General

Malware Config

Signatures

Files

• 6a5b7fbc0eb29449bdfc81f24a7f2a29_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  eea64118b74a4b4a2bdc05ae9c5f96b3

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  78:99:58:b0:26:4f:06:05:56:19:27:00:74:af:a6:1f

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  10-01-2013 00:00

  Not After

  10-01-2015 23:59

  Subject

  CN=Visual Tools,O=Visual Tools,L=Belgrade,ST=Serbia,C=RS

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  cc:a7:ab:fb:08:3c:79:14:cc:96:f5:da:71:d0:dc:dc:4d:8d:c9:0b

  Signer

  Actual PE Digest

  cc:a7:ab:fb:08:3c:79:14:cc:96:f5:da:71:d0:dc:dc:4d:8d:c9:0b

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Projects\Users\SP_Vladimir\Setup1_Win32\SetupStub.pdb

  Imports

  shlwapi

  StrToIntW

  StrChrA

  StrCmpNW

  StrStrIW

  StrCpyW

  StrCmpNIA

  StrCpyNW

  StrChrW

  StrStrW

  StrToIntA

  kernel32

  GetModuleHandleExW

  SetFilePointerEx

  SetStdHandle

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetStringTypeW

  HeapAlloc

  GetProcessHeap

  HeapFree

  CreateFileW

  GetFileSize

  ReadFile

  CloseHandle

  GetLastError

  GetCurrentDirectoryW

  SetCurrentDirectoryW

  lstrlenW

  RemoveDirectoryW

  DeleteFileW

  CreateDirectoryW

  WriteFile

  SetFileTime

  FindResourceW

  LoadResource

  SizeofResource

  LockResource

  lstrlenA

  GetModuleFileNameW

  lstrcpynA

  lstrcpyW

  lstrcatW

  ExitProcess

  VirtualFree

  VirtualAlloc

  LoadLibraryA

  GetProcAddress

  LCMapStringW

  EncodePointer

  DecodePointer

  InterlockedDecrement

  WriteConsoleW

  MultiByteToWideChar

  GetStdHandle

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  IsDebuggerPresent

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  SetLastError

  GetCurrentProcess

  TerminateProcess

  TlsGetValue

  TlsSetValue

  Sleep

  LoadLibraryExW

  InterlockedIncrement

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  OutputDebugStringW

  LoadLibraryW

  GetCurrentThreadId

  RtlUnwind

  WideCharToMultiByte

  user32

  wsprintfW

  Sections

  .text

  Size: 30KB - Virtual size: 29KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 699KB - Virtual size: 699KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ