5293caf8da5a2ec1c309b2350b8c3dd9_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5293caf8da5a2ec1c309b2350b8c3dd9_JaffaCakes118
Size

3.5MB
MD5

5293caf8da5a2ec1c309b2350b8c3dd9
SHA1

29468c93893106897c24bd141eb6ab418114c3b9
SHA256

a1dec2c5f22022b4978a4a77dff567d90f34ad47d9ebddb93ed67a833cdceb72
SHA512

d25412c34d6f47b6bdafe31dcc8cac6f2822a122098010e34e05757cab39c7bc33665f4f87d0254e85acaea7af82eda8731308c5c270e35072a20ba2e0e32e8b
SSDEEP

49152:iootQwPR5/uU6SkrjFdr9cLS3nMI/05zOKE1antX00I2qTtMi5PKJxxpfKuNsIu7:PkQS2U6zjTxP/05zvntX0L9Oau3b2EM

Score

1^/10

Malware Config

Signatures

Files

5293caf8da5a2ec1c309b2350b8c3dd9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

509bdf03a1612215885dcab70e53c041

Code Sign

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-08-2017 20:23

Not After

11-08-2018 20:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:02:be:35:9f:50:5f:67:27:bb:d6:e5:46:91:5f:bf:14:5e:8b:09:0a:a2:ba:7c:3f:cc:1c:2c:ae:38:e5:10
Signer

Actual PE Digest

2d:02:be:35:9f:50:5f:67:27:bb:d6:e5:46:91:5f:bf:14:5e:8b:09:0a:a2:ba:7c:3f:cc:1c:2c:ae:38:e5:10

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA

user32

SetClipboardData

advapi32

GetAce

wsock32

htons

mpr

WNetAddConnection2W

shell32

SHGetFolderPathW

oleaut32

VariantInit

ole32

ProgIDFromCLSID

userenv

CreateEnvironmentBlock

comdlg32

GetSaveFileNameW

version

GetFileVersionInfoSizeW

iphlpapi

IcmpSendEcho

comctl32

ImageList_BeginDrag

winmm

mciSendStringW

wininet

InternetSetOptionW

psapi

GetProcessMemoryInfo

gdi32

StrokePath

uxtheme

IsThemeActive

Sections

Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

509bdf03a1612215885dcab70e53c041

Code Sign

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

2d:02:be:35:9f:50:5f:67:27:bb:d6:e5:46:91:5f:bf:14:5e:8b:09:0a:a2:ba:7c:3f:cc:1c:2c:ae:38:e5:10Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

wsock32

mpr

shell32

oleaut32

ole32

userenv

comdlg32

version

iphlpapi

comctl32

winmm

wininet

psapi

gdi32

uxtheme

Sections

Size: - Virtual size: 3.6MB

Size: 1KB - Virtual size: 4KB

.rsrc Size: 2.8MB - Virtual size: 2.9MB

Size: 94KB - Virtual size: 96KB

33:00:00:01:74:69:de:10:8b:37:65:a8:d7:00:00:00:00:01:74
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

2d:02:be:35:9f:50:5f:67:27:bb:d6:e5:46:91:5f:bf:14:5e:8b:09:0a:a2:ba:7c:3f:cc:1c:2c:ae:38:e5:10
Signer

.rsrc
Size: 2.8MB - Virtual size: 2.9MB