a30c72f4c3dc2b60091aba0cfb47d7c8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a30c72f4c3dc2b60091aba0cfb47d7c8_JaffaCakes118
Size 448KB
Sample240613-aak2sawdqb
SHA256 1242735896addeac97f0b6cb493216299783038eb5ed1d2934161e27fc43c247
MD5 a30c72f4c3dc2b60091aba0cfb47d7c8
SHA1 d3c88e01cbeddd533b0be98ab38f372c25ae62c1
SHA512 53f70e4a2f02b61395730e69d0cc295462687acdb2ea401d29039d8b673a7360625cc6a39866924dab9cb999fe7866aa1f85ca8515525c75a0f8fe20750a2294
SSDEEP 12288:otq9TAeg/BdDOi9gqmk20IfghSp3GTp8J7s:oiTAxBd1jvJw7p3GTp8J7s
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a30c72f4c3dc2b60091aba0cfb47d7c8_JaffaCakes118

.exe 448KB

a30c72f4c3dc2b60091aba0cfb47d7c8_JaffaCakes118

IMPHASH 270c32d64c4496bc56f5a3e47e9a0048
SHA256 1242735896addeac97f0b6cb493216299783038eb5ed1d2934161e27fc43c247
MD5 a30c72f4c3dc2b60091aba0cfb47d7c8
SHA1 d3c88e01cbeddd533b0be98ab38f372c25ae62c1
SHA512 53f70e4a2f02b61395730e69d0cc295462687acdb2ea401d29039d8b673a7360625cc6a39866924dab9cb999fe7866aa1f85ca8515525c75a0f8fe20750a2294
SSDEEP 12288:otq9TAeg/BdDOi9gqmk20IfghSp3GTp8J7s:oiTAxBd1jvJw7p3GTp8J7s
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

32:94:1e:33:a9:aa:4d:90:19:cb:df:5a:a2:e1:0a:0f:31:29:78:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Positive Finds,O=Positive Finds,L=San Diego,ST=California,C=US

Chains

Jul 11, 2015

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Positive Finds,O=Positive Finds,L=San Diego,ST=California,C=US

Serial Number

36:c4:7a:2c:ba:b8:82:a6:50:f1:e1:b7:d4:be:3a:45

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 5, 2014 - Nov 5, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

138975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindNextFileW FindClose GetFileAttributesW CreateDirectoryW InitializeCriticalSectionAndSpinCount DeleteCriticalSection RaiseException FreeLibrary CreateEventW OpenProcess GetExitCodeProcess ResetEvent WaitForMultipleObjects SetEvent CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess LoadLibraryW GetComputerNameW ReleaseMutex CreateMutexW CreateNamedPipeW ConnectNamedPipe WaitNamedPipeW Sleep CancelIo CopyFileW SetErrorMode DecodePointer FindFirstFileW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW MoveFileExW CreateProcessW GetVersionExW DeleteFileW GetTempPathW GetOverlappedResult WriteFile ReadFile CreateFileW LocalFree WaitForSingleObject GetProcAddress GetModuleHandleW GetModuleFileNameW InterlockedDecrement CloseHandle GetLastError MultiByteToWideChar GetCurrentProcess WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW SizeofResource LockResource lstrlenA SetEndOfFile WriteConsoleW ReadConsoleW SetStdHandle UnregisterWaitEx LoadLibraryExW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc ExitThread LoadResource FindResourceW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetOEMCP GetACP IsValidCodePage GetStdHandle GetModuleHandleExW ExitProcess IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DuplicateHandle GetCurrentThread GetExitCodeThread GetSystemTimeAsFileTime EncodePointer GetStringTypeW IsProcessorFeaturePresent GetCommandLineW RtlUnwind CreateTimerQueue WaitForSingleObjectEx SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue TlsFree GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError GetStartupInfoW GetTickCount CreateSemaphoreW EnumSystemLocalesW

user32

IsWindowVisible FindWindowExW GetWindowThreadProcessId

advapi32

CreateProcessAsUserW InitializeSecurityDescriptor CryptDeriveKey CryptDestroyHash CryptHashData CryptCreateHash RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey DuplicateTokenEx LookupAccountSidW ConvertSidToStringSidW IsValidSid CryptReleaseContext CryptDestroyKey CryptDecrypt CryptEncrypt CryptExportKey CryptDuplicateKey CryptGenKey CryptImportKey CryptAcquireContextW LookupAccountNameW GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl

shell32

SHGetFolderPathW

ole32

CoCreateInstance StringFromGUID2 CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateGuid CoUninitialize

oleaut32

SysAllocString VariantClear SysFreeString

shlwapi

PathRemoveFileSpecW PathAppendW PathCombineW PathFileExistsW PathMakePrettyW PathRemoveArgsW PathRemoveExtensionW PathRenameExtensionW PathStripPathW PathUnquoteSpacesW

crypt32

CryptBinaryToStringA CryptStringToBinaryA

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpSendRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetModuleFileNameExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

a30c72f4c3dc2b60091aba0cfb47d7c8_JaffaCakes118

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

winhttp

version

psapi

userenv

generic