3d1ddb3e042994276f78d51f42b98bb3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d1ddb3e042994276f78d51f42b98bb3_JaffaCakes118
Size

384KB
MD5

3d1ddb3e042994276f78d51f42b98bb3
SHA1

21b64950402b4eeb39fce3c1b802a1f4023a649c
SHA256

21c9aaf51f73d410ec50d0ac1e36dc444e390fb545665aacd024ca1f8f6dbdad
SHA512

7917fe248822dc7c6e35fdccbb7ccf26313c75241f38240eb12dfe2ab755a32fcb1015fa2b9e01f88e19a4e7a75b0dce21d292bc2f81066fc97051ccc8f8c0d2
SSDEEP

12288:yyK61HyvakgI6V1DwzpOP+/HK9KQBQvsx:U61HyvakgI6V1kcP+/HGBQ

Score

1^/10

Malware Config

Signatures

Files

3d1ddb3e042994276f78d51f42b98bb3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7a81ca1349f2ce068f3b938960ab0fa2

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ef:f3:ac:73:2f:ff:0c:34:d8:93:c6:de:0e:c5:a4:19:bd:08:49:e5
Signer

Actual PE Digest

ef:f3:ac:73:2f:ff:0c:34:d8:93:c6:de:0e:c5:a4:19:bd:08:49:e5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setlang.pdb

Imports

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameW

msimg32

TransparentBlt

msvcrt

wcslen
wcscmp
_vsnwprintf
memmove
_wtoi
wcschr
_wcsicmp
wcsstr
_snwprintf
swscanf
free
__CxxFrameHandler
_wcsdup
_endthreadex
_beginthreadex
memset
_CxxThrowException
malloc
_except_handler3
realloc
labs
_expand
memcpy
_msize
wcstoul
wcstol
iswdigit
iswspace
_ultow
_ltow
wcscpy
wcsncpy
_controlfp
??1type_info@@UAE@XZ
ctime
mktime
gmtime
localtime
time
?terminate@@YAXXZ
_vsnprintf
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_c_exit
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_adjust_fdiv

kernel32

GlobalDeleteAtom
FreeLibrary
GlobalAlloc
lstrcmpW
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
GetCurrentThread
lstrlenW
GetModuleFileNameW
SetThreadPriority
ResumeThread
SetEvent
SuspendThread
CreateEventW
lstrcpynW
SetLastError
LoadLibraryA
GetModuleHandleA
GetFileAttributesW
VirtualProtect
OutputDebugStringA
GlobalFree
GlobalUnlock
LocalFree
FormatMessageW
GetVersionExA
lstrcatW
lstrlenA
GlobalFindAtomW
InterlockedDecrement
RaiseException
InitializeCriticalSection
DeleteCriticalSection
WritePrivateProfileStringW
lstrcmpiW
InterlockedIncrement
GlobalFlags
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
CreateFileW
FindResourceExW
FileTimeToSystemTime
SetErrorMode
FileTimeToLocalFileTime
GetFileTime
GetTickCount
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
GetSystemInfo
VirtualQuery
LoadLibraryExW
GetSystemDirectoryW
FormatMessageA
GetModuleHandleW
GetProcAddress
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
LoadLibraryW
OpenProcess
WaitForSingleObject
CloseHandle
CreateProcessW
GetUserDefaultUILanguage
IsValidLocale
GetLocaleInfoW
FreeResource
SizeofResource
MulDiv
FindResourceW
LoadResource
LockResource
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CreateMutexW
GetLastError
ReleaseMutex
GlobalAddAtomW

user32

DestroyMenu
RegisterClipboardFormatW
PostThreadMessageW
MessageBoxA
CharNextW
CharUpperW
LoadCursorW
GetSysColorBrush
wsprintfW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
WinHelpW
GetClassLongW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
GetClassInfoW
CreateWindowExW
GetClassInfoExW
UnregisterClassW
RegisterClassW
GetMenu
AdjustWindowRectEx
ScreenToClient
EqualRect
GetScrollInfo
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetMenuItemID
GetMenuItemCount
GetSubMenu
DestroyWindow
IsWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
SetWindowContextHelpId
MapDialogRect
SetWindowPos
ShowWindow
GetAsyncKeyState
SetFocus
GetDlgItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
SetWindowsHookExW
CallNextHookEx
GetMessageW
GetNextDlgGroupItem
ReleaseCapture
TranslateMessage
DispatchMessageW
IsWindowVisible
SetCapture
InvalidateRgn
CopyAcceleratorTableW
SetRect
MessageBoxW
IsRectEmpty
GetKeyState
GetCursorPos
ValidateRect
SetCursor
PostQuitMessage
GetDesktopWindow
GetWindowThreadProcessId
GetClassNameW
SendMessageTimeoutW
SetForegroundWindow
PostMessageW
OffsetRect
SystemParametersInfoW
GetClientRect
GetFocus
InvalidateRect
GetWindowRect
GetSysColor
LoadBitmapW
GetWindowLongW
SetWindowLongW
GetSystemMetrics
MessageBeep
LoadIconW
DrawFocusRect
FillRect
PeekMessageW
IsWindowEnabled
GetCapture
GetActiveWindow
EnableWindow
GetParent
GetWindow
SetActiveWindow
LockWindowUpdate
UpdateWindow
ReleaseDC
GetDC
SendMessageW
EndDialog

gdi32

SetBkColor
SaveDC
RestoreDC
SetBkMode
SetMapMode
SetTextAlign
GetViewportExtEx
GetWindowExtEx
SetTextColor
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetStockObject
GetClipBox
CreateBitmap
CreateCompatibleDC
SelectObject
DeleteDC
GetTextExtentPoint32W
DeleteObject
GetTextAlign
GetTextColor
GetBkColor
CreateSolidBrush
GetDeviceCaps
GetObjectW
PtVisible
GetMapMode
GetRgnBox
CreateRectRgnIndirect
EnumFontFamiliesExW
CreateFontIndirectW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW

comctl32

ord17
PropertySheetW

shlwapi

PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoRevokeClassObject
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysStringLen
SysFreeString
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
SysAllocStringLen
VariantClear
VariantChangeType
OleCreateFontIndirect
VariantCopy
VariantInit

oleacc

LresultFromObject
CreateStdAccessibleObject

Exports

Exports

_ctime64
_gmtime64
_localtime64
_mktime64
_resetstkoflw
_scprintf
_scwprintf
_time64
_vscprintf
_vscwprintf

Sections

.text
Size: 217KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7a81ca1349f2ce068f3b938960ab0fa2

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

ef:f3:ac:73:2f:ff:0c:34:d8:93:c6:de:0e:c5:a4:19:bd:08:49:e5Signer

Headers

File Characteristics

PDB Paths

Imports

psapi

msimg32

msvcrt

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

oleacc

Exports

Exports

Sections

.text Size: 217KB - Virtual size: 217KB

.data Size: 102KB - Virtual size: 110KB

.rsrc Size: 63KB - Virtual size: 63KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

ef:f3:ac:73:2f:ff:0c:34:d8:93:c6:de:0e:c5:a4:19:bd:08:49:e5
Signer

.text
Size: 217KB - Virtual size: 217KB

.data
Size: 102KB - Virtual size: 110KB

.rsrc
Size: 63KB - Virtual size: 63KB