a16f3f012a5685e14b2a4245eb971cc6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a16f3f012a5685e14b2a4245eb971cc6_JaffaCakes118
Size 433KB
Sample240612-vlpjkasdpg
SHA256 d7874d7b612066635fc2b1feba30410ca14bd0dd028cb75f1e35813dea2f5308
MD5 a16f3f012a5685e14b2a4245eb971cc6
SHA1 fd3b24982427544e9f9755120054f111458b6b5c
SHA512 a24c84d170901e6b7aea0ee275133272b707b142c34ae5a508d15feb1fdf5cfcf9606b9eef5d5873dbcc06d4946f6efe6ee151659d7ea0674c0f266b5ac19def
SSDEEP 6144:f7Rz3i8qenDjedtWGLzv2kd2EUqRISBEL4F4MzYW10xFvgTpVUSRCfXAG:f7Ro+3jGOxQEcaMzYQ0xFQlMXAG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a16f3f012a5685e14b2a4245eb971cc6_JaffaCakes118

.exe 433KB

a16f3f012a5685e14b2a4245eb971cc6_JaffaCakes118

IMPHASH 80f6ec327191c70dd6472e3915b235b8
SHA256 d7874d7b612066635fc2b1feba30410ca14bd0dd028cb75f1e35813dea2f5308
MD5 a16f3f012a5685e14b2a4245eb971cc6
SHA1 fd3b24982427544e9f9755120054f111458b6b5c
SHA512 a24c84d170901e6b7aea0ee275133272b707b142c34ae5a508d15feb1fdf5cfcf9606b9eef5d5873dbcc06d4946f6efe6ee151659d7ea0674c0f266b5ac19def
SSDEEP 6144:f7Rz3i8qenDjedtWGLzv2kd2EUqRISBEL4F4MzYW10xFvgTpVUSRCfXAG:f7Ro+3jGOxQEcaMzYQ0xFQlMXAG
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=BeiJing Baidu Netcom Science Technology Co.\, Ltd,OU=\ Engineering Excellence,O=BeiJing Baidu Netcom Science Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

1f:d2:d3:0e:26:0f:c2:89:cf:af:11:51:8f:2c:d3:6f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2015 - Feb 6, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

Major OS version

Entry point

190401

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\clientci\workspace\ime_compile_3.3.2.1010_patch\Basic\Outputs\Release\imetool.pdb

kernel32

RaiseException InitializeCriticalSectionAndSpinCount GetModuleHandleW CreateDirectoryW WriteFile ReadFile CreateFileW SetErrorMode GetEnvironmentStringsW GetTempPathW FreeEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW GetSystemInfo SetEnvironmentVariableA ReadConsoleW FlushFileBuffers WriteConsoleW SetStdHandle DecodePointer GetConsoleMode GetConsoleCP GetTimeZoneInformation HeapReAlloc GetFileType GetStdHandle GetOEMCP GetACP IsValidCodePage GetUserDefaultLangID GetWindowsDirectoryW LoadLibraryExW GetLocalTime Sleep OpenProcess GetProcessHeap HeapFree HeapAlloc LocalFree InterlockedDecrement GetVersionExW CopyFileW GetTickCount QueryPerformanceCounter MoveFileExW FindNextFileW FindFirstFileW DeleteFileW GetFileAttributesW RemoveDirectoryW InterlockedExchange GetCurrentDirectoryW SetCurrentDirectoryW WritePrivateProfileStringW OutputDebugStringW ExpandEnvironmentStringsW GetCommandLineW CreateProcessW GetModuleHandleExW GetModuleFileNameW LoadLibraryW CreateEventW FileTimeToSystemTime SystemTimeToFileTime GetSystemTime CloseHandle FindClose WaitForMultipleObjects WaitForSingleObject ResetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError GetLastError GetCurrentThreadId SetUnhandledExceptionFilter TerminateProcess HeapSize AreFileApisANSI ExitProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc UnhandledExceptionFilter GetCPInfo SystemTimeToTzSpecificLocalTime FindFirstFileExW GetSystemTimeAsFileTime GetFileAttributesExW IsProcessorFeaturePresent RtlUnwind IsDebuggerPresent EncodePointer GetCurrentProcessId GetCurrentProcess GlobalMemoryStatusEx GetProcAddress FreeLibrary SetFilePointerEx GetStringTypeW SetEndOfFile

user32

GetWindowThreadProcessId GetKeyboardLayoutList LoadKeyboardLayoutW IsWindow FindWindowA SendMessageTimeoutW UnloadKeyboardLayout FindWindowW LoadStringW OpenDesktopW CloseDesktop SystemParametersInfoW

advapi32

RegEnumValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW OpenProcessToken RegOpenKeyW GetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorSacl FreeSid SetEntriesInAclW ConvertStringSecurityDescriptorToSecurityDescriptorW AllocateAndInitializeSid GetNamedSecurityInfoW LookupAccountSidW GetAce LookupPrivilegeValueW SetNamedSecurityInfoW GetFileSecurityW GetAclInformation MapGenericMask RegEnumKeyExW RegDeleteValueW RegQueryInfoKeyW ConvertStringSidToSidW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyW DuplicateTokenEx CreateProcessAsUserW GetUserNameW GetLengthSid GetSidSubAuthorityCount GetSidSubAuthority SetTokenInformation GetTokenInformation RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW ord165 SHFileOperationW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoCreateInstance IIDFromString CLSIDFromString CoUninitialize CoInitialize StringFromIID CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

shlwapi

PathRemoveFileSpecW PathQuoteSpacesW PathFileExistsW StrStrIW PathAppendW SHDeleteKeyW PathFindFileNameW

imm32

ImmGetIMEFileNameW ImmGetHotKey ImmSetHotKey ImmInstallIMEW ImmDisableIME

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

a16f3f012a5685e14b2a4245eb971cc6_JaffaCakes118

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

imm32

version

generic