3eeca9f820db36461ea128fa52f075a4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3eeca9f820db36461ea128fa52f075a4_JaffaCakes118
Size

127KB
MD5

3eeca9f820db36461ea128fa52f075a4
SHA1

35939bb9c0554e70e93f07ec90728145e003fd54
SHA256

24e74c087543d361fa9fa46e2693f95710243b0c8b30e97134561804f54572c8
SHA512

f3a1675968aff46a4c2b3a3019a2593b90747961b299dd5c422ca59887d57c26b1b8f00177df6c2ed17e6f462c958db5670e7aa01cc504a82b7617ac686c7520
SSDEEP

3072:05dnu0W5ZyYi+KpM6TWrwrtGGF4IfhcNM+1Uh:EnxIZhKp1fFpfD+1U

Score

1^/10

Malware Config

Signatures

Files

3eeca9f820db36461ea128fa52f075a4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4b7cf5131d2e296be23f3a22ab9adc11

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ab:07:ad:ec:9c:cb:f3:ff:f1:bb:72:a1:b3:fb:30:a9:d8:92:3c:bf
Signer

Actual PE Digest

ab:07:ad:ec:9c:cb:f3:ff:f1:bb:72:a1:b3:fb:30:a9:d8:92:3c:bf

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

ose.pdb

Imports

msvcrt

_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_vsnwprintf
_vsnprintf
wcsrchr
wcscmp

advapi32

RegEnumValueW
CryptReleaseContext
CryptAcquireContextW
SetFileSecurityW
RegDeleteKeyW
OpenThreadToken
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
AllocateAndInitializeSid
FreeSid
CryptHashData
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
RegisterServiceCtrlHandlerW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
SetThreadToken
RegQueryValueExW
RegNotifyChangeKeyValue
SetServiceStatus
StartServiceCtrlDispatcherW
DuplicateToken
RegDeleteValueW

kernel32

FormatMessageA
GetComputerNameW
GetModuleHandleA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapFree
HeapSize
RaiseException
LoadLibraryA
MoveFileExW
GetLastError
GetModuleFileNameW
CloseHandle
SetEvent
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetDriveTypeW
GetLogicalDrives
lstrcmpW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
ExitProcess
InitializeCriticalSection
GetCommandLineW
GetTickCount
ReleaseMutex
ResetEvent
WaitForMultipleObjectsEx
SetErrorMode
CreateEventW
CreateMutexW
CreateProcessW
GetSystemInfo
InterlockedExchange
CreateFileA
ReadFile
SetFilePointer
DosDateTimeToFileTime
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
CreateFileW
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
CreateThread
CreateSemaphoreW
VirtualFree
VirtualAlloc
SetFilePointerEx
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
WriteFile
GlobalFree
GlobalAlloc
GetFileAttributesExW
GetFileSizeEx
FindClose
FindFirstFileW
GetFileAttributesW
CopyFileW
CreateHardLinkW
SetFileAttributesW
DeleteFileW
GetTempPathA
GetTempPathW
GetFileTime
FindNextFileW
LocalFree
GetCurrentThread
CreateDirectoryW
RemoveDirectoryW
lstrlenA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
LocalAlloc

rpcrt4

RpcImpersonateClient
RpcRevertToSelf
RpcServerUnregisterIf
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
NdrServerCall2

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4b7cf5131d2e296be23f3a22ab9adc11

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

ab:07:ad:ec:9c:cb:f3:ff:f1:bb:72:a1:b3:fb:30:a9:d8:92:3c:bfSigner

Headers

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

rpcrt4

Sections

.text Size: 77KB - Virtual size: 77KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 48KB - Virtual size: 48KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

ab:07:ad:ec:9c:cb:f3:ff:f1:bb:72:a1:b3:fb:30:a9:d8:92:3c:bf
Signer

.text
Size: 77KB - Virtual size: 77KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 48KB - Virtual size: 48KB