5d967f83e0c981fccc0a0dc725c13e17_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
5d967f83e0c981fccc0a0dc725c13e17_JaffaCakes118
Size 774KB
Sample240520-g1mfvsff8t
SHA256 8bf9564b2c01286e373eaa576d0cceb44b3e7adec958ceb8ba7b7115fa2f0586
MD5 5d967f83e0c981fccc0a0dc725c13e17
SHA1 7e1a3b770c6abcff322ba27f975559f71e97ff3c
SHA512 eb68556a805b584dc385a4cb1941198085bf391a011bfcc54ca40b2388e0e10e77b8fa02b418145a9eecf385187fd34ff0f93e72ebd0c4ce0e8f9a67013b642d
SSDEEP 12288:AYcWjXkAglfMCGqnjChEvv+t9BjGfIDD0A/s7fYWjieKd2/ZB+e:ARxlfMCBjmfBds7YWFZBr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

5d967f83e0c981fccc0a0dc725c13e17_JaffaCakes118

.exe 774KB

5d967f83e0c981fccc0a0dc725c13e17_JaffaCakes118

IMPHASH f22e47c7067edff45662c6cd23a892ff
SHA256 8bf9564b2c01286e373eaa576d0cceb44b3e7adec958ceb8ba7b7115fa2f0586
MD5 5d967f83e0c981fccc0a0dc725c13e17
SHA1 7e1a3b770c6abcff322ba27f975559f71e97ff3c
SHA512 eb68556a805b584dc385a4cb1941198085bf391a011bfcc54ca40b2388e0e10e77b8fa02b418145a9eecf385187fd34ff0f93e72ebd0c4ce0e8f9a67013b642d
SSDEEP 12288:AYcWjXkAglfMCGqnjChEvv+t9BjGfIDD0A/s7fYWjieKd2/ZB+e:ARxlfMCBjmfBds7YWFZBr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a4:45:f7:c4:45:3f:4c:b0:3d:79:5a:38:8e:a5:7b:b9:5f:61:8d:8c:03:0e:34:4f:3e:87:55:7e:86:3f:44:42

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Jul 14, 2017

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

94:0e:27:0b:56:f7:db:63:e8:f7:67:8c:68:89:78:08:ae:72:43:85

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Chains

Jul 14, 2017

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

14:f8:fd:d1:67:f9:24:02:b1:57:0b:5d:c4:95:c8:15

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 29, 2016 - Nov 21, 2019

Subject

CN=Dummy certificate

Serial Number

Issuer

CN=Unknown issuer

Key Usages

KeyUsageCertSign

Ext Key Usages

Timespan

Jan 1, 2013 - Apr 1, 2013

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Serial Number

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 16, 2015 - Dec 16, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

98352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LCMapStringA LCMapStringW Sleep GetStringTypeA GetStringTypeW UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType SetUnhandledExceptionFilter IsBadReadPtr IsBadWritePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA VirtualAlloc GetProfileStringA InterlockedExchange VirtualFree HeapCreate HeapDestroy GetTimeZoneInformation HeapSize HeapReAlloc TerminateProcess GetACP RaiseException HeapFree ExitProcess GetCommandLineA GetStartupInfoA HeapAlloc RtlUnwind FileTimeToLocalFileTime FileTimeToSystemTime SetErrorMode SystemTimeToFileTime LocalFileTimeToFileTime GetFileSize GetCurrentDirectoryA lstrcpyW CopyFileA GlobalSize SizeofResource GetOEMCP GetCPInfo TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalAlloc GlobalFlags GetProcessVersion FormatMessageA LocalFree GetShortPathNameA GetThreadLocale GetStringTypeExA GetVolumeInformationA FindFirstFileA FindClose DeleteFileA MoveFileA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle SetLastError GetLastError GetDiskFreeSpaceA GetFileTime SetFileTime GetFullPathNameA GetTempFileNameA GetFileAttributesA GetTickCount CloseHandle GetModuleFileNameA GetCurrentThread GlobalAlloc lstrlenW lstrcmpA MulDiv MultiByteToWideChar WideCharToMultiByte InterlockedIncrement GlobalFree InterlockedDecrement WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA FreeLibrary FindResourceA LoadResource LockResource GetCurrentThreadId lstrcmpiA GlobalFindAtomA GlobalDeleteAtom GetModuleHandleA lstrcatA GlobalLock lstrcpynA GlobalUnlock GlobalGetAtomNameA GlobalAddAtomA GetVersion lstrcpyA lstrlenA LoadLibraryA GetModuleHandleW LoadLibraryW IsBadCodePtr GetProcAddress

user32

GetTabbedTextExtentA WindowFromPoint DestroyIcon CharNextA GetNextDlgGroupItem PostThreadMessageA FindWindowA SetTimer KillTimer InvertRect GetDCEx LockWindowUpdate CreateDialogIndirectParamA GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetNextDlgTabItem MoveWindow SetWindowTextA IsDialogMessageA SetDlgItemTextA SendDlgItemMessageA MapWindowPoints GetSysColor DispatchMessageA ScreenToClient DeferWindowPos BeginDeferWindowPos EndDeferWindowPos ScrollWindow GetScrollInfo SetScrollInfo GetScrollRange SetScrollRange GetScrollPos SetScrollPos GetTopWindow MessageBoxA IsChild RegisterClassA TrackPopupMenu GetWindowTextLengthA GetWindowTextA DefWindowProcA DestroyWindow SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow IntersectRect RemoveMenu GetWindowPlacement GetWindowRect GetSystemMetrics GetLastActivePopup IsWindowVisible IsIconic GetFocus EqualRect GetDlgItem GetKeyState GetDlgCtrlID UnpackDDElParam ReuseDDElParam SetActiveWindow WinHelpA SetMenu LoadIconA GetClassInfoA DestroyMenu SetFocus ShowWindow GetDesktopWindow GetWindow IsWindowEnabled SetCursor PeekMessageA GetCapture ReleaseCapture LoadAcceleratorsA SetRectEmpty RegisterWindowMessageA GetActiveWindow wsprintfA GetMenuItemID AdjustWindowRectEx RedrawWindow SetWindowPos GetWindowLongA SetWindowLongA IsWindow DefMDIChildProcA DrawMenuBar TranslateAcceleratorA TranslateMDISysAccel DefFrameProcA CreateWindowExA UpdateWindow FillRect UnregisterClassA HideCaret ShowCaret ExcludeUpdateRgn DrawFocusRect DefDlgProcA IsWindowUnicode EnableWindow ClientToScreen GrayStringA DrawTextA TabbedTextOutA BringWindowToTop GetMenu GetMenuItemCount InvalidateRect ValidateRect OpenClipboard GetClipboardData CloseClipboard GetClientRect OffsetRect ShowScrollBar GetDC SendMessageA PostMessageA CopyRect LoadMenuA LoadStringA GetClassNameA GetSysColorBrush CharUpperA InflateRect GetSubMenu GetParent EndPaint BeginPaint GetWindowDC GetSystemMenu AppendMenuA IsZoomed EndDialog LoadCursorA DestroyCursor SetParent ReleaseDC GetMenuStringA DeleteMenu InsertMenuA RegisterClipboardFormatA MapDialogRect SetWindowContextHelpId GetMessageA TranslateMessage GetCursorPos ShowOwnedPopups PostQuitMessage InSendMessage CopyAcceleratorTableA IsRectEmpty MessageBeep PtInRect CountClipboardFormats IsClipboardFormatAvailable SetCapture SetRect SystemParametersInfoA

gdi32

PatBlt Rectangle CreatePen GetViewportOrgEx AbortDoc EndDoc EndPage StartPage StartDocA SetAbortProc DeleteDC SelectObject GetTextMetricsA StretchDIBits DeleteObject GetCharWidthA CreateFontA SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetStretchBltMode SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx SelectClipRgn ExcludeClipRect IntersectClipRect MoveToEx LineTo SetTextAlign GetCurrentPositionEx GetWindowOrgEx CreateRectRgn GetViewportExtEx CreateSolidBrush CreatePatternBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetMapMode SetRectRgn CombineRgn CreateRectRgnIndirect CopyMetaFileA GetTextColor GetBkColor LPtoDP GetNearestColor GetStretchBltMode GetPolyFillMode GetTextAlign GetBkMode GetROP2 GetTextFaceA GetWindowExtEx ScaleWindowExtEx GetDeviceCaps DPtoLP CreateDCA CreateBitmap SetBkColor SetTextColor GetClipBox CreateCompatibleDC CreateCompatibleBitmap BitBlt GetTextExtentPoint32A CreateFontIndirectA GetStockObject CreateDIBitmap GetTextExtentPointA GetObjectA

comdlg32

PrintDlgA FindTextA ReplaceTextA ChooseFontA GetFileTitleA CommDlgExtendedError GetSaveFileNameA GetOpenFileNameA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegQueryValueA RegCreateKeyA RegSetValueA GetFileSecurityA SetFileSecurityA RegOpenKeyA RegEnumKeyA SetFileSecurityW RegDeleteKeyA RegDeleteValueA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

shell32

ExtractIconA DragAcceptFiles DragQueryFileA DragFinish SHGetFileInfoA

comctl32

ord17

oledlg

ord3 ord5 ord4 ord11 ord8 ord1

ole32

CoDisconnectObject OleRegEnumVerbs OleRegGetMiscStatus GetRunningObjectTable WriteClassStg CoLockObjectExternal CreateBindCtx CoTaskMemAlloc ReadFmtUserTypeStg ReadClassStg OleDuplicateData SetConvertStg WriteFmtUserTypeStg CoTreatAsClass OleGetClipboard OleFlushClipboard OleIsCurrentClipboard CoGetClassObject CoRegisterMessageFilter CoRevokeClassObject CoFreeUnusedLibraries CreateGenericComposite CreateItemMoniker CreateStreamOnHGlobal OleSaveToStream WriteClassStm OleGetIconOfClass GetHGlobalFromILockBytes StgOpenStorageOnILockBytes CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes OleSave OleLoad OleCreate OleCreateLinkToFile OleCreateFromFile OleCreateStaticFromData OleCreateLinkFromData OleCreateFromData OleSetContainedObject StringFromCLSID OleLockRunning OleRegGetUserType CoTaskMemFree ReleaseStgMedium OleUninitialize OleInitialize CLSIDFromString CLSIDFromProgID StgIsStorageFile StgOpenStorage StgCreateDocfile CreateFileMoniker OleSetMenuDescriptor OleIsRunning OleRun

olepro32

ord253

oleaut32

SysFreeString SysAllocStringLen VariantClear VariantTimeToSystemTime SysStringLen SysAllocStringByteLen VariantCopy VariantChangeType SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

5d967f83e0c981fccc0a0dc725c13e17_JaffaCakes118

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

generic