a4a255000750ba764d20b6ded423bcbb_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a4a255000750ba764d20b6ded423bcbb_JaffaCakes118
Size

524KB
MD5

a4a255000750ba764d20b6ded423bcbb
SHA1

fc56945a903155d088983b51839b45ccbaeec4c2
SHA256

06302c1d6200fe1991a2da1a3cc3aa7bf0f15231a52e27438e0959cf71850da6
SHA512

51a8878d958d9a0196aa9ad1ce0fab7038f7429c8b26bd6b269e09f8b26adaaca81654c4dffe9bd5e1826e7a6b26d02ee18760382f761a70018bc623eb5dabbb
SSDEEP

12288:DzllhnfuOxLGOL39G08A8dxnMXgYxZADkFBfxzWg/vm:DpHxykMxnMX3ADOxKg/vm

Score

1^/10

Malware Config

Signatures

Files

a4a255000750ba764d20b6ded423bcbb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

78cb0ea06274bdca981a552196d91055

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

14:44:84:51:c4:ac:ac:4a:2a:ac:a6:37:28:8d:b6:59
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17-03-2014 00:00

Not After

17-03-2015 23:59

Subject

CN=Rational Thought Solutions,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Rational Thought Solutions,L=St. James,ST=St. James,C=BB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

82:54:d8:ce:5e:75:28:41:8d:f6:98:41:2c:09:1a:0e:ae:08:7d:dd
Signer

Actual PE Digest

82:54:d8:ce:5e:75:28:41:8d:f6:98:41:2c:09:1a:0e:ae:08:7d:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

winhttp

WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle

kernel32

GetFileSizeEx
CloseHandle
ReadFile
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetCurrentProcessId
TerminateProcess
IsWow64Process
GetCurrentProcess
GetTempPathW
CopyFileW
DeleteFileW
GetSystemTimeAsFileTime
IsDebuggerPresent
GetCurrentThreadId
GetLocalTime
GetVersionExW
CreateFileW
GetModuleFileNameW
FormatMessageW
InterlockedDecrement
WaitForSingleObject
GetTimeZoneInformation
lstrcmpA
lstrcpyW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
LocalAlloc
GetLastError
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
SetStdHandle
WriteConsoleW
ReadConsoleW
SetFilePointer
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
GetOEMCP
GetACP
GetFileType
GetProcessHeap
WriteFile
SetEndOfFile
SetEnvironmentVariableA
GetConsoleCP
GetStdHandle
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
CreateProcessW
GetStringTypeW
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
lstrlenA
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
GetDriveTypeW
GetCPInfo
GetCommandLineW
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsValidCodePage

advapi32

RegQueryValueExW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptGetHashParam
RegCreateKeyExW
RegOpenKeyExW
CryptAcquireContextW
RegEnumKeyExW
RegCloseKey

ole32

CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

oleaut32

SysFreeString
SysAllocString
VariantClear

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CryptMsgClose
CertGetNameStringW
CryptDecodeObject
CertCloseStore
CryptQueryObject

Sections

.text
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

78cb0ea06274bdca981a552196d91055

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

14:44:84:51:c4:ac:ac:4a:2a:ac:a6:37:28:8d:b6:59Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

82:54:d8:ce:5e:75:28:41:8d:f6:98:41:2c:09:1a:0e:ae:08:7d:ddSigner

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

winhttp

kernel32

advapi32

ole32

oleaut32

crypt32

Sections

.text Size: 390KB - Virtual size: 390KB

.rdata Size: 69KB - Virtual size: 69KB

.data Size: 11KB - Virtual size: 26KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 45KB - Virtual size: 45KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

14:44:84:51:c4:ac:ac:4a:2a:ac:a6:37:28:8d:b6:59
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

82:54:d8:ce:5e:75:28:41:8d:f6:98:41:2c:09:1a:0e:ae:08:7d:dd
Signer

.text
Size: 390KB - Virtual size: 390KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 11KB - Virtual size: 26KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 45KB - Virtual size: 45KB