4eba2cc3ca4f650c26cf5de68ba90c56_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4eba2cc3ca4f650c26cf5de68ba90c56_JaffaCakes118
Size

368KB
MD5

4eba2cc3ca4f650c26cf5de68ba90c56
SHA1

8b3a7c46910fec0ef3089b9ddb0312dfa6a0ea02
SHA256

10119a596c638fe49650542b3bb73c08dce13deb008d96953b1f494e18cb4cd4
SHA512

24c6511127a58d65e23fa43892793b9488c98db4db64db568e6697b0fc9a161121c02e63ecf37f94bf8b18bd78617c0ef97f5a6cca4d91597eff1983e2b870b0
SSDEEP

6144:yuBmh7NReNV6P505u6CUXYF3dm2BU3ukJdlUAGMerKVk+FvU5UDFFX6uaNID:yuBmh7mV6x0fxgdmH3hV1pF56uaNID

Score

1^/10

Malware Config

Signatures

Files

4eba2cc3ca4f650c26cf5de68ba90c56_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9b8b2f3934a1e3d246d6e2f6059bef91

Code Sign

24
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

24/10/2007, 22:01

Not After

24/10/2017, 22:01

Subject

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:bb
Certificate

Issuer

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/11/2014, 00:09

Not After

31/10/2016, 17:47

Subject

CN=ООО ”БАНДЛ” - Bundle LLC,O=ООО ”БАНДЛ” - Bundle LLC,L=Saint-Petersburg,ST=Saint Petersburg City,C=RU,1.2.840.113549.1.9.1=#0c16696e666f40696e7374616c6c62756e646c652e636f6d,2.5.4.13=#1310345173635459644f79754e45624e586d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fb:6e:bc:14:9b:f1:3b:9c:4f:42:64:05:d0:51:d1:ef:1c:13:d8:e3
Signer

Actual PE Digest

fb:6e:bc:14:9b:f1:3b:9c:4f:42:64:05:d0:51:d1:ef:1c:13:d8:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CloseWindow
GetWindowTextA
ScreenToClient
GetParent
GetClassNameA
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
DestroyWindow
DefWindowProcA

kernel32

HeapDestroy
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
WriteFile
RtlUnwind
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
ReadFile
GetFileType
CreateNamedPipeA
CopyFileA
GetLastError
LockFile
OpenFile
GetModuleHandleA
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetStringTypeW
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte

Sections

.text
Size: 296KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9b8b2f3934a1e3d246d6e2f6059bef91

Code Sign

24Certificate

Key Usages

10:bbCertificate

Extended Key Usages

Key Usages

fb:6e:bc:14:9b:f1:3b:9c:4f:42:64:05:d0:51:d1:ef:1c:13:d8:e3Signer

Headers

File Characteristics

Imports

user32

kernel32

Sections

.text Size: 296KB - Virtual size: 293KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 52KB - Virtual size: 51KB

24
Certificate

10:bb
Certificate

fb:6e:bc:14:9b:f1:3b:9c:4f:42:64:05:d0:51:d1:ef:1c:13:d8:e3
Signer

.text
Size: 296KB - Virtual size: 293KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 52KB - Virtual size: 51KB