a3aa9342592feeb9d2e655ef483c7d8e_JaffaCakes118

General

Target
a3aa9342592feeb9d2e655ef483c7d8e_JaffaCakes118
Size 47KB
Sample240613-dy5b4swekm
SHA256 49c40475545075f6594cb37bc8c5fc4f8d749deecfd60f5ca2aa16bae442fa08
MD5 a3aa9342592feeb9d2e655ef483c7d8e
SHA1 4c72f16fb4c3812dc53e941c52611ef9c23fe52b
SHA512 204a3651cfd95b4c908937471b0dceed53d79434803016b65719e63bafb37eacbd00b372f0627a13174835ae889821f68db1da3ffa73475caf6417b7f0364114
SSDEEP 768:BLYl7gEuVyqy9sriOkqQLI1DzohU1XhDGpKgri9:BLYlBuI9qBYUNC9U
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a3aa9342592feeb9d2e655ef483c7d8e_JaffaCakes118

.dll 47KB

a3aa9342592feeb9d2e655ef483c7d8e_JaffaCakes118

IMPHASH a37436e164c2de5041f30b99de64cc5d
SHA256 49c40475545075f6594cb37bc8c5fc4f8d749deecfd60f5ca2aa16bae442fa08
MD5 a3aa9342592feeb9d2e655ef483c7d8e
SHA1 4c72f16fb4c3812dc53e941c52611ef9c23fe52b
SHA512 204a3651cfd95b4c908937471b0dceed53d79434803016b65719e63bafb37eacbd00b372f0627a13174835ae889821f68db1da3ffa73475caf6417b7f0364114
SSDEEP 768:BLYl7gEuVyqy9sriOkqQLI1DzohU1XhDGpKgri9:BLYlBuI9qBYUNC9U
MD5 SHA1 SHA512 SSDEEP

Digest

66:9b:ca:b0:f6:07:c6:37:58:44:ca:8a:1e:ed:b5:8c:e3:0e:90:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Nicholas Forystek,O=Nicholas Forystek,L=Mound,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c13737570706f7274406e656f746578742e6f7267

Chains

Jan 30, 2017

CN=Nicholas Forystek,O=Nicholas Forystek,L=Mound,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c13737570706f7274406e656f746578742e6f7267

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Nicholas Forystek,O=Nicholas Forystek,L=Mound,ST=Minnesota,C=US,1.2.840.113549.1.9.1=#0c13737570706f7274406e656f746578742e6f7267

Serial Number

04:0b:67:08:f9:94:fa:d5:d2:3f:54:72:25:53:b9:0b

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 16, 2015 - Sep 20, 2018

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

0

Major OS version

4

Entry point

5704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaHresultCheck __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaAptOffset __vbaFreeVarList _adj_fdiv_m64 __vbaPut4 __vbaRaiseEvent __vbaFreeObjList ord516 _adj_fprem1 ord518 __vbaVarSetVarAddref __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj __vbaVargVarCopy _adj_fdiv_m32 ord592 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaBoolVar ord520 __vbaBoolVarNull __vbaRefVarAry _CIsin ord709 ord525 ord632 __vbaVargVarMove __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord529 __vbaStrCmp __vbaVarTstEq __vbaGet4 __vbaObjVar ord561 ord562 DllFunctionCall __vbaVarOr ord564 _adj_fpatan __vbaFixstrConstruct EVENT_SINK_Release __vbaNew _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile __vbaStrToUnicode ord712 ord713 _adj_fprem _adj_fdivr_m64 ord607 __vbaFailedFriend ord608 ord716 __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaDateVar __vbaI2Var ord644 _CIlog __vbaFileOpen ord648 __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var ord577 _adj_fdiv_r ord685 __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 __vbaVarCmpEq ord104 ord105 __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaFpI2 ord616 __vbaVarCopy __vbaFpI4 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaStrMove ord619 __vbaVarNeg _allmul __vbaLenVarB _CItan _CIexp __vbaFreeStr __vbaFreeObj

Sharing

General

Malware Config

Signatures

File Explorer

a3aa9342592feeb9d2e655ef483c7d8e_JaffaCakes118

msvbvm60

generic