74664919b9e9a77fd7c59a822d37edfd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

74664919b9e9a77fd7c59a822d37edfd_JaffaCakes118
Size

23.3MB
MD5

74664919b9e9a77fd7c59a822d37edfd
SHA1

7c73a3d5a60137966d2fb86b26f08f1e3622651e
SHA256

ec290e5969a5eab6c5904fef88d88f4977d2df9e4ab6425dee1af22199a1a3ab
SHA512

1fff01464007989a222b0ba45b37c5cd906a1c6a3d14a90b8d68fb61102266690dffd72f253176e1ae607fb61520fe725c6c679e470463126dfe155c65365441
SSDEEP

393216:GzHQz4EDk6jWrB2arst/nCzAHI412QqgBnGGAtH50F6LmiG1mAGaC0SFUJqbWZDc:GzHQBDxstc/pL2Q3Ela6WFC0e/

Score

1^/10

Malware Config

Signatures

Files

74664919b9e9a77fd7c59a822d37edfd_JaffaCakes118
.zip
L800_x32_674HomeExportAsia_s.exe
.exe windows:4 windows x86 arch:x86

f2f9102c7663962c22d17a8dabc5e7ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:4f:e3:8b:60:9e:3a:a9:31:33:24:9f:75:9d:9a:3f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

01/07/2013, 00:00

Not After

31/08/2014, 23:59

Subject

CN=SEIKO EPSON CORPORATION,OU=Information Service & Support Department+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SEIKO EPSON CORPORATION,L=Suwa-shi,ST=Nagano,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

db:44:e2:9f:b9:ba:2f:c8:db:48:fb:9b:de:e4:58:07:cd:a6:f2:77
Signer

Actual PE Digest

db:44:e2:9f:b9:ba:2f:c8:db:48:fb:9b:de:e4:58:07:cd:a6:f2:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
FindExecutableA
SHBrowseForFolderA
SHGetMalloc

user32

GetClientRect
SetRect
EndPaint
LoadCursorA
GetLastActivePopup
KillTimer
ShowWindow
PostMessageA
SendMessageA
EnableWindow
SetTimer
SetWindowTextA
SetForegroundWindow
SetActiveWindow
SetDlgItemTextA
GetKeyState
CharUpperBuffA
PeekMessageA
GetSysColor
DispatchMessageA
GetParent
SendDlgItemMessageA
GetDlgItem
InvalidateRect
UpdateWindow
LoadStringA
MessageBoxA
DialogBoxParamA
GetWindowLongA
SetWindowLongA
GetDlgItemTextA
EndDialog
GetWindowRect
GetSystemMetrics
SetWindowPos
SetCursor
CharNextA
BeginPaint
SetWindowWord
GetWindowWord
DefWindowProcA
RegisterClassA
TranslateMessage

kernel32

GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetStdHandle
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapSize
Sleep
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
GetVersionExA
FindClose
FindFirstFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateDirectoryA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
LocalAlloc
GetDriveTypeA
GetEnvironmentVariableA
SetFilePointer
CreateFileA
GetWindowsDirectoryA
GlobalFree
GlobalUnlock
GlobalHandle
_lclose
_llseek
_lread
_lopen
GlobalLock
GlobalAlloc
GlobalMemoryStatus
GetVersion
GetModuleFileNameA
WriteFile
GetSystemTime
LocalFree
ExitProcess
FormatMessageA
GetLastError
GetModuleHandleA
GetVolumeInformationA
WideCharToMultiByte
CreateProcessA
lstrcmpiA
SetErrorMode
MultiByteToWideChar
GetLocalTime
lstrlenA
CreateFileW
ReadFile
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
FlushFileBuffers
WriteConsoleW
CloseHandle
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetProcessHeap
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetProcAddress
TlsGetValue
TlsAlloc

gdi32

SetTextColor
SetTextAlign
GetBkColor
GetTextExtentPoint32A
ExtTextOutA
CreateDCA
GetDeviceCaps
CreateFontIndirectA
DeleteDC
SelectObject
DeleteObject
SetBkColor

advapi32

RegQueryValueA

comctl32

ord17

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_winzip_
Size: 23.1MB - Virtual size: 23.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2f9102c7663962c22d17a8dabc5e7ce

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4aCertificate

Key Usages

63:4f:e3:8b:60:9e:3a:a9:31:33:24:9f:75:9d:9a:3fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

db:44:e2:9f:b9:ba:2f:c8:db:48:fb:9b:de:e4:58:07:cd:a6:f2:77Signer

Headers

File Characteristics

Imports

shell32

user32

kernel32

gdi32

advapi32

comctl32

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 57KB

.rsrc Size: 40KB - Virtual size: 37KB

_winzip_ Size: 23.1MB - Virtual size: 23.1MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

63:4f:e3:8b:60:9e:3a:a9:31:33:24:9f:75:9d:9a:3f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

db:44:e2:9f:b9:ba:2f:c8:db:48:fb:9b:de:e4:58:07:cd:a6:f2:77
Signer

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 57KB

.rsrc
Size: 40KB - Virtual size: 37KB

_winzip_
Size: 23.1MB - Virtual size: 23.1MB