97d47e8d69182b2766686bb823fc56d7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

97d47e8d69182b2766686bb823fc56d7_JaffaCakes118
Size

1.0MB
MD5

97d47e8d69182b2766686bb823fc56d7
SHA1

04cb40694f9aca24735d190b043b7cbd32210b49
SHA256

cb724b9873b85095a86ecfe7eaf2a9c7fd83ea63d5baa99cd027634b50c57de9
SHA512

48d334d2e67cfe4cf63e43ea4691245a9df0aff6df78cd5078ec738c0ec00ec146b6562ac530022bedaaa497752f7b2c57da5a814c3583d722ee405f3ed86a10
SSDEEP

24576:uogcRw38cwVQ8Ke7ZwUDu6o0y++/9cfwAp:a8cyQlU630yn/9cfwAp

Score

1^/10

Malware Config

Signatures

Files

97d47e8d69182b2766686bb823fc56d7_JaffaCakes118
.dll windows:5 windows x86 arch:x86

e523c35529f486892ab0a2c19df643c5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:5f:67:d2:9d:b9:b4:3d:65:ec:a5:a8:67:f6:2e:83:86:fa:57:ac
Signer

Actual PE Digest

89:5f:67:d2:9d:b9:b4:3d:65:ec:a5:a8:67:f6:2e:83:86:fa:57:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\.jenkins\workspace\tas-prism\Tools\PRISM\src\Output\TASVulCheck.pdb

Imports

kernel32

VirtualAllocEx
LoadLibraryA
CreateFileMappingA
GetSystemInfo
GetModuleFileNameA
GetModuleHandleA
GetFileTime
CloseHandle
GetCurrentProcessId
GetProcAddress
CreateThread
VirtualFree
IsBadReadPtr
VirtualAlloc
CreateFileMappingW
VirtualProtect
Sleep
CreateEventA
ReadProcessMemory
TerminateThread
VirtualFreeEx
OpenProcess
GetProcessTimes
GetSystemTimeAsFileTime
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcess
GetProcessIoCounters
GetProcessHeap
UnmapViewOfFile
MapViewOfFile
CreateFileA
HeapFree
lstrlenA
OpenFileMappingA
DisableThreadLibraryCalls
GetSystemDirectoryA
GetFileSize
ReadFile
GetLastError
DeviceIoControl
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
InterlockedDecrement
lstrlenW
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
MultiByteToWideChar

user32

wsprintfA
GetWindowThreadProcessId
GetForegroundWindow

advapi32

OpenServiceA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerA
StartServiceA
CloseServiceHandle
ControlService
QueryServiceStatus

ole32

CoCreateGuid
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoCreateInstance

iphlpapi

GetAdaptersInfo
SendARP

msvcr90

_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_lock
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_encode_pointer
_amsg_exit
__dllonexit
_unlock
_mbsnbicmp
wcsncpy
_mbsnbcpy
__CxxFrameHandler3
??_V@YAXPAX@Z
_snprintf
memcpy
memset
_mbsnbcat
strncmp
??_U@YAPAXI@Z
_getpid
sprintf_s
strncpy_s
strrchr
strncat_s
memcpy_s
??2@YAPAXI@Z
??3@YAXPAX@Z
malloc
_CxxThrowException

msvcp90

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

ws2_32

inet_addr

shlwapi

SHGetValueA
SHDeleteKeyA
SHSetValueA

psapi

GetProcessMemoryInfo

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

Exports

Exports

vulnerabilityCheck1

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tvm0
Size: 169KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e523c35529f486892ab0a2c19df643c5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

89:5f:67:d2:9d:b9:b4:3d:65:ec:a5:a8:67:f6:2e:83:86:fa:57:acSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

iphlpapi

msvcr90

msvcp90

ws2_32

shlwapi

psapi

setupapi

oleaut32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.tvm0 Size: 169KB - Virtual size: 172KB

.reloc Size: 2KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

89:5f:67:d2:9d:b9:b4:3d:65:ec:a5:a8:67:f6:2e:83:86:fa:57:ac
Signer

.text
Size: 39KB - Virtual size: 38KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.tvm0
Size: 169KB - Virtual size: 172KB

.reloc
Size: 2KB - Virtual size: 4KB