63d5b2eb29444e1deb91d3fdfb806547_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

63d5b2eb29444e1deb91d3fdfb806547_JaffaCakes118
Size

587KB
MD5

63d5b2eb29444e1deb91d3fdfb806547
SHA1

53191d46be7a53d8a62878ad39fd8a316794576f
SHA256

22ea24cc2bf9e199bef745b8582c6404bbf28496d1a885d42e60561ddf91c630
SHA512

062e430bd86fba316e59e674e10d98d9f18cf91730f1212addf7ccde69e288b6eaaa22f029eef8629df7f1edc40641bfadf69ffc4e533d2cafc83e2e956ee518
SSDEEP

12288:8ZWzPqnz2f8XdBKYdMofPQTWTVrVGdzl5ybIDl39EtHyp66fv9:iWzPqnSU2NOhVUzl5ybIDl3e66+v9

Score

1^/10

Malware Config

Signatures

Files

63d5b2eb29444e1deb91d3fdfb806547_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0ee1334b2cf8dce7cef9660f00edf55

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:01:f1:f3:cc:d2:f6:a9:5b:2a:2d:5c:53:06:f3:ea
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13-04-2015 00:00

Not After

12-04-2016 23:59

Subject

CN=FLAGMAN-SOFT,O=FLAGMAN-SOFT,POSTALCODE=646822,STREET=4\, kv.1\, ul.Vodoprovod,L=S. PRISTANSKOE,ST=Omsk region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

20:80:78:7a:72:5c:5e:e1:69:cd:54:46:59:b4:5d:d7:6f:98:df:54
Signer

Actual PE Digest

20:80:78:7a:72:5c:5e:e1:69:cd:54:46:59:b4:5d:d7:6f:98:df:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

IsCharLowerA
MapVirtualKeyExW
GetShellWindow
CascadeChildWindows
GetDlgItemInt
LoadMenuIndirectW
EnumDisplayMonitors
GetParent
MessageBoxExW
CharUpperA
TabbedTextOutW
IsCharUpperA
EndTask
GetUserObjectSecurity
MonitorFromRect
OemKeyScan
FindWindowA
OpenWindowStationA
GetClassInfoA
SetClipboardViewer
GetIconInfo
SystemParametersInfoA
UnionRect
EqualRect
LockWorkStation
TranslateAcceleratorA
EnableScrollBar
TileChildWindows
ActivateKeyboardLayout
RegisterWindowMessageA
MapDialogRect
GetDesktopWindow
BroadcastSystemMessageExW
FrameRect
IsWindow
LoadStringW
ShowStartGlass
GetCursorInfo
CallNextHookEx
SetMenu
GetUserObjectInformationW
CopyIcon
CreateDialogIndirectParamW
EnumDesktopsW
SetDlgItemInt
SetLayeredWindowAttributes
GetScrollRange
CreateAcceleratorTableW
EndPaint
GetMenuBarInfo
DestroyCaret
EnumClipboardFormats
SetParent
MessageBeep
DragObject
IsMenu
SetUserObjectInformationW
SetCaretBlinkTime
DragDetect
SetWindowTextW
RegisterHotKey
LoadKeyboardLayoutA
IsHungAppWindow
CharToOemBuffW
TileWindows
ChangeDisplaySettingsW
DrawCaptionTempW
IsCharLowerW
SendMessageTimeoutW
UnhookWindowsHook
LoadCursorW
DlgDirSelectExA
LoadStringA
LoadBitmapA
GetClipboardFormatNameA
SetLastErrorEx
LoadBitmapW
GetAsyncKeyState
MessageBoxW
GetMenuItemCount
GetAltTabInfoA
GetClipboardViewer
GetListBoxInfo
GetKeyState
IsChild
SetActiveWindow
PrintWindow
UnregisterDeviceNotification
AttachThreadInput
InvalidateRgn
OpenDesktopA
ModifyMenuW
DrawMenuBar
CreateIconFromResourceEx
CloseWindowStation
SetClassLongW
CopyImage
CharPrevExA
GetMenuItemID
LoadAcceleratorsA
AdjustWindowRectEx
SwapMouseButton
RegisterDeviceNotificationW
WinHelpW
SetScrollPos
MonitorFromPoint
GetComboBoxInfo
LoadImageA
OemToCharBuffW
DispatchMessageA
GetPropA
GetScrollInfo
CreatePopupMenu
GetMonitorInfoA
AnyPopup
DialogBoxIndirectParamW
GetSystemMenu
GetMenu
GetInputState
GetSysColorBrush
GetSysColor
DrawMenuBarTemp
GetMessageW
DrawCaptionTempA
MessageBoxA
SetWindowWord
SetMenuContextHelpId
IsHungAppWindow
GetShellWindow

kernel32

CancelWaitableTimer
FlushInstructionCache
QueryPerformanceCounter
GetFileSizeEx
SetUserGeoID
ReleaseMutex
DnsHostnameToComputerNameA
GetConsoleFontInfo
RtlZeroMemory
GetNamedPipeHandleStateA
GetExpandedNameA
RtlFillMemory
GlobalFix
HeapReAlloc
SetFileTime
UnmapViewOfFile
GetShortPathNameW
GetNamedPipeHandleStateW
OpenFileMappingA
GetCommModemStatus
GetComputerNameExA
GetCurrentThread
WriteConsoleOutputCharacterW
CreateNamedPipeW
GetCPInfoExA
OpenFileMappingW
SetVolumeMountPointW
InitializeCriticalSection
LCMapStringW
SearchPathA
DeleteTimerQueueTimer
QueryPerformanceFrequency
FindFirstFileW
ReadConsoleInputA
EnumCalendarInfoA
FindFirstVolumeW
TryEnterCriticalSection
SetDefaultCommConfigW
FatalAppExitW
CreatePipe
OutputDebugStringA
LZRead
lstrcpyA
GetProcessVersion
GetCPInfo
LoadResource
GetTickCount
HeapAlloc
GetCommandLineW
SetVolumeLabelA
ReplaceFileA
FreeEnvironmentStringsW
TlsGetValue
WriteProfileSectionW
MoveFileExA
SetVolumeLabelW
RegisterWaitForInputIdle
LockFile
GetCommMask
ReadConsoleInputExW
GetSystemTime
GetThreadTimes
SetFileApisToOEM
EnumCalendarInfoExW
EnumResourceTypesA
UnlockFile
GetOEMCP
IsBadHugeWritePtr
GlobalLock
GetVolumePathNamesForVolumeNameW
WaitForSingleObject
GetExpandedNameW
GetSystemDefaultLangID
GetCurrentThreadId
lstrcpy
TransactNamedPipe
ReadConsoleW
GetStringTypeW
FlushViewOfFile
GetGeoInfoW
CreateEventW
GetFileAttributesExA
GlobalWire
CancelDeviceWakeupRequest
ReadConsoleOutputW
WaitForMultipleObjectsEx
FindNextVolumeMountPointA
GetConsoleKeyboardLayoutNameW
RaiseException
InterlockedIncrement
ReadFileEx
GlobalAlloc
FindFirstVolumeMountPointW
GetNumberOfConsoleMouseButtons
FreeConsole
GetConsoleKeyboardLayoutNameA
VerLanguageNameA
GlobalGetAtomNameA
DosPathToSessionPathW
RequestDeviceWakeup
RemoveDirectoryA
QueryDosDeviceW
CompareStringA
CreateHardLinkA
TransmitCommChar
VerifyVersionInfoW
ExitThread
DeleteFileW
EnumTimeFormatsW
OpenSemaphoreW
GetCurrentProcess
GetProcessHeap
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

oleaut32

VarAnd
CreateErrorInfo

gdi32

TextOutW

wtsapi32

WTSDisconnectSession

comctl32

CreatePropertySheetPageW
FlatSB_ShowScrollBar
GetEffectiveClientRect
LBItemFromPt
ImageList_DragLeave

Exports

Exports

�u�Ȑv��)��W�)�[@�S�SiKH�8�A��_�� <��4�5�g�Z4�I��g��驑U��]R��2:�U7#�ϧ�oH��Q�%��w�U5�OP�,�r��1�T�;�v �EI,D��%W�:{��-@��p6��d�ſ�X��%��C��3[�K�)��fR�F�>��Zi��3��SZ��)zE��IדRuL��-lFC=X�{C ��IF�ȣ��^F��m[3R��yA>1��l��\! z CXd��IP��~�̀��1�4��Ⱦ�|^j�n Z�`��t8��e:;��̿X�P�B|^�<V�gU�tJ��P��L��]�hh�tD^<��(Ɩ�h��q��Q�� G'�q�J3��,��6��<5~��>1a�:��í��qUo�h�Bv�-�L?y;��fz�[q�i#x��te��h��)��Y*,?V��rJ3��{e8�I��8 ��G��3�/Ȁ��n��qq��#�c��3X��r]-�:]Ӈ�Õ�Ǔ ��]��n��^&��]C!��]9�:�/�>P�V�*&��+�3{��b6�A��r��TrjFC��*j.��-dT��3�w�G"q�f(�U�U��AB�Un�1JNdzz�uVy�;��W��In�e\;�1/|g˸(=7��*I ��|=��:�0�s2~hj��z?�G��MAwVt ��0��immTd͕:��nC��V��GU�� f�@��g�ƪ�X��ʞ��v��\�(6ك�6{��B��VQ�wt��3Hv�aR�a�6.��G�%�/7�1W:��q(U �S\�+�"=��¼G)CGdFcV �kG�*��`�\.�3v:3��]�&��[��J��%4�]�zgF�E�k0��uݣ�@Y��hJ�O��h?�dLo��i1�WPxPM��b�݆�5C'��Рb�%��A? �D�~�1��*{��DP�d�r&Ӂ�X��-@Y��,p V�@��`��Lq^s�J#3��a%x=��(|��z��K�))�m~�P��G��ģ�^bXP��≻(��6��s �a8�G�V��h��I�ߵ��=Lk��&�� .� $A��HO��b�L�� $�S^|糏d��#��Y��:j�IE5��R��H��`��w׋��i�9#|¾�aյ��>��K�I>��y �&�#�L��y��]��^�0 o��w��|gsW�x��a��U:k�4��*��O�p-�/Y��rW�2�]��o|��*��.��í\�-N'l�:ln��u(��<_ˈ4>�R�� L>�= <E&�:R�p�m �ԚAu�qC��Mݴ�?KV!?#Eҿ��1<b/�T�o�?Lu�c��Ke��J�xg�/�e��g�#mg��t��y�"$X��T��!nU�-��/io�"��Cy �Rb�ࡏt�}��Z2(�UuM��T��L�Z�U ��TR?�LiI��e�x{�6�i��C|��=�*�[ ��v��9��İVK��4��R��z-�D��r�0+�Z��v�o�EМQ�3�tg��T({��D��z��͇c��ۆ<�Z�J�=��k�&a��zxkGdo\hL�#F?�3|��ԧg+�%�\�3�$�!YM��o�H2"�-3Rw��nR_h��4� q2�ho|��eU��TG��_QP|c�_��w3�&ko�^ ^��hx�ƴ�тJDN��,�Zj��H�qXs3l��dAת�B��'?B��g��2Kk̘��1��7~�H|A׹u�qPu.1��4+�A��D� �wPn?��"��6�}'`��7�G3z�A��*��&��*h{�#�|l_�l<�P��`R��O)� ��-7�K��2�ވ� �w�qP�QM�5�B��gӠ?ȥ!�l��P��B^�׆��1� �/��J Xh3��C�Nn��'w�A��#��Ļ�%��%��b�,��M�N4U��Pb=JJ�o�~��So��%�tj��8��D��,Ȱmp�1Y�AC��`ʮ�>9��N-�5U�2�v��B��p!�m�>�|s_z�tA%��4�4�~H[�+��d!e�G�/�o0��BX6|3�f��40Kj�X8B@H`DaOM� t�O��^��zs�f5�uEH�`�Ҕ:}��J�� H\��r��P}��G�D$">~�֏�*iդ%�M(㒮��7A��`��nd{}R��Q�S�}�]��M.ew15��R�5pй/�J��Q��B|��y�n0�h��w ��7�Lӫ5��Y=\~�Aث,L �8__��i9"��n��$��HQ��蹓 �k��#a^bތ�qr��6�+�� 4V�� U�\E�\�� [`��L��%5B8�?m ��Rt��=�$(nv��vwS�g�m�,�_�>��>@�Tb.#z��FJu8?�h[Ϡ�D�~Q�~H��G]Wý��9H�}��yc� c̕f9p�W�6��s�H�(�ݸ=*MӮ��ƕ��C��jd�L|��ZH�um<>0��=J��j�g�`�LU��x�찻��D�8��a_'m��\�w�7�}��~�$8g�{%��L�<��͠kr|u�� a��4�}<��F��(Xo;��r�sJ��Mu�$hC��³D�NP��P&ʣ�W�A��X�j��/��̎Ě+�Z��c�?�Ϛ�)��f+�R��6�p�D�Q�H�,#��-OS�y�q,li��!=�"�E�^��`Z��vQx*�u��ļ2|5�9�ֈ(�Z�C�.0fsΧa��+��x�.��E�}�;��M�PG�v�

Sections

CODE
Size: 437KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 14KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ee1334b2cf8dce7cef9660f00edf55

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

70:01:f1:f3:cc:d2:f6:a9:5b:2a:2d:5c:53:06:f3:eaCertificate

Extended Key Usages

Key Usages

20:80:78:7a:72:5c:5e:e1:69:cd:54:46:59:b4:5d:d7:6f:98:df:54Signer

Headers

File Characteristics

Imports

user32

kernel32

oleaut32

gdi32

wtsapi32

comctl32

Exports

Exports

Sections

CODE Size: 437KB - Virtual size: 440KB

DATA Size: 14KB - Virtual size: 20KB

.idata Size: 6KB - Virtual size: 8KB

.text0 Size: 17KB - Virtual size: 20KB

.tls Size: 512B - Virtual size: 4KB

.text1 Size: 64KB - Virtual size: 68KB

.reloc Size: 5KB - Virtual size: 8KB

.rsrc Size: 35KB - Virtual size: 34KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

70:01:f1:f3:cc:d2:f6:a9:5b:2a:2d:5c:53:06:f3:ea
Certificate

20:80:78:7a:72:5c:5e:e1:69:cd:54:46:59:b4:5d:d7:6f:98:df:54
Signer

CODE
Size: 437KB - Virtual size: 440KB

DATA
Size: 14KB - Virtual size: 20KB

.idata
Size: 6KB - Virtual size: 8KB

.text0
Size: 17KB - Virtual size: 20KB

.tls
Size: 512B - Virtual size: 4KB

.text1
Size: 64KB - Virtual size: 68KB

.reloc
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 35KB - Virtual size: 34KB