6c47684c6e5071b1a207867419290747_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6c47684c6e5071b1a207867419290747_JaffaCakes118
Size

600KB
MD5

6c47684c6e5071b1a207867419290747
SHA1

da29eb162633c2a9c8bed5fc1c6da695e90346a2
SHA256

04f3ca4f83a0fdcac76471a2fa8ab2e872cd443930fad481216012152b50d5ef
SHA512

7cd0863e58aab6bdf35a6880871dad3a596366f81a61c7620d0485e1ca6fe4da94c2d5245e1dd4a046e7ec8283b15283a3b56893104830a55ec2cb02b6e7677c
SSDEEP

12288:/HN8MUocoWhRYQsUkb5bQvzpQGaLJN5evSmposY:/HNJZUCUkbdTGs5enNY

Score

1^/10

Malware Config

Signatures

Files

6c47684c6e5071b1a207867419290747_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b9ab8f217c7876e6222081721e2d7c5a

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30-05-2000 10:48

Not After

30-05-2020 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:ad:07:f1:69:75:8b:4d:6d:2e:51:21:24:a5:3b:57
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

29-05-2015 00:00

Not After

28-05-2016 23:59

Subject

CN=KATANA,O=KATANA,POSTALCODE=156002,STREET=44/7 ul.Ostrovskogo,L=Kostroma,ST=Kostroma region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:4a:0c:11:b7:34:87:46:e2:50:85:68:83:f3:42:e9:54:69:be:cf
Signer

Actual PE Digest

09:4a:0c:11:b7:34:87:46:e2:50:85:68:83:f3:42:e9:54:69:be:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

SetMenuItemInfoW
DlgDirListA
PrivateExtractIconsA
DefFrameProcW
CharLowerBuffW
GrayStringW
IsCharLowerW
DestroyCaret
GetKeyboardState
PostMessageW
ChangeDisplaySettingsW
RemovePropW
wsprintfA
RegisterClipboardFormatA
CharUpperBuffW
GetSysColor
AdjustWindowRect
GetMouseMovePointsEx
DefDlgProcA
OpenIcon
GetClassInfoA
InsertMenuItemW
GetMessageA
CreateAcceleratorTableA
GetKeyState
SetCursorPos
RegisterDeviceNotificationW
PeekMessageA
CharUpperW
DlgDirSelectExW
DlgDirSelectExA
RegisterClassW
SetCapture
CloseWindowStation
CallNextHookEx
MessageBoxTimeoutW
CreateIconFromResourceEx
GetClassLongA
LoadCursorFromFileW
MoveWindow
GetAltTabInfoA
ToUnicode
OemToCharW
IsCharUpperW
LockWorkStation
GetClipboardData
LoadStringW
SendMessageCallbackW
GetUpdateRect
RegisterClassExW
UnhookWindowsHook
GetMenuBarInfo
LoadStringA
IntersectRect
ChangeMenuW
MonitorFromRect
GetWindowWord
SendInput
GetDlgItemInt
LoadKeyboardLayoutEx
SetUserObjectInformationA
IsCharLowerA
InflateRect
GetInputDesktop
CascadeChildWindows
GetClipCursor
CopyAcceleratorTableA
UnregisterClassA
GetWindowTextLengthW
GetTopWindow
GetWindowTextW
GetWindowPlacement
CreateMenu
IsWindow
SendMessageW
IsDlgButtonChecked
GetTabbedTextExtentW
SubtractRect
AttachThreadInput
TranslateAcceleratorA
GetDlgItem
SetWindowTextA
EnumPropsExA
MessageBeep
GetDCEx
SetRectEmpty
TileWindows
DrawMenuBarTemp
UnregisterHotKey
InsertMenuA
SendMessageTimeoutA
DialogBoxParamW
IsDialogMessageW
RegisterDeviceNotificationA
SetPropW
SetWindowTextW
MenuWindowProcA
SetProcessWindowStation
ScrollChildren
AdjustWindowRectEx
GetInputState
RemovePropA
CharLowerBuffA
AnimateWindow
SetScrollRange
GetClipboardFormatNameA
EnumDisplaySettingsExW
ExitWindowsEx
LoadIconW
EnableScrollBar
ValidateRgn
DrawFrame
DrawTextExW
CharNextExA
GetCaretPos
GetKeyboardType
UpdateWindow
GetClientRect
GetWindowThreadProcessId
CharPrevExA
UpdateLayeredWindow
GetScrollRange
CloseClipboard
IsCharAlphaNumericW
FindWindowExA
DestroyAcceleratorTable
SetProgmanWindow
LoadIconA
CreateCursor
SetWindowContextHelpId
ToAsciiEx
MapVirtualKeyA
GetMenu
RegisterWindowMessageW
CloseDesktop
SetMenuItemBitmaps
GetComboBoxInfo
IsWindowUnicode
ShowScrollBar
CopyAcceleratorTableW
GetDlgCtrlID
MapWindowPoints
SetMenuDefaultItem
InvalidateRgn
LoadMenuIndirectA
SetMenuItemInfoA
DefWindowProcW
GetMonitorInfoW
GetWindowTextLengthA
DialogBoxIndirectParamW
RemoveMenu
PrintWindow
DeleteMenu
AllowForegroundActivation
IsDialogMessageA
CreateMDIWindowA
GetMenuItemCount
EnumPropsW
SetCaretPos
GetWindowModuleFileNameW
LoadAcceleratorsW
GetClassInfoW
IsGUIThread
MapVirtualKeyExW
BroadcastSystemMessageA
SetWindowsHookExA
EnumWindowStationsW
EnumDisplayMonitors
MenuItemFromPoint
GetWindow
GetKeyboardLayoutNameW
FillRect
GetWindowRect
EndMenu
BeginPaint
BroadcastSystemMessageW
SetForegroundWindow
DrawFrameControl
GetMenuItemID
GetDesktopWindow
IsMenu
ScrollWindowEx
ActivateKeyboardLayout

kernel32

ReadFile
GetFileAttributesA
EnumResourceTypesA
GetStartupInfoW
GetExitCodeProcess
WaitNamedPipeA
LockResource
UnmapViewOfFile
TryEnterCriticalSection
OutputDebugStringW
FlushConsoleInputBuffer
IsBadHugeReadPtr
PrivMoveFileIdentityW
CreateMailslotW
ReadConsoleInputW
CreateNamedPipeA
SetThreadContext
GetConsoleAliasesA
ReadConsoleOutputCharacterA
EnumSystemCodePagesA
WriteFileGather
ScrollConsoleScreenBufferW
SetErrorMode
GetAtomNameW
SetCurrentDirectoryA
WaitNamedPipeW
CreateEventA
AssignProcessToJobObject
CopyLZFile
GetDefaultCommConfigW
MultiByteToWideChar
GetProcessIoCounters
AttachConsole
ReplaceFile
GetNumberOfConsoleFonts
VirtualFree
GetAtomNameA
GetCurrentThreadId
GetNamedPipeHandleStateW
GetCommandLineA
LZCreateFileW
LZInit
GetGeoInfoW
GetLogicalDriveStringsA
GetCurrentProcess
FindFirstVolumeA
WriteConsoleOutputCharacterW
Heap32First
DelayLoadFailureHook
VerLanguageNameW
WriteConsoleOutputAttribute
MapViewOfFileEx
GetCPInfo
GetStringTypeW
GetConsoleMode
ExpandEnvironmentStringsW
GetUserGeoID
SetFileShortNameW
CreateProcessInternalA
IsValidLocale
GetCommandLineW
RtlMoveMemory
GetLocaleInfoW
GetConsoleCharType
ConsoleMenuControl
SearchPathW
GetConsoleOutputCP
FindFirstFileExA
VirtualUnlock
ReadConsoleInputExA
GetCommConfig
CreateJobSet
FindVolumeClose
EndUpdateResourceA
LZRead
GetDiskFreeSpaceW
HeapLock
RtlFillMemory
CallNamedPipeW
GetFileInformationByHandle
GetUserDefaultUILanguage
ReadConsoleInputExW
GetThreadPriorityBoost
MoveFileWithProgressA
EnumTimeFormatsA
SetMailslotInfo
LZStart
SetSystemTime
MoveFileW
EnumResourceLanguagesW
WaitForMultipleObjects
SetThreadPriorityBoost
FindClose
TlsFree
GetConsoleTitleW
WritePrivateProfileStructA
GlobalLock
TransmitCommChar
MulDiv
GetStringTypeExA
GetConsoleWindow
CreateJobObjectA
SetCriticalSectionSpinCount
SetComputerNameW
GlobalAddAtomW
GetVolumeInformationA
GetVersionExW
IsBadStringPtrA
TransactNamedPipe
InitializeCriticalSection
OpenMutexA
SetWaitableTimer
RtlZeroMemory
CreateDirectoryExW
FindNextChangeNotification
ChangeTimerQueueTimer
GetCurrentConsoleFont
SetComputerNameA
ClearCommBreak
FreeConsole
SetFileAttributesW
WriteProfileSectionA
GetLargestConsoleWindowSize
GetLastError
FreeResource
GetUserDefaultLangID
VirtualQuery
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

comdlg32

ChooseColorA
PrintDlgW
GetSaveFileNameW
PrintDlgA
FindTextW
PageSetupDlgW
GetOpenFileNameA

oleaut32

VarI4FromR4

shell32

SHGetDiskFreeSpaceExA
StrRStrIW
SHFileOperationW
StrChrIA
PrintersGetCommand_RunDLLA
ShellExecuteA
DragAcceptFiles
DragQueryFileW

gdi32

GetClipBox
EngGetPrinterDataFileName
EnumFontsW
EngCreateClip

wtsapi32

WTSEnumerateServersW
WTSShutdownSystem
WTSEnumerateServersA
WTSOpenServerA

comctl32

FlatSB_SetScrollRange
ImageList_Copy
CreateStatusWindow
ImageList_GetIcon

Exports

Exports

Y>úg�"��g�~�ī"�cD-_8x�ނ�6�0�� $Futi��wYr��V��X�\˹�J��6o��n @�a�q&<�->��P88�c�];V�{( �Đ�Y��f1�Y��&&(j��0ZY2_�:v2�]��$M.m�suLr��*:0��w�b�P;Y��Y]��1B�Ǟ�?��(u�!8[F�Gm��k��K�R�+�F��,a�+}��]^��܌1�r�-0��\5��/A��G��?uB�ő��ɝ��)��@��[��'�1�Y��s��@��<&��òBC�;�_(�r�=��Y �}D�j�a�u��Y�7�.o��u�I�.bO~Z��]��!�a��zMe�$�<�pv��/ �� W�� $�^��IN��_�f��[��a��H� -,oyWAPT�~�RЎDv�@�#3J�i��<��Q��ۣC�z+��kR��\��a1]�rҞ�e�B��Ҍl�%�rT�.wtDK��̭�UCJY��&��{��{�3��4~l�/��%h�� 0��\��n��d �=*l�3��8��JEH澗�MHU�M\��e��.|/�b;�S��?��J��s��U�M��w�}�v�J�=�� *�o��a|��c�֩��3�Y8�P��^@;�8��B ��x&��>�+�"1��\W��(�z��OR��(��&ի��*�]ޤw�G��^f`�-�Ó�n�Wf��T84�v�ho��AE�!E.��>��a��G��=j��F�2h>މ*a brǓ�xU��"Qܭ6�{��-�h��[�H��{�Z�� ͆��jQ�d�C!u�� ˤSo�I��S�(��O��4��|ā��@��:��c�_��{��j3�I�Fk��ͣ�5z&��&��F0t�B�~�T�-�!c�T< !�DƤ��Cj�x�Ƽ��6�F _w]^D�_j'��%�N�� Q��h|W>QX��86 ��\��`Ђ��pPH��B�-��v�5Wgc��P��0��7�LA�d��!3��e��x��S>��%��#��m3�3�e��W!(�{M��!+-��؝&��}\�T<$ӄ\��CCzq4M|g�h�1��:\��3�)�VחB�CV�с�M�G�P�� %׷y�C�y��!��T��ƅD��tk��&v D��[��7�j4��,��_�fg�c�6#N\��@��uz�Q��PV�j;��H�� f ��?Ӌ��ȁ�Ɋ�~s�V��퍅��M�ѷN��/_��T�c� ��\ �B�̾��{�$ѹ�?ø�C��w��+a�d+7��D`�u �,t'Fi��*w�IRw��pa��ړQ��mͧN��'��ɚ��[�^RZ��Vg]�P�70�}UW�k�o�7䞡@�;e��S�%le��G/\�G��!!/�܄�Bġs2�$AP[Z�g��h�ES�*�J��2 ��T��p�YG��h��e ��f��3��z��8��SDS�1�cE��L�|��>��`5� �,�~��*��! 1G��:�u��=pM��;�ѽY�X��bF�<�#��,�!�~�3R0.6͹X`7o#i��O#<?�Ժ��` ��}�o��|�X%�R@{�/ǃs�� y�^�$�*�\�2;��C�!�b�u4��m1��t)|zuܗ$Z�٨��7݇�z�Y�Dn2ᵩ�ml��3pn�~� /��EL��X듑O��x� �Iձ(�AJ��dZ ��%=�O�kf��'�*?ɩ)�nvK0�h^A�l�-;#ȶ�l�j�� ~�Ђ��M8��dnϵ�E�N�I�*�t�Ldn�Y��c *��u.��Ӧ��2Ɣ�me��.*��_b��F��劬P��^��H��ۤ��t�g��I��{7? ��_#&S�@V��#,��+q��i��ݨ�%��-�%�-��Qs��gI�e�B�G8eU�_F��v_�{��,�j��;�K�64ƀN�h�ۧu��YU&��>Ŏ�N��)�� &c��PO>!J��OPۏ��~w��bE�>��M��h品�}� 䂈Г3��D�aA{��5�}��Z̥M"��M�6oˁ��Q��1��N��6�W��?��S<�@�?� ��y��|��+2��C��Q<l��?¥�|��򈷍��z�\O��&�G^��ɴ��%l��d �/��\�t��.f��J[v&��o'2$;`�U��p,O�<[�\H k��=�:�V�f��;p��[�j�Z��qㄙb#@��r\�ypw5}P�`T��C؞��3�8�R%��X��3�A��_��c�B�� ̍��s�ж:�g��N;� �"\X��_h�Ѡ��x��HnE{&��ڬZ�3��ĝ5�Q�2'�i�f%�x�z%��XS�y�<�#��{O�0Aq�މ!��0W6�8-(%^i�1}��?�])��<��N�Y��J-bNP�{� 5<2�<�Eis�:��6�˽^��b��a%��$��K��Bs��n8��̒($/��C]�*k륑�R�#��]8��#(��O.T\ ��Mmgϟo&T}�E��g��*��-:=��b_4g$� �,g��&H��* u��7��J��w��Y9/3x�N��z�ik�Ab�@"��c�̱�� 9��)>�ݢ��ߠ��J��`�@�w�_�*&�د��e�􈢖�9䭘EՄ`��ӻ��*�n��9�olC�!��@�-q�y�Y7��1�F5��Ʊ��.M��,u��>� ��2��.m�R��

Sections

CODE
Size: 443KB - Virtual size: 443KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9ab8f217c7876e6222081721e2d7c5a

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

90:ad:07:f1:69:75:8b:4d:6d:2e:51:21:24:a5:3b:57Certificate

Extended Key Usages

Key Usages

09:4a:0c:11:b7:34:87:46:e2:50:85:68:83:f3:42:e9:54:69:be:cfSigner

Headers

File Characteristics

Imports

user32

kernel32

comdlg32

oleaut32

shell32

gdi32

wtsapi32

comctl32

Exports

Exports

Sections

CODE Size: 443KB - Virtual size: 443KB

DATA Size: 17KB - Virtual size: 17KB

BSS Size: - Virtual size: 1KB

.idata Size: 8KB - Virtual size: 7KB

.text0 Size: 16KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 66KB - Virtual size: 66KB

.reloc Size: 6KB - Virtual size: 6KB

.rsrc Size: 35KB - Virtual size: 34KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

90:ad:07:f1:69:75:8b:4d:6d:2e:51:21:24:a5:3b:57
Certificate

09:4a:0c:11:b7:34:87:46:e2:50:85:68:83:f3:42:e9:54:69:be:cf
Signer

CODE
Size: 443KB - Virtual size: 443KB

DATA
Size: 17KB - Virtual size: 17KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 8KB - Virtual size: 7KB

.text0
Size: 16KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 66KB - Virtual size: 66KB

.reloc
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 35KB - Virtual size: 34KB