3b5db42b79c070a568720b0768090124_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3b5db42b79c070a568720b0768090124_JaffaCakes118
Size

22.1MB
MD5

3b5db42b79c070a568720b0768090124
SHA1

f5634a0fe7e3acc20bbb903c39fc0068dba6cc9f
SHA256

78ac406ded7a97f206b0de19cd5ba1fcf602fe97ea1a7332702c23d7e7cf8034
SHA512

b240f5790da8d02deacaf30352641b640849f23c6fbeb9dd3ceb70eb8232137ea4f7fe631ffb760d1549087f38cae827d5efda6d1a4cfd85c6c902b998abed87
SSDEEP

393216:fIXQ0pDQbR/VhCybsCJCFVesUyypcgGFbEG:fIXQL/7bseS1yr5G

Score

1^/10

Malware Config

Signatures

Files

3b5db42b79c070a568720b0768090124_JaffaCakes118
.exe windows:4 windows x86 arch:x86

97853aa3456a5049aba29a9a4df35270

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1b:86:12:67:7a:e1:9d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

14/10/2007, 22:03

Not After

14/10/2022, 22:03

Subject

CN=StartCom Class 3 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:d8:75:4a:ed:a8:4a
Certificate

Issuer

CN=StartCom Class 3 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

13/09/2015, 10:11

Not After

13/09/2018, 11:17

Subject

CN=Audials AG,O=Audials AG,L=Karlsruhe,ST=Baden-W�rttemberg,C=DE,1.2.840.113549.1.9.1=#0c1163657274734061756469616c732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

c6:08:50:31:8c:59:c8:be:73:30:4e:b6:28:66:51:7b:5e:0c:d5:77
Signer

Actual PE Digest

c6:08:50:31:8c:59:c8:be:73:30:4e:b6:28:66:51:7b:5e:0c:d5:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

gdi32

BitBlt
ChoosePixelFormat
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBSection
CreatePalette
CreateSolidBrush
DeleteDC
DeleteObject
DescribePixelFormat
GetDIBits
GetDeviceCaps
GetDeviceGammaRamp
GetPixel
GetPixelFormat
GetStockObject
GetSystemPaletteEntries
GetSystemPaletteUse
RealizePalette
SelectObject
SelectPalette
SetDIBColorTable
SetDeviceGammaRamp
SetPaletteEntries
SetPixel
SetPixelFormat
SetSystemPaletteUse
SwapBuffers
UnrealizeObject

kernel32

AllocConsole
CloseHandle
CreateConsoleScreenBuffer
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
CreateSemaphoreA
CreateThread
DeleteCriticalSection
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FormatMessageA
FormatMessageW
FreeConsole
FreeLibrary
GetACP
GetConsoleCursorInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentConsoleFont
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentVariableA
GetFileAttributesA
GetFileAttributesExA
GetFileType
GetFullPathNameA
GetHandleInformation
GetLastError
GetLocaleInfoA
GetLogicalDrives
GetLongPathNameA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleW
GetNumberOfConsoleInputEvents
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathA
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MapViewOfFile
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleInputA
ReadFile
ReleaseMutex
ReleaseSemaphore
ResetEvent
ResumeThread
SetConsoleActiveScreenBuffer
SetConsoleCursorInfo
SetConsoleMode
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleWindowInfo
SetCriticalSectionSpinCount
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetLastError
SetPriorityClass
SetProcessAffinityMask
SetThreadAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleOutputW
WriteFile

msvcrt

__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_access
_amsg_exit
_atoi64
_beginthread
_beginthreadex
_cexit
_chmod
_close
_creat
_close
_endthread
_endthreadex
_errno
_exit
_fdopen
_filelengthi64
_fileno
_findclose
_fileno
_findfirst
_findnext
_fmode
_fstati64
_ftime
_fullpath
_get_osfhandle
_getcwd
_hypot
_initterm
_iob
_getpid
_lock
_lseeki64
_mbsrchr
_memccpy
_mkdir
_mkdir
_onexit
_open
_open
_open_osfhandle
_putenv
_read
_setjmp3
_setmode
_setmode
_snprintf
_rmdir
_snwprintf
_sopen
_stat
_stati64
_strdup
_stricmp
_strnicmp
_telli64
_tempnam
_unlink
_unlock
_vsnprintf
_wfindfirst
_wfindnext
_wfopen
_wopen
_write
_write
_wsopen
abort
acos
asin
atan
atan2
atof
atoi
atol
bsearch
calloc
clearerr
clock
cosh
ctime
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
frexp
fseek
fsetpos
ftell
fwprintf
fwrite
getc
getenv
gmtime
isalnum
isalpha
islower
isprint
isspace
isupper
localtime
isxdigit
localeconv
log10
longjmp
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
perror
printf
putc
putchar
puts
qsort
raise
rand
realloc
remove
rename
rewind
setlocale
setvbuf
signal
sinh
sprintf
srand
sscanf
strcat
strchr
strcmp
strcoll
strcpy
strcspn
strerror
strftime
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
system
tan
tanh
time
time
tolower
toupper
ungetc
vfprintf
vsprintf
wcscpy
wcslen
wcstombs

ole32

CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize

opengl32

glBegin
glBindTexture
glBlendFunc
glCallList
glCallLists
glClear
glClearColor
glClearDepth
glColor4f
glColor4ub
glColorMask
glColorMaterial
glDeleteLists
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glDrawBuffer
glEnable
glEnd
glEndList
glFinish
glFlush
glGenLists
glGenTextures
glGetError
glGetIntegerv
glGetString
glGetTexLevelParameteriv
glLightfv
glLoadMatrixf
glNewList
glNormal3f
glPixelStorei
glShadeModel
glTexCoord2f
glTexEnvi
glTexImage1D
glTexImage2D
glTexParameterf
glTexParameterfv
glTexParameteri
glTexSubImage2D
glVertex2f
glVertex3f
glViewport
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent

shell32

ExtractIconA
SHGetFolderPathA

user32

AdjustWindowRect
AdjustWindowRectEx
BeginPaint
CallWindowProcA
ChangeDisplaySettingsA
ClientToScreen
ClipCursor
CreateCursor
CreateIconFromResourceEx
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageA
EnableWindow
EndPaint
EnumDisplayDevicesA
EnumDisplaySettingsA
FillRect
GetClassInfoA
GetClientRect
GetCursor
GetCursorPos
GetDC
GetDesktopWindow
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardState
GetMenu
GetMessageA
GetParent
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsZoomed
KillTimer
LoadCursorA
LoadIconA
LoadImageA
LoadKeyboardLayoutA
MapVirtualKeyA
MapVirtualKeyExA
MapWindowPoints
MessageBoxW
MoveWindow
MsgWaitForMultipleObjects
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RegisterClassA
RegisterClassExA
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SetCapture
SetClassLongA
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowCursor
ShowWindow
ToAsciiEx
ToUnicode
TranslateMessage
UnregisterClassA
WindowFromPoint

winmm

joyGetDevCapsA
joyGetNumDevs
joyGetPosEx
mciGetErrorStringA
mciSendCommandA
timeBeginPeriod
timeEndPeriod
timeGetTime
timeKillEvent
timeSetEvent
waveOutClose
waveOutGetErrorTextA
waveOutGetVolume
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutSetVolume
waveOutUnprepareHeader
waveOutWrite

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Exports

Exports

opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_parse
opus_pcm_soft_clip
opus_strerror

Sections

.text
Size: 13.9MB - Virtual size: 13.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/4
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 341KB - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

97853aa3456a5049aba29a9a4df35270

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

1b:86:12:67:7a:e1:9dCertificate

Key Usages

12:d8:75:4a:ed:a8:4aCertificate

Extended Key Usages

Key Usages

c6:08:50:31:8c:59:c8:be:73:30:4e:b6:28:66:51:7b:5e:0c:d5:77Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

ole32

opengl32

shell32

user32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 13.9MB - Virtual size: 13.9MB

.rotext Size: 108KB - Virtual size: 107KB

.data Size: 209KB - Virtual size: 209KB

.rdata Size: 5.9MB - Virtual size: 5.9MB

.rodata Size: 27KB - Virtual size: 26KB

/4 Size: 1.3MB - Virtual size: 1.3MB

.bss Size: - Virtual size: 6.5MB

.edata Size: 1024B - Virtual size: 876B

.idata Size: 14KB - Virtual size: 14KB

.CRT Size: 512B - Virtual size: 56B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 323KB - Virtual size: 323KB

.reloc Size: 341KB - Virtual size: 340KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1b:86:12:67:7a:e1:9d
Certificate

12:d8:75:4a:ed:a8:4a
Certificate

c6:08:50:31:8c:59:c8:be:73:30:4e:b6:28:66:51:7b:5e:0c:d5:77
Signer

.text
Size: 13.9MB - Virtual size: 13.9MB

.rotext
Size: 108KB - Virtual size: 107KB

.data
Size: 209KB - Virtual size: 209KB

.rdata
Size: 5.9MB - Virtual size: 5.9MB

.rodata
Size: 27KB - Virtual size: 26KB

/4
Size: 1.3MB - Virtual size: 1.3MB

.bss
Size: - Virtual size: 6.5MB

.edata
Size: 1024B - Virtual size: 876B

.idata
Size: 14KB - Virtual size: 14KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 323KB - Virtual size: 323KB

.reloc
Size: 341KB - Virtual size: 340KB