8465d26ef04aab51cc8b468a5072939c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
8465d26ef04aab51cc8b468a5072939c_JaffaCakes118
Size 3.5MB
Sample240530-rb5agscb46
SHA256 10a12cb04ad163cdebf412fc61ca14b5cb329f9b1fc0cfc8442e4fc612b9b867
MD5 8465d26ef04aab51cc8b468a5072939c
SHA1 208d5243b0c8cb8f5e2b69e8d1421034d892bb4a
SHA512 ce5d51b14a2683a27e196c9b41bdb66a3abff2df508240f330ab166dc4b45bf960606f791dc10073b85c98ef1e52cdb1803e384e268246518042570dd55a3ebe
SSDEEP 49152:OGTmx/jFyIewFVxQm125xXIUepx57iVZxPKWS2zT2VpDxHJPp:ObxjFTeKy55IRx5402WJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

8465d26ef04aab51cc8b468a5072939c_JaffaCakes118

.exe 3.5MB

8465d26ef04aab51cc8b468a5072939c_JaffaCakes118

IMPHASH 260725db05d85038f0d2595a14b7e42a
SHA256 10a12cb04ad163cdebf412fc61ca14b5cb329f9b1fc0cfc8442e4fc612b9b867
MD5 8465d26ef04aab51cc8b468a5072939c
SHA1 208d5243b0c8cb8f5e2b69e8d1421034d892bb4a
SHA512 ce5d51b14a2683a27e196c9b41bdb66a3abff2df508240f330ab166dc4b45bf960606f791dc10073b85c98ef1e52cdb1803e384e268246518042570dd55a3ebe
SSDEEP 49152:OGTmx/jFyIewFVxQm125xXIUepx57iVZxPKWS2zT2VpDxHJPp:ObxjFTeKy55IRx5402WJ
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

d1:e8:94:4c:e5:01:df:29:16:90:be:64:97:34:1b:4c:1f:23:f0:23

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 24, 2007

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0f:78:4d:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 23, 2007 - Feb 23, 2009

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:14:2c:a7:00:00:00:00:00:06

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 12, 2007 - Jun 13, 2012

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:14:2c:a7:00:00:00:00:00:06

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 12, 2007 - Jun 13, 2012

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

Major OS version

Entry point

18731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aspnet_state.pdb

kernel32

SetWaitableTimer CloseHandle CreateThread CreateWaitableTimerW CreateEventW SetConsoleCtrlHandler FormatMessageW InterlockedIncrement InterlockedDecrement GetSystemTimeAsFileTime lstrlenW WideCharToMultiByte FileTimeToSystemTime FileTimeToLocalFileTime QueryPerformanceCounter GetTickCount GetCurrentThreadId Sleep TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemInfo WaitForSingleObject SetEvent GetProcessAffinityMask SwitchToThread MultiByteToWideChar GetLastError HeapReAlloc InterlockedCompareExchange InterlockedExchange HeapFree HeapAlloc GetProcAddress HeapDestroy HeapCreate FreeLibrary GetCurrentProcessId

msvcr80

__set_app_type _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer ?terminate@@YAXXZ _invoke_watson _controlfp_s _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _purecall strncmp memcpy _vsnwprintf_s memset _itoa_s _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit __winitenv _initterm strtol strstr strchr

advapi32

RegCloseKey RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegQueryValueExW RegOpenKeyExW SetServiceStatus

mswsock

GetAcceptExSockaddrs AcceptEx

ole32

CoUninitialize CoInitializeEx

ws2_32

recv select WSASend WSARecv WSAGetOverlappedResult WSAAddressToStringA gethostbyname ntohs WSACleanup WSAStartup closesocket WSASocketW WSAGetLastError setsockopt htons htonl bind listen inet_ntoa

mscoree

ClrCreateManagedInstance

webengine

PerfCounterInitialize InitializeLibrary XspLogEvent AttachHandleToThreadPool LoadLibraryUsingFullPath PrintResourceString AspnetLoadResourceDLL GetXSPHeap

Sharing

General

Malware Config

Signatures

File Explorer

8465d26ef04aab51cc8b468a5072939c_JaffaCakes118

PE Signature issue

kernel32

msvcr80

advapi32

mswsock

ole32

ws2_32

mscoree

webengine

generic