f1f478cc37883e136f80c70a0b1ee2ee34cfcd5a1cb
SSDEEP 6144:zIcKOnEJ8C8Ska8qKpekm+eVCb5D4Zv1XaA:zWJ8st8q0m+15S1XaA
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

b5:0e:c0:29:7e:ae:03:78:65:16:fa:84:27:26:bb:8b:8d:29:ec:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Exciting Apps,O=Exciting Apps,L=Philadelphia,ST=Pennsylvania,C=US

Chains

Jul 10, 2014

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Exciting Apps,O=Exciting Apps,L=Philadelphia,ST=Pennsylvania,C=US

Serial Number

53:46:82:e2:d4:42:ec:8e:a3:32:08:56:df:22:14:dc

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Mar 18, 2014 - Mar 25, 2015

Subject

CN=Starfield Services Timestamp Authority,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Serial Number

2c:a6:b3

Issuer

CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 1, 2014 - Apr 1, 2019

Minor OS version

Major OS version

Entry point

149573

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gdiplus

GdipDeleteBrush GdipCreateSolidFill GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCloneBrush GdipDeleteGraphics GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipFree GdipCreateHBITMAPFromBitmap GdipDeletePath GdiplusShutdown GdiplusStartup GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillPath GdipAddPathArcI GdipClosePathFigure GdipAlloc GdipCreatePath GdipCreateFromHDC GdipGetImageHeight GdipGetImageWidth GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectRectI GdipDrawImageRectI GdipFillRectangleI GdipGraphicsClear GdipSetPageUnit

wininet

InternetSetCookieW InternetGetCookieExW

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetOEMCP GetACP IsValidCodePage GetStartupInfoW GetFileType SetFilePointerEx GetConsoleMode WriteFile GetStdHandle GetModuleHandleExW ExitProcess GetCommandLineA LockResource HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LoadResource SizeofResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress GetVersion GlobalAlloc GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess RaiseException GetCurrentThreadId GetLastError SetLastError Sleep LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection MulDiv lstrcmpW LoadLibraryW GetModuleFileNameW GetModuleHandleA GetModuleHandleW OutputDebugStringA GetFileAttributesW DecodePointer FreeLibrary TerminateProcess CloseHandle CreateFileW InitializeCriticalSection InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls GetVersionExW lstrcmpiW LoadLibraryExW LoadLibraryA EncodePointer GetThreadLocale SetThreadLocale TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree RtlUnwind WideCharToMultiByte GetStringTypeW SetStdHandle FlushFileBuffers WriteConsoleW EnterCriticalSection

user32

GetActiveWindow GetMonitorInfoW MonitorFromPoint TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsWindowVisible CopyRect MapWindowPoints AdjustWindowRectEx GetWindowRect GetWindowDC GetMenu UpdateLayeredWindow LoadCursorW GetWindow GetClassNameW FindWindowExW GetParent GetDesktopWindow SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient ClientToScreen GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem SetWindowPos MoveWindow DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW PostMessageW SendMessageW RegisterWindowMessageW IsChild

gdi32

ExtTextOutW SetBkMode GetTextExtentPoint32W GetObjectW SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush

advapi32

RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey

ole32

CoCreateInstance CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize OleLockRunning CoTaskMemRealloc CreateStreamOnHGlobal

oleaut32

VariantChangeType SysAllocStringByteLen SysStringByteLen SysAllocString SysAllocStringLen SysFreeString VariantInit VariantClear SysStringLen LoadTypeLi LoadRegTypeLi DispCallFunc UnRegisterTypeLi OleCreateFontIndirect VariantCopy VarUI4FromStr RegisterTypeLi

shlwapi

PathFileExistsW PathAddBackslashW PathRemoveFileSpecW

urlmon

CoInternetGetSession CreateUri

Sharing

General

Malware Config

Signatures

File Explorer

386cd00002d95e8ad326ccf7848330e9_JaffaCakes118

PE Signature issue

gdiplus

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

urlmon

generic