General

Malware Config

Signatures

Files

• 65b64a06c6315d0fd8abc2d1114a4251_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  24f4613d0395ec689682abd0a1f8a028

  
  

  Code Sign

  01

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  30-05-2000 10:48

  Not After

  30-05-2020 10:48

  Subject

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  48:ec:05:2d:ad:94:98:23:d9:66:e3:f7:7e:c8:1e:59

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  23-05-2018 00:00

  Not After

  23-05-2019 23:59

  Subject

  CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

  Certificate

  Issuer

  CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

  Not Before

  30-05-2000 10:48

  Not After

  30-05-2020 10:48

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  e0:e4:5f:7f:49:c6:3c:aa:83:25:9d:b0:7d:c1:c2:75:c2:fb:ef:35

  Signer

  Actual PE Digest

  e0:e4:5f:7f:49:c6:3c:aa:83:25:9d:b0:7d:c1:c2:75:c2:fb:ef:35

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  InitializeCriticalSectionAndSpinCount

  LocalAlloc

  LoadLibraryA

  CreateEventW

  WaitForSingleObject

  SetFilePointer

  SetFilePointerEx

  SetEndOfFile

  GetFileSize

  ReadFile

  GetFileAttributesExW

  GetCurrentProcessId

  GetTempFileNameW

  GetTickCount

  GetSystemTimeAsFileTime

  MapViewOfFile

  HeapFree

  FindClose

  GetFullPathNameW

  FindFirstFileW

  FindNextFileW

  DebugBreak

  OutputDebugStringW

  lstrlenA

  LoadLibraryW

  MulDiv

  lstrcmpW

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  FlushFileBuffers

  CloseHandle

  CreateFileW

  WriteConsoleW

  SetStdHandle

  LCMapStringW

  GetConsoleMode

  GetConsoleCP

  DeleteCriticalSection

  RtlUnwind

  QueryPerformanceCounter

  GetFileType

  SetHandleCount

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetStringTypeW

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetStdHandle

  WriteFile

  HeapReAlloc

  HeapCreate

  ExitProcess

  HeapSize

  Sleep

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TerminateProcess

  GetStartupInfoW

  HeapSetInformation

  GetCommandLineW

  DecodePointer

  EncodePointer

  InterlockedPopEntrySList

  VirtualAlloc

  VirtualFree

  IsProcessorFeaturePresent

  HeapAlloc

  GetProcessHeap

  InterlockedIncrement

  InterlockedDecrement

  lstrlenW

  GetModuleFileNameW

  LoadLibraryExW

  FindResourceW

  LoadResource

  SizeofResource

  MultiByteToWideChar

  lstrcmpiW

  FreeLibrary

  SetLastError

  GetLastError

  RaiseException

  GetCurrentThreadId

  FlushInstructionCache

  GetCurrentProcess

  GetModuleHandleW

  GetProcAddress

  LeaveCriticalSection

  EnterCriticalSection

  WideCharToMultiByte

  InterlockedPushEntrySList

  InterlockedCompareExchange

  user32

  DestroyWindow

  LoadCursorW

  CreateWindowExW

  RegisterClassExW

  SetTimer

  KillTimer

  DefWindowProcW

  GetWindowLongW

  GetClassInfoExW

  SetWindowLongW

  CallWindowProcW

  RegisterWindowMessageW

  BeginPaint

  FillRect

  EndPaint

  IsChild

  SetFocus

  GetDlgItem

  GetClassNameW

  GetSysColor

  RedrawWindow

  CreateAcceleratorTableW

  InvalidateRect

  GetDesktopWindow

  GetFocus

  UpdateWindow

  SetWindowTextW

  GetWindowTextW

  GetWindowTextLengthW

  ClientToScreen

  ReleaseDC

  GetDC

  PostMessageW

  ShowWindow

  IsWindowVisible

  GetWindow

  MonitorFromWindow

  GetMonitorInfoW

  GetParent

  GetClientRect

  MapWindowPoints

  SetWindowPos

  MoveWindow

  GetWindowRect

  IsWindow

  SendMessageW

  LoadImageW

  LoadIconW

  PeekMessageW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  CharNextW

  UnregisterClassA

  gdi32

  CreateSolidBrush

  GetStockObject

  GetDeviceCaps

  GetObjectW

  SelectObject

  DeleteDC

  DeleteObject

  CreateCompatibleDC

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  RegQueryInfoKeyW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegCreateKeyExW

  RegOpenKeyExW

  RegCloseKey

  shell32

  Shell_NotifyIconW

  CommandLineToArgvW

  DoEnvironmentSubstW

  ole32

  OleInitialize

  CreateStreamOnHGlobal

  OleLockRunning

  OleUninitialize

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoTaskMemFree

  CoCreateInstance

  oleaut32

  SysAllocString

  VariantChangeType

  VariantClear

  OleCreateFontIndirect

  DispCallFunc

  VarBstrCat

  SysStringByteLen

  SysAllocStringByteLen

  LoadTypeLi

  LoadRegTypeLi

  VarUI4FromStr

  SysStringLen

  SysFreeString

  VariantInit

  VariantCopy

  shlwapi

  PathFileExistsW

  Sections

  .text

  Size: 353KB - Virtual size: 352KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 135KB - Virtual size: 134KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ