3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118

General

Target
3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118
Size 501KB
Sample240513-mdkxeaba59
SHA256 b863ef1d634887948e32b76f80d62ba48d43275238fb41b74f4b0c493cf272c2
MD5 3f01cf63727ca8cbabc4a8f708ae1517
SHA1 21b8fa0f3fa6817ad9e5c062cf8d56c3ebb5b545
SHA512 26afb4ad49dac5314bfec20711b7f4720d81d2e617d4f59d6939b6233375aff92e61b08360cbd2d08e04b07cdc908d57864992e449aff9620f80092fb54858a9
SSDEEP 12288:30rHvfcA1OYg1x6YtCzDfXKoUXBipALLbsfuwh:30rHv0Yg/NGvmBNLah
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118

.exe 501KB

3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118

IMPHASH be401e0f15879f0fec3c1119c9fcb531
SHA256 b863ef1d634887948e32b76f80d62ba48d43275238fb41b74f4b0c493cf272c2
MD5 3f01cf63727ca8cbabc4a8f708ae1517
SHA1 21b8fa0f3fa6817ad9e5c062cf8d56c3ebb5b545
SHA512 26afb4ad49dac5314bfec20711b7f4720d81d2e617d4f59d6939b6233375aff92e61b08360cbd2d08e04b07cdc908d57864992e449aff9620f80092fb54858a9
SSDEEP 12288:30rHvfcA1OYg1x6YtCzDfXKoUXBipALLbsfuwh:30rHv0Yg/NGvmBNLah
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

96:58:33:5a:d8:93:e0:bf:fb:83:4e:29:46:c9:28:ad:83:e9:ae:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Firseria,O=Firseria,L=Badalona,ST=Barcelona,C=ES,1.2.840.113549.1.9.1=#0c13737570706f727440736f6c696d62612e636f6d

Chains

Jun 18, 2014

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

02:00:00:00:00:00:d6:78:b7:94:05

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 1, 1998 - Jan 28, 2014

Subject

CN=Firseria,O=Firseria,L=Badalona,ST=Barcelona,C=ES,1.2.840.113549.1.9.1=#0c13737570706f727440736f6c696d62612e636f6d

Serial Number

11:21:30:c3:b2:8d:7c:9c:29:b8:b0:73:21:ef:3f:8a:14:62

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 11, 2013 - Nov 12, 2014

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

1

Major OS version

5

Entry point

61578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize WaitForSingleObject WriteFile GetLastError CloseHandle FindFirstFileW GetVersionExW GetFileAttributesW GetModuleFileNameW RemoveDirectoryW GetProcAddress SetFilePointer SystemTimeToFileTime WideCharToMultiByte ReadFile MultiByteToWideChar GetCurrentDirectoryW LocalFileTimeToFileTime SetEndOfFile CreateFileW LoadLibraryW FindNextFileW GetModuleHandleW InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCPInfo ExitProcess GetSystemTimeAsFileTime HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType HeapCreate GetConsoleCP GetConsoleMode FlushFileBuffers GetLocaleInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle WriteConsoleW CreateFileA GetProcessHeap

user32

wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW

Sharing

General

Malware Config

Signatures

File Explorer

3f01cf63727ca8cbabc4a8f708ae1517_JaffaCakes118

PE Signature issue

kernel32

user32

advapi32

generic