9d4318b747bb9a0027a384700666aec3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9d4318b747bb9a0027a384700666aec3_JaffaCakes118
Size

23KB
MD5

9d4318b747bb9a0027a384700666aec3
SHA1

bda0a2a74d4714b8a191f24c4796fa97a3e7f03c
SHA256

b500f592c44a973c5025ab796d6d893b2500f1f8a60b916b5bb9e3a476638102
SHA512

83d086febe050b34cc33821c1f6ca0ca6148752efd699afe88ab5ac1a6123bf951d32a960ee5d43e3a1287c73394e3f6ba6cfc775a62a46f79e16b6dc86a8c62
SSDEEP

384:eyPjNmaHz19rfTyaVsacZvD5gCUrAfFK/Ougbz/XdVO+wbB+Y:eGjNF9/lsacZvdAr9/OugbLHwbB+Y

Score

1^/10

Malware Config

Signatures

Files

9d4318b747bb9a0027a384700666aec3_JaffaCakes118
.zip
prjSQLRestore.exe
.exe windows:4 windows x86 arch:x86

8ae81767e01eb3fd20d6c459ee99c0cc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

16:3c:a7:23:41:d1:64:d3:1b:3e:6e:58:3a:b8:72:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

09/03/2016, 00:00

Not After

09/03/2018, 23:59

Subject

CN=上海昂卓信息科技有限公司,O=上海昂卓信息科技有限公司,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4f:34:ce:90:51:3c:6d:e9:04:44:b8:cb:46:ad:b8:54:1a:35:54:08
Signer

Actual PE Digest

4f:34:ce:90:51:3c:6d:e9:04:44:b8:cb:46:ad:b8:54:1a:35:54:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

kernel32

GetVersion
Sleep

comctl32

InitCommonControls

user32

GetSystemMenu
CreateWindowExA
GetWindowLongA
DestroyWindow
SetFocus
SetWindowLongA
SendMessageA
GetFocus
ModifyMenuA
GetClientRect
GetParent

msvbvm60

ord690
MethCallEngine
ord518
ord626
ord660
ord667
ord669
ord301
ord595
ord598
ord520
ord307
ord631
ord709
ord632
ord526
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord608
ord716
ord717
ProcCallEngine
ord644
ord537
ord645
ord573
ord681
ord685
ord100
ord689
ord617
ord618
ord619
ord546
ord581

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ae81767e01eb3fd20d6c459ee99c0cc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

16:3c:a7:23:41:d1:64:d3:1b:3e:6e:58:3a:b8:72:65Certificate

Extended Key Usages

Key Usages

4f:34:ce:90:51:3c:6d:e9:04:44:b8:cb:46:ad:b8:54:1a:35:54:08Signer

Headers

File Characteristics

Imports

shell32

kernel32

comctl32

user32

msvbvm60

Sections

.text Size: 40KB - Virtual size: 39KB

.data Size: - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

16:3c:a7:23:41:d1:64:d3:1b:3e:6e:58:3a:b8:72:65
Certificate

4f:34:ce:90:51:3c:6d:e9:04:44:b8:cb:46:ad:b8:54:1a:35:54:08
Signer

.text
Size: 40KB - Virtual size: 39KB

.data
Size: - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 2KB