5dac4f8cc0d6b2512f7601c29891b985_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5dac4f8cc0d6b2512f7601c29891b985_JaffaCakes118
Size

20KB
MD5

5dac4f8cc0d6b2512f7601c29891b985
SHA1

c2b6aa87b4294e66e1f91e998b8b65909d3b9148
SHA256

57a571e5d7f11d6da3fb8688906b174a01abb3c1c6276845c5cdc23304ef0074
SHA512

1ae26744068cbcbb956c05e74ff62513d3527d4394ecdb7b28c0dfb9df3ccd7e2464d3af627f5506ac64dec3232961a171195c7601885779504dacd7d87056db
SSDEEP

384:f991FrtuyWpKBiqiKT7LzJ3mirILlUTNMeM7x:z1F4HpKY2T7L0IILz

Score

1^/10

Malware Config

Signatures

Files

5dac4f8cc0d6b2512f7601c29891b985_JaffaCakes118
.sys windows:5 windows x86 arch:x86

b67b0ea8b7a4a0db6ac7e809fe3c1358

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:00:26:b7:ae:29:96:3b:60:8d:61:91:1b:77:1e:16
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/05/2012, 00:00

Not After

10/08/2015, 23:59

Subject

CN=Beijing Rising Information Technology Corporation Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Rising Information Technology Corporation Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:1c:f8:c6:da:4a:c1:6a:26:ee:22:ab:9c:a8:24:db:ff:a6:82:79
Signer

Actual PE Digest

b6:1c:f8:c6:da:4a:c1:6a:26:ee:22:ab:9c:a8:24:db:ff:a6:82:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\DistributedAutoLink\Temp\CompileOutputDir\protreg.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
strlen
RtlInitUnicodeString
strcpy
IoCreateFile
memset
ZwClose
ObReferenceObjectByHandle
ZwWriteFile
DbgPrint
ZwRestoreKey
memcpy
_wcsicmp
wcscat
ExFreePoolWithTag
IoRegisterShutdownNotification
NtBuildNumber
ZwQuerySymbolicLinkObject
KeSetPriorityThread
IoDeleteDevice
MmGetSystemRoutineAddress
ZwDeleteValueKey
ZwOpenSymbolicLinkObject
wcslen
KeDelayExecutionThread
ObQueryNameString
ZwCreateFile
PsCreateSystemThread
ExAllocatePool
IoUnregisterShutdownNotification
KeGetCurrentThread
PsTerminateSystemThread
ZwEnumerateValueKey
IofCompleteRequest
IoCreateDevice
wcscpy
RtlCreateRegistryKey
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
_except_handler3

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 544B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b67b0ea8b7a4a0db6ac7e809fe3c1358

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

41:00:26:b7:ae:29:96:3b:60:8d:61:91:1b:77:1e:16Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

b6:1c:f8:c6:da:4a:c1:6a:26:ee:22:ab:9c:a8:24:db:ff:a6:82:79Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 416B - Virtual size: 388B

.data Size: 3KB - Virtual size: 3KB

INIT Size: 1024B - Virtual size: 1000B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 544B - Virtual size: 532B

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

41:00:26:b7:ae:29:96:3b:60:8d:61:91:1b:77:1e:16
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

b6:1c:f8:c6:da:4a:c1:6a:26:ee:22:ab:9c:a8:24:db:ff:a6:82:79
Signer

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 416B - Virtual size: 388B

.data
Size: 3KB - Virtual size: 3KB

INIT
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 544B - Virtual size: 532B