5bf86d1457b3fbfb17b3b3d6bf42e2a7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5bf86d1457b3fbfb17b3b3d6bf42e2a7_JaffaCakes118
Size

801KB
MD5

5bf86d1457b3fbfb17b3b3d6bf42e2a7
SHA1

05a1e0c73e1702c6f461e3d08742377a8640c515
SHA256

31d40e0a427f07e4555f46e8fbc7ce6d79684d7885075b81b129662ff53fefa9
SHA512

a4a70fd6ed310b2a652f01100f0acfa41058cc84962d19ebaf860f2ee582c0766b94d6887fbd6282e1b438d8a04e30cc2e6600aca9fcea59676ec19246f24d5a
SSDEEP

24576:vcolJr6XW/rnDJYjXZy0jXLNICn71+fZn:X/r6XWbDYZ7XLNI67M

Score

1^/10

Malware Config

Signatures

Files

5bf86d1457b3fbfb17b3b3d6bf42e2a7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c3c108a08daa7a412448cb602f27e635

Code Sign

5d:f9:01:32:bb:5c:d1:1b:2a:5a:55:6b:6f:84:13:34
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

24/02/2017, 00:00

Not After

07/09/2017, 23:59

Subject

CN=\"Master-Sintez\"\, Ltd.,O=\"Master-Sintez\"\, Ltd.,POSTALCODE=107497,STREET=Montazhnaya\, House 9\, Structure 3 A,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0f:c1:c7:03:58:77:60:f2:74:b3:9f:d6:78:d6:52:ce:19:fd:19:20:32:de:94:fc:2a:0c:00:52:99:5e:65:b2
Signer

Actual PE Digest

0f:c1:c7:03:58:77:60:f2:74:b3:9f:d6:78:d6:52:ce:19:fd:19:20:32:de:94:fc:2a:0c:00:52:99:5e:65:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexW
GetFileAttributesW
VirtualProtect
Sleep
FindClose
GetFileSize
VirtualAlloc
GetTickCount
HeapAlloc
OpenSemaphoreW
CreateDirectoryA
InterlockedIncrement
GetSystemDirectoryW
SetFileAttributesW
SetThreadPriority
InitializeCriticalSection
TerminateProcess
GetCurrentThread
GetCurrentDirectoryW
GetCurrentThreadId
DeleteFileW
SetThreadPriorityBoost
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
TerminateThread
WaitForMultipleObjects
RaiseException
SetFilePointer
FlushFileBuffers
GetLastError
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
CloseHandle
WriteFile
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetProcAddress
HeapReAlloc
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind

user32

GetDC
DestroyWindow
ShowWindow
PostMessageW
MessageBoxA

advapi32

LookupAccountNameA

ole32

CoCreateInstance

oleaut32

SysFreeString

msacm32

acmFormatChooseW

winscard

SCardForgetReaderA

ws2_32

select
recv

Sections

.text
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 648KB - Virtual size: 651KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c3c108a08daa7a412448cb602f27e635

Code Sign

5d:f9:01:32:bb:5c:d1:1b:2a:5a:55:6b:6f:84:13:34Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

0f:c1:c7:03:58:77:60:f2:74:b3:9f:d6:78:d6:52:ce:19:fd:19:20:32:de:94:fc:2a:0c:00:52:99:5e:65:b2Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

msacm32

winscard

ws2_32

Sections

.text Size: 72KB - Virtual size: 69KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 648KB - Virtual size: 651KB

.rsrc Size: 36KB - Virtual size: 34KB

5d:f9:01:32:bb:5c:d1:1b:2a:5a:55:6b:6f:84:13:34
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

0f:c1:c7:03:58:77:60:f2:74:b3:9f:d6:78:d6:52:ce:19:fd:19:20:32:de:94:fc:2a:0c:00:52:99:5e:65:b2
Signer

.text
Size: 72KB - Virtual size: 69KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 648KB - Virtual size: 651KB

.rsrc
Size: 36KB - Virtual size: 34KB