General

Malware Config

Signatures

Files

• 65bc7bf83bf8c66d1d367480da743d9f_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  260725db05d85038f0d2595a14b7e42a

  
  

  Code Sign

  c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  10-01-1997 07:00

  Not After

  31-12-2020 07:00

  Subject

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  10-01-1997 07:00

  Not After

  31-12-2020 07:00

  Subject

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  2e:ab:11:dc:50:ff:5c:9d:cb:c0

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  22-08-2007 22:31

  Not After

  25-08-2012 07:00

  Subject

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:0f:78:4d:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-08-2007 00:23

  Not After

  23-02-2009 00:33

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  61:14:2c:a7:00:00:00:00:00:06

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12-06-2007 23:54

  Not After

  13-06-2012 00:04

  Subject

  CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  61:14:2c:a7:00:00:00:00:00:06

  Certificate

  Issuer

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12-06-2007 23:54

  Not After

  13-06-2012 00:04

  Subject

  CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

  Certificate

  Issuer

  CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

  Not Before

  16-09-2006 01:04

  Not After

  15-09-2019 07:00

  Subject

  CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  b2:b6:12:6b:3e:36:f4:30:1d:b6:de:81:27:85:d7:2a:3f:60:f9:e2

  Signer

  Actual PE Digest

  b2:b6:12:6b:3e:36:f4:30:1d:b6:de:81:27:85:d7:2a:3f:60:f9:e2

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  aspnet_state.pdb

  Imports

  kernel32

  SetWaitableTimer

  CloseHandle

  CreateThread

  CreateWaitableTimerW

  CreateEventW

  SetConsoleCtrlHandler

  FormatMessageW

  InterlockedIncrement

  InterlockedDecrement

  GetSystemTimeAsFileTime

  lstrlenW

  WideCharToMultiByte

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  Sleep

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetSystemInfo

  WaitForSingleObject

  SetEvent

  GetProcessAffinityMask

  SwitchToThread

  MultiByteToWideChar

  GetLastError

  HeapReAlloc

  InterlockedCompareExchange

  InterlockedExchange

  HeapFree

  HeapAlloc

  GetProcAddress

  HeapDestroy

  HeapCreate

  FreeLibrary

  GetCurrentProcessId

  msvcr80

  __set_app_type

  _except_handler4_common

  _unlock

  __dllonexit

  _lock

  _onexit

  _decode_pointer

  ?terminate@@YAXXZ

  _invoke_watson

  _controlfp_s

  _encode_pointer

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _configthreadlocale

  _initterm_e

  _purecall

  strncmp

  memcpy

  _vsnwprintf_s

  memset

  _itoa_s

  _amsg_exit

  __wgetmainargs

  _cexit

  _exit

  _XcptFilter

  exit

  __winitenv

  _initterm

  strtol

  strstr

  strchr

  advapi32

  RegCloseKey

  RegisterServiceCtrlHandlerW

  StartServiceCtrlDispatcherW

  RegQueryValueExW

  RegOpenKeyExW

  SetServiceStatus

  mswsock

  GetAcceptExSockaddrs

  AcceptEx

  ole32

  CoUninitialize

  CoInitializeEx

  ws2_32

  recv

  select

  WSASend

  WSARecv

  WSAGetOverlappedResult

  WSAAddressToStringA

  gethostbyname

  ntohs

  WSACleanup

  WSAStartup

  closesocket

  WSASocketW

  WSAGetLastError

  setsockopt

  htons

  htonl

  bind

  listen

  inet_ntoa

  mscoree

  ClrCreateManagedInstance

  webengine

  PerfCounterInitialize

  InitializeLibrary

  XspLogEvent

  AttachHandleToThreadPool

  LoadLibraryUsingFullPath

  PrintResourceString

  AspnetLoadResourceDLL

  GetXSPHeap

  Exports

  Exports

  _STWNDCloseConnection@4

  _STWNDDeleteStateItem@4

  _STWNDEndOfRequest@4

  _STWNDGetLocalAddress@8

  _STWNDGetLocalPort@4

  _STWNDGetRemoteAddress@8

  _STWNDGetRemotePort@4

  _STWNDIsClientConnected@4

  _STWNDSendResponse@24

  Sections

  .text

  Size: 20KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ