694d5a3a3cbc40b8536b980a5e680124_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

694d5a3a3cbc40b8536b980a5e680124_JaffaCakes118
Size

538KB
MD5

694d5a3a3cbc40b8536b980a5e680124
SHA1

2cb661910d28140d159036929d52f227d9055402
SHA256

3e75d547934167b9b9a6fdf4b0a995ed74e67d1ed3c2c4f0f4dc2bb0e4c3533d
SHA512

3399bf64ff7569a8dcd89a2a894b8599e17f84e59e7c2cb7bfc22313bffe7993636320bef7c5a5d870efff205c8632a58723cc300a1d750a2ca3f3053f92ae7b
SSDEEP

12288:Lm4qc/tDdjTLbl2xTgZAGevyOFp5Tj8fJr0ytvK:Rqc/tDdjTLblxZE6OFpg0yty

Score

1^/10

Malware Config

Signatures

Files

694d5a3a3cbc40b8536b980a5e680124_JaffaCakes118
.dll windows:4 windows x64 arch:x64

582377d7a3d01124b56bbbf7ceee727b

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:74:18:0f:a9:40:be:e8:96:e1:b4:df:9e:21:77:0c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-09-2016 00:00

Not After

09-09-2019 23:59

Subject

CN=Cole Williams Software Limited,O=Cole Williams Software Limited,POSTALCODE=DN37 9PQ,STREET=8 Defender Drive,L=Grimsby,ST=North East Lincolnshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:74:18:0f:a9:40:be:e8:96:e1:b4:df:9e:21:77:0c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-09-2016 00:00

Not After

09-09-2019 23:59

Subject

CN=Cole Williams Software Limited,O=Cole Williams Software Limited,POSTALCODE=DN37 9PQ,STREET=8 Defender Drive,L=Grimsby,ST=North East Lincolnshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

73:53:68:37:9c:e7:82:e0:41:66:d0:02:f8:05:f8:3e:10:6e:ca:3c:c1:8a:d9:ad:9f:0d:35:52:49:5a:57:5e
Signer

Actual PE Digest

73:53:68:37:9c:e7:82:e0:41:66:d0:02:f8:05:f8:3e:10:6e:ca:3c:c1:8a:d9:ad:9f:0d:35:52:49:5a:57:5e

Digest Algorithm

sha256

PE Digest Matches

true

0b:2c:fc:44:03:46:69:7d:a9:c3:4d:20:44:26:8d:8e:9d:a7:d4:f1
Signer

Actual PE Digest

0b:2c:fc:44:03:46:69:7d:a9:c3:4d:20:44:26:8d:8e:9d:a7:d4:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__iob_func
__setusermatherr
_amsg_exit
_errno
_initterm
_lock
_onexit
_unlock
abort
calloc
fprintf
free
fwrite
malloc
memcmp
memcpy
memset
signal
strlen
strncmp
vfprintf

avutil-lav-55

av_free
av_freep
av_get_bits_per_pixel
av_get_cpu_flags
av_get_pix_fmt_name
av_image_alloc
av_log
av_malloc
av_mallocz
av_opt_get_int
av_opt_set_defaults
av_opt_set_int
av_pix_fmt_desc_get
av_pix_fmt_get_chroma_sub_sample
av_pix_fmt_swap_endianness

Exports

Exports

sws_addVec
sws_allocVec
sws_alloc_context
sws_alloc_set_opts
sws_cloneVec
sws_convVec
sws_convertPalette8ToPacked24
sws_convertPalette8ToPacked32
sws_freeContext
sws_freeFilter
sws_freeVec
sws_getCachedContext
sws_getCoefficients
sws_getColorspaceDetails
sws_getConstVec
sws_getContext
sws_getDefaultFilter
sws_getGaussianVec
sws_getIdentityVec
sws_get_class
sws_init_context
sws_isSupportedEndiannessConversion
sws_isSupportedInput
sws_isSupportedOutput
sws_normalizeVec
sws_printVec2
sws_scale
sws_scaleVec
sws_setColorspaceDetails
sws_shiftVec
sws_subVec
swscale_configuration
swscale_license
swscale_version

Sections

.text
Size: 474KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

582377d7a3d01124b56bbbf7ceee727b

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

52:74:18:0f:a9:40:be:e8:96:e1:b4:df:9e:21:77:0cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

52:74:18:0f:a9:40:be:e8:96:e1:b4:df:9e:21:77:0cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

73:53:68:37:9c:e7:82:e0:41:66:d0:02:f8:05:f8:3e:10:6e:ca:3c:c1:8a:d9:ad:9f:0d:35:52:49:5a:57:5eSigner

0b:2c:fc:44:03:46:69:7d:a9:c3:4d:20:44:26:8d:8e:9d:a7:d4:f1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

avutil-lav-55

Exports

Exports

Sections

.text Size: 474KB - Virtual size: 473KB

.data Size: 512B - Virtual size: 120B

.rdata Size: 21KB - Virtual size: 20KB

.rodata Size: 512B - Virtual size: 320B

.pdata Size: 9KB - Virtual size: 8KB

.xdata Size: 12KB - Virtual size: 11KB

.bss Size: - Virtual size: 34KB

.edata Size: 1024B - Virtual size: 1010B

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 104B

.rsrc Size: 1024B - Virtual size: 912B

.reloc Size: 1024B - Virtual size: 892B

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

52:74:18:0f:a9:40:be:e8:96:e1:b4:df:9e:21:77:0c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

52:74:18:0f:a9:40:be:e8:96:e1:b4:df:9e:21:77:0c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

73:53:68:37:9c:e7:82:e0:41:66:d0:02:f8:05:f8:3e:10:6e:ca:3c:c1:8a:d9:ad:9f:0d:35:52:49:5a:57:5e
Signer

0b:2c:fc:44:03:46:69:7d:a9:c3:4d:20:44:26:8d:8e:9d:a7:d4:f1
Signer

.text
Size: 474KB - Virtual size: 473KB

.data
Size: 512B - Virtual size: 120B

.rdata
Size: 21KB - Virtual size: 20KB

.rodata
Size: 512B - Virtual size: 320B

.pdata
Size: 9KB - Virtual size: 8KB

.xdata
Size: 12KB - Virtual size: 11KB

.bss
Size: - Virtual size: 34KB

.edata
Size: 1024B - Virtual size: 1010B

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.rsrc
Size: 1024B - Virtual size: 912B

.reloc
Size: 1024B - Virtual size: 892B