500e9aa4308c1f06bbdde904fdb8b15f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

500e9aa4308c1f06bbdde904fdb8b15f_JaffaCakes118
Size

158KB
MD5

500e9aa4308c1f06bbdde904fdb8b15f
SHA1

feb313c097f3c93f8751624184e32aa6fce1181d
SHA256

6fc569977e6c5fe3f1b4af0233bfdc78d96a0c5c2445b0513a9fcd6e5f398307
SHA512

4d4cbe54d66fb21048bba70947ef333f4c42d9385beaeb87b49b1dcc225c1a1c9b3299de1db7e805640c52bcf315bd64d2bdd7382fcfbea8e706de29cbe7f50e
SSDEEP

3072:oG9EM+WgjLKCUBQHcHt6L6bP87IJjxvkWkJbB9knSknDC:P+F6CUBQHmt6L6bPQIZ/6B9knSS2

Score

1^/10

Malware Config

Signatures

Files

500e9aa4308c1f06bbdde904fdb8b15f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

64ab6f80b8539cc7ad569621f1064e71

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:4e:e7:9f:85:6a:67:01:6f:01:25:41:a7:5f:64:46
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2015, 00:00

Not After

12/08/2018, 23:59

Subject

CN=Beijing Sogou Information Service Co.\, Ltd.,OU=Search business Division,O=Beijing Sogou Information Service Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:e4:db:98:20:e0:64:a7:06:e5:57:20:9a:d9:f1:8a:36:6c:52:fd
Signer

Actual PE Digest

61:e4:db:98:20:e0:64:a7:06:e5:57:20:9a:d9:f1:8a:36:6c:52:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathA
SHCreateDirectoryExA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

kernel32

WritePrivateProfileSectionA
GetPrivateProfileIntA
WritePrivateProfileStringA
FileTimeToSystemTime
SetEvent
CreateEventA
WaitForSingleObject
MoveFileExA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateProcessA
OutputDebugStringA
CreateMutexA
CloseHandle
lstrcpynA
lstrcatA
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetLastError
FreeLibrary
LoadLibraryA
GetCurrentProcessId
Process32FirstW
Process32NextW
CreateFileA
GetPrivateProfileStringA
ProcessIdToSessionId
OpenProcess
lstrcmpA
GetModuleHandleA
LoadLibraryExA
ReadProcessMemory
LocalFree
lstrlenA
lstrcpynW
GetACP
LoadLibraryW
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcess
GetVersionExA
GetVersion
FindFirstFileA
FindNextFileA
FindClose
RemoveDirectoryA
GetFileAttributesExA
GetTempPathA
GetTempFileNameA
CreateDirectoryA
MultiByteToWideChar
GetLongPathNameA
DeleteFileA
GetWindowsDirectoryA
GetShortPathNameA
GetSystemDirectoryA
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
lstrcpyA
GetEnvironmentVariableA
CreateFileW
WriteFile
GetFileSize
WritePrivateProfileStructA
SetLastError
GetPrivateProfileStructA
GetStartupInfoA
GetProcAddress
lstrlenW
WideCharToMultiByte
FileTimeToLocalFileTime
LocalAlloc
ReadFile
OpenMutexA
lstrcmpiA
MapViewOfFile

advapi32

RegCreateKeyExA
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
RegCreateKeyA
RegSetKeySecurity
RegDeleteValueA
SetNamedSecurityInfoA
SetEntriesInAclA
GetNamedSecurityInfoA
ConvertSidToStringSidA
GetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueW
SetTokenInformation
EqualSid
GetSidSubAuthority
CloseServiceHandle
CreateServiceA
OpenSCManagerA
ChangeServiceConfig2A
OpenServiceA
DeleteService
QueryServiceStatus
StartServiceA
ControlService
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
SetServiceStatus
CreateProcessAsUserA
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
GetSidSubAuthorityCount

shlwapi

SHDeleteKeyA
SHGetValueA
SHDeleteValueA
PathAddExtensionA
PathRemoveExtensionA
PathFindExtensionA
SHSetValueA
PathIsDirectoryA
PathRemoveBlanksA
PathRemoveBackslashA
PathFileExistsA
PathAppendA
wnsprintfA
StrStrIA
PathStripToRootA
PathRemoveFileSpecA
PathFindFileNameA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

ws2_32

WSAStartup
WSACleanup
gethostbyname
gethostname

msvcrt

__p__fmode
__set_app_type
_controlfp
__p__commode
_adjust_fdiv
??1type_info@@UAE@XZ
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
strncat
_stricmp
_strnicmp
_tempnam
srand
rename
_ltoa
atol
_mbschr
sprintf
strncpy
_mbstok
atoi
_local_unwind2
_except_handler3
memmove
localtime
time
_snwprintf
sscanf
_mbscmp
malloc
_ismbcupper
tolower
ftell
fread
strchr
strrchr
fwrite
wcslen
fopen
rewind
fgets
strstr
fputs
fclose
fseek
_mbsnbcpy
rand
free
_mbsrchr
_snprintf
_mbsicmp
__CxxFrameHandler
??2@YAPAXI@Z
_strlwr
_wcsicmp
_wcsnicmp
??0exception@@QAE@ABV0@@Z
strlen
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
memcpy
printf
__setusermatherr

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsA

user32

FindWindowExA
GetClassNameA
IsWindow
SendMessageA
FindWindowA
GetParent

ole32

CoInitialize
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoCreateGuid

oleaut32

SysAllocStringLen
SysStringLen
SysFreeString

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64ab6f80b8539cc7ad569621f1064e71

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

70:4e:e7:9f:85:6a:67:01:6f:01:25:41:a7:5f:64:46Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:e4:db:98:20:e0:64:a7:06:e5:57:20:9a:d9:f1:8a:36:6c:52:fdSigner

Headers

File Characteristics

Imports

shell32

userenv

kernel32

advapi32

shlwapi

version

ws2_32

msvcrt

wtsapi32

user32

ole32

oleaut32

Sections

.text Size: 108KB - Virtual size: 106KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 1KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

70:4e:e7:9f:85:6a:67:01:6f:01:25:41:a7:5f:64:46
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:e4:db:98:20:e0:64:a7:06:e5:57:20:9a:d9:f1:8a:36:6c:52:fd
Signer

.text
Size: 108KB - Virtual size: 106KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 1KB