94f407e8615ebe091ccf5035197ea1ea_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

94f407e8615ebe091ccf5035197ea1ea_JaffaCakes118
Size

1.1MB
MD5

94f407e8615ebe091ccf5035197ea1ea
SHA1

89c8938057a1b0514e3805536ccf3d2eb4acb1e0
SHA256

14fe0fa7e16253e53ce4c25616e08006ad09330bea8df9161a47b2815cd83067
SHA512

08ec9d99d753e9239d89a9081276329e51adb2d3414447b103eae8dcd21f02dabc86a39abd4f8405cec076dfdc74133796eb4117285add6bd13826de5c99e423
SSDEEP

24576:JAkh6SRcwxbc0x7A2JHQWP5Nx8ubFKD8L1QA/:JAe6Spxb9xc2JHXP3xBpD1Qw

Score

1^/10

Malware Config

Signatures

Files

94f407e8615ebe091ccf5035197ea1ea_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d4fefa839744fbd856673c897f570f06

Code Sign

64:4d:a5:84:ba:53:61:5a:b4:65:3c:f5:92:a1:3e:50
Certificate

Issuer

CN=VHRGUMCPBKMFRGRSFG

Not Before

08/08/2019, 16:56

Not After

31/12/2039, 23:59

Subject

CN=VHRGUMCPBKMFRGRSFG

Extended Key Usages

ExtKeyUsageCodeSigning

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c8:ad:35:62:ed:b4:a7:27:5f:cc:77:8d:bf:87:4e:92:4a:c9:57:60
Signer

Actual PE Digest

c8:ad:35:62:ed:b4:a7:27:5f:cc:77:8d:bf:87:4e:92:4a:c9:57:60

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersion
GetVersionExA
GetWindowsDirectoryW
GlobalFree
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
GetConsoleOutputCP
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LocalReAlloc
LockResource
MultiByteToWideChar
OpenEventW
OpenProcess
OpenThread
OutputDebugStringW
Process32FirstW
Process32NextW
QueryPerformanceCounter
RaiseException
ReadFile
ReleaseMutex
RtlUnwind
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetHandleCount
SetLastError
SetStdHandle
SetThreadUILanguage
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
lstrcmpiW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
GetConsoleCP
GetConsoleMode
GetCommandLineW
GetCommandLineA
GetCPInfo
GetAtomNameW
GetACP
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FormatMessageW
FlushInstructionCache
FlushFileBuffers
FindResourceW
FindResourceExW
FindAtomW
ExitProcess
EnumSystemLocalesA
EnterCriticalSection
DeviceIoControl
DeleteCriticalSection
DeleteAtom
CreateToolhelp32Snapshot
CreateThread
CreateProcessW
CreateMutexW
CreateFileW
CreateFileA
CreateEventW
CreateDirectoryW
CompareStringW
CompareStringA
CloseHandle
LoadLibraryExW
AddAtomW

user32

UnregisterClassA
TranslateMessage
SetWindowLongW
SetTimer
SendMessageTimeoutW
RegisterClassW
RegisterClassExW
PostThreadMessageW
PostMessageW
PeekMessageW
MessageBoxW
LoadStringW
GetKeyboardLayout
KillTimer
IsWindow
GetWindowLongW
GetMessageW
GetClassInfoExW
GetActiveWindow
VkKeyScanA
GetKeyboardType
IsWindowUnicode
IsCharLowerW
CallWindowProcW
CharNextW
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
ExitWindowsEx
GetCaretBlinkTime
GetLastActivePopup
LoadCursorFromFileW
GetMenuContextHelpId
GetWindowContextHelpId
GetParent
DestroyMenu
LoadIconA
GetSysColorBrush
IsIconic
GetMessageExtraInfo
GetOpenClipboardWindow
AnyPopup
LoadCursorW
FindWindowW
InSendMessage

gdi32

GetTextAlign
GetGraphicsMode
GetTextCharset
UpdateColors
EndDoc
GetBkColor
GetDCBrushColor
CreateSolidBrush
UnrealizeObject
CreateMetaFileW
CloseFigure
PathToRegion
GetStockObject

advapi32

RegCloseKey
RegCreateKeyExW
RegOpenKeyExA
RegSetValueExW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize

shlwapi

StrCpyNW
StrCmpNIW
StrCmpIW
SHGetValueW
StrStrIA
PathIsDirectoryW
PathFindFileNameW
PathFileExistsW
PathCombineW
PathAppendW
StrStrIW
UrlGetPartA
wvnsprintfW
PathRemoveFileSpecW

comctl32

InitCommonControlsEx

imm32

ImmDisableIME

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 967KB - Virtual size: 967KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4fefa839744fbd856673c897f570f06

Code Sign

64:4d:a5:84:ba:53:61:5a:b4:65:3c:f5:92:a1:3e:50Certificate

Extended Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19Certificate

Extended Key Usages

Key Usages

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49Certificate

Extended Key Usages

Key Usages

c8:ad:35:62:ed:b4:a7:27:5f:cc:77:8d:bf:87:4e:92:4a:c9:57:60Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

imm32

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 967KB - Virtual size: 967KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 75KB - Virtual size: 1.0MB

64:4d:a5:84:ba:53:61:5a:b4:65:3c:f5:92:a1:3e:50
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

c8:ad:35:62:ed:b4:a7:27:5f:cc:77:8d:bf:87:4e:92:4a:c9:57:60
Signer

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 967KB - Virtual size: 967KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 75KB - Virtual size: 1.0MB