4e982eebd91e74b287bdefabf594003e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4e982eebd91e74b287bdefabf594003e_JaffaCakes118
Size

223KB
MD5

4e982eebd91e74b287bdefabf594003e
SHA1

7377b6f0e1fa3c4e0da1ea74410a9c88858b5b13
SHA256

40636528d8f38f606c79cf5e5979f7a68dc66e53af8c2614f5a2d8f4973dae4a
SHA512

4f0543fdbfb910041e2fae03e71b9706b7832ea735eb79d4f96d7ef708c1b4e46d1a2426335e5280534871ef768ac74c66584b6b83b0afedb4863b2e3330ed02
SSDEEP

3072:Hul4gNmW3ufXspYwVNZB8ugPzRI5j0+JUaq8BmqlnZCFMTF1I2v8+ul51zV:6F8G5jbKkZCFMVv8+ax

Score

1^/10

Malware Config

Signatures

Files

4e982eebd91e74b287bdefabf594003e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

83958fcee62bb3a58c42aea8b2820c28

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/02/2009, 00:00

Not After

12/04/2012, 23:59

Subject

CN=CyberLink,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CyberLink,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:76:d7:99:91:4d:70:b2:da:be:6b:ed:c8:1d:ef:8d:51:0d:b0:e4
Signer

Actual PE Digest

b9:76:d7:99:91:4d:70:b2:da:be:6b:ed:c8:1d:ef:8d:51:0d:b0:e4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Project\MUI\MUI\StartMenu\Release\StartMenu.pdb

Imports

kernel32

RemoveDirectoryA
RemoveDirectoryW
DeleteFileA
DeleteFileW
CopyFileA
CopyFileW
SetFileAttributesA
LocalFree
lstrcpynW
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
GlobalFree
SetLastError
RaiseException
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetVersion
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetFileAttributesW
GlobalFlags
GetCurrentThreadId
GetProcAddress
GetModuleHandleW
lstrcatW
FreeLibrary
LoadLibraryA
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
MoveFileW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
GetCurrentProcess
ExitProcess
RtlUnwind
HeapFree
HeapAlloc
TerminateProcess
CreateDirectoryW
CreateDirectoryA
MoveFileA
GetStartupInfoW
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
GetShortPathNameA
GetShortPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetLocaleInfoW
OutputDebugStringW
GetVersionExA
OutputDebugStringA
Sleep
CreateFileMappingW
CloseHandle
GetUserDefaultUILanguage
GetSystemDefaultLangID
EnumSystemLocalesW
EnumUILanguagesW
GetUserDefaultLangID
GetTempPathW
FindClose
GetFullPathNameA
GetFullPathNameW
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
lstrlenA
lstrlenW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetLastError
MultiByteToWideChar
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
lstrcmpW
InterlockedExchange

advapi32

RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyExA
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHChangeNotify
SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantChangeType
VariantInit
VariantClear
SysAllocStringLen
SysFreeString

comctl32

ord17

shlwapi

PathIsDirectoryEmptyW
PathIsDirectoryA
PathIsDirectoryW
PathRemoveFileSpecA
PathRemoveFileSpecW
PathAppendA
PathAppendW
PathIsDirectoryEmptyA
PathAddBackslashW
PathRemoveBackslashW
PathFileExistsW
PathAddExtensionW
PathFindFileNameW
PathCanonicalizeW
PathCanonicalizeA
PathFindExtensionW
PathFindExtensionA
PathFindFileNameA
PathFileExistsA
StrStrW
StrStrA

oleacc

LresultFromObject
CreateStdAccessibleObject

user32

RegisterWindowMessageW
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
DestroyMenu
PostQuitMessage
GetClassInfoW
RegisterClassW
DefWindowProcW
CallWindowProcW
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
SetMenuItemBitmaps
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
SetWindowPos
SetWindowLongW
WinHelpW
GetDlgItem
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
GetKeyState
PeekMessageW
ValidateRect
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetFocus
SetWindowTextW
GetClassNameW
GetWindowTextW
SendMessageW
MessageBoxW
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassW
GetMenuState
GetMenuItemID
GetCapture
CreateWindowExW
GetClassInfoExW
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetMenuItemCount
GetSubMenu
GetForegroundWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconW
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageW
AdjustWindowRectEx
GetParent

gdi32

SetViewportExtEx
OffsetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
ScaleViewportExtEx
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
DeleteObject
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
GetDeviceCaps
PtVisible
RectVisible

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

83958fcee62bb3a58c42aea8b2820c28

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5fCertificate

Extended Key Usages

Key Usages

b9:76:d7:99:91:4d:70:b2:da:be:6b:ed:c8:1d:ef:8d:51:0d:b0:e4Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

oleacc

user32

gdi32

winspool.drv

Sections

.text Size: 156KB - Virtual size: 153KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 15KB - Virtual size: 15KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5f
Certificate

b9:76:d7:99:91:4d:70:b2:da:be:6b:ed:c8:1d:ef:8d:51:0d:b0:e4
Signer

.text
Size: 156KB - Virtual size: 153KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 15KB - Virtual size: 15KB