a4d2c6cd7e548df5f183ae6d4f81f1e6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

a4d2c6cd7e548df5f183ae6d4f81f1e6_JaffaCakes118
Size

363KB
MD5

a4d2c6cd7e548df5f183ae6d4f81f1e6
SHA1

bd86f1164760583bc271c32153324e3f69b144b7
SHA256

d5928c945386a8b2600ec8690517d242578503524219cac6d88f99f7e8af6e05
SHA512

cd9abe1e24029680141d34b4a0d19d7a123043dfe78e1b2a7b4bbd467ca8cea45e8ec2fe68368b7d85b9e9a720ea3dcae4852e58d1679d8b348f8907255c3d41
SSDEEP

6144:a3nxE9AbcxDeSvGJy69Ky0ExPVCB8D1Km42bhZPHnSSIXIKWBJg5HpKgxpme9IVo:aXxwe7Ky0cCOD1KH2XnTI6yaimjYrB

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Windows 8.1 x86 Activator NO/KEDP.dll
unpack001/Windows 8.1 x86 Activator NO/WinDivert.dll
unpack001/Windows 8.1 x86 Activator NO/Windows 8.1 Activator By Simon-Benyo.exe

Files

a4d2c6cd7e548df5f183ae6d4f81f1e6_JaffaCakes118
.rar
Windows 8.1 x86 Activator NO/KEDP.dll
.dll windows:5 windows x86 arch:x86

0958aab4795f23141be0650f5437556a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\Documents\My Source Code\C++\Projects\Visual Studio\KMSEmulator\KMS Emulator DLL\bin\x86\Release\KMS Emulator DLL.pdb

Imports

rpcrt4

NdrServerCall2
NdrClientCall2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIfEx
UuidFromStringW
RpcStringFreeW
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

kernel32

GetCommandLineA
GetCurrentThreadId
GetLastError
HeapFree
EncodePointer
DecodePointer
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
GetSystemDefaultLCID
LeaveCriticalSection
HeapSize
RaiseException
WriteFile
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetTimeZoneInformation
RtlUnwind
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetStringTypeW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
SetEnvironmentVariableA
OpenProcess
GetCurrentProcess
CompareStringW
GetSystemTimeAsFileTime
GetTickCount
EnterCriticalSection
CloseHandle
FreeEnvironmentStringsW
GetModuleHandleW

advapi32

RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
LookupPrivilegeValueW
RegQueryValueExW
OpenProcessToken
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptSetHashParam
CryptDecrypt
CryptDestroyKey
CryptReleaseContext
CryptSetKeyParam
CryptGenRandom
CryptAcquireContextW
CloseEventLog
ReportEventW
SetServiceStatus
OpenEventLogW
CryptEncrypt
CryptImportKey

ole32

CoCreateGuid

Exports

Exports

KillKMSServer
RunKMSClient
RunKMSServer

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows 8.1 x86 Activator NO/WinDivert.dll
.dll windows:6 windows x86 arch:x86

ecc0e8f80353839329c3e67ce657cc06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
TlsAlloc
TlsGetValue
CreateEventW
TlsFree
IsWow64Process
DeviceIoControl
GetOverlappedResult
SetLastError
GetLastError
CloseHandle
CreateFileW
TlsSetValue
GetCurrentDirectoryW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
OutputDebugStringW
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW

advapi32

OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
StartServiceW

Exports

Exports

DivertClose
DivertGetParam
DivertHelperCalcChecksums
DivertHelperParseIPv4Address
DivertHelperParseIPv6Address
DivertHelperParsePacket
DivertOpen
DivertRecv
DivertSend
DivertSetParam
WinDivertClose
WinDivertDllEntry
WinDivertGetParam
WinDivertHelperCalcChecksums
WinDivertHelperParseIPv4Address
WinDivertHelperParseIPv6Address
WinDivertHelperParsePacket
WinDivertOpen
WinDivertRecv
WinDivertRecvEx
WinDivertSend
WinDivertSendEx
WinDivertSetParam

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows 8.1 x86 Activator NO/WinDivert32.sys
.sys windows:6 windows x86 arch:x86

c4d14fa112d98c8012c7b23ea664ac24

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:73:ac:83:dd:32:f5:4f:f6:cd:7f:84:6d:44:b8:ba
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/05/2013, 00:00

Not After

01/08/2014, 12:00

Subject

CN=Nemea Mjukvaruutveckling AB,O=Nemea Mjukvaruutveckling AB,L=Stockholm,ST=Vastra Gotaland,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:69:bd:7e:b4:8e:c4:91:21:0c:46:f1:2c:b6:b6:a6:94:ca:64:54
Signer

Actual PE Digest

b8:69:bd:7e:b4:8e:c4:91:21:0c:46:f1:2c:b6:b6:a6:94:ca:64:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\divert-master\install\WDDK\i386\WinDivert32.pdb

Imports

ntoskrnl.exe

RtlCopyUnicodeString
KeBugCheckEx
KeTickCount
ExUuidCreate
IoAllocateMdl
MmBuildMdlForNonPagedPool
memcpy
ExAllocatePoolWithTag
memmove
MmMapLockedPagesSpecifyCache
ExFreePoolWithTag
IoFreeMdl
KeDelayExecutionThread
memset
_allmul

hal

KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock

ndis.sys

NdisFreeNetBufferListPool
NdisGetDataBuffer
NdisAllocateNetBufferListPool
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart

fwpkclnt.sys

FwpsCalloutRegister0
FwpsInjectNetworkReceiveAsync0
FwpsInjectForwardAsync0
FwpsAllocateNetBufferAndNetBufferList0
FwpmCalloutAdd0
FwpsAllocateCloneNetBufferList0
FwpsQueryPacketInjectionState0
FwpmEngineOpen0
FwpsInjectionHandleCreate0
FwpsInjectNetworkSendAsync0
FwpmEngineClose0
FwpmSubLayerDeleteByKey0
FwpsInjectionHandleDestroy0
FwpmSubLayerAdd0
FwpsCalloutUnregisterByKey0
FwpmCalloutDeleteByKey0
FwpmFilterDeleteByKey0
FwpsFreeNetBufferList0
FwpsFreeCloneNetBufferList0
FwpmFilterAdd0

wdfldr.sys

WdfVersionBindClass
WdfVersionUnbindClass
WdfVersionBind
WdfVersionUnbind

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Windows 8.1 x86 Activator NO/Windows 8.1 Activator By Simon-Benyo.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 270KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

7lHaeT/c
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0958aab4795f23141be0650f5437556a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

iphlpapi

ws2_32

kernel32

advapi32

ole32

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 156KB

.rdata Size: 49KB - Virtual size: 48KB

.data Size: 6KB - Virtual size: 16KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

ecc0e8f80353839329c3e67ce657cc06

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 4KB - Virtual size: 3KB

c4d14fa112d98c8012c7b23ea664ac24

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

07:73:ac:83:dd:32:f5:4f:f6:cd:7f:84:6d:44:b8:baCertificate

Extended Key Usages

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

b8:69:bd:7e:b4:8e:c4:91:21:0c:46:f1:2c:b6:b6:a6:94:ca:64:54Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

ndis.sys

fwpkclnt.sys

wdfldr.sys

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 2KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 1KB - Virtual size: 1KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

.text
Size: 156KB - Virtual size: 156KB

.rdata
Size: 49KB - Virtual size: 48KB

.data
Size: 6KB - Virtual size: 16KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

07:73:ac:83:dd:32:f5:4f:f6:cd:7f:84:6d:44:b8:ba
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

b8:69:bd:7e:b4:8e:c4:91:21:0c:46:f1:2c:b6:b6:a6:94:ca:64:54
Signer

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 2KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 270KB - Virtual size: 269KB

.rsrc
Size: 15KB - Virtual size: 15KB

.reloc
Size: 512B - Virtual size: 12B

7lHaeT/c
Size: 90KB - Virtual size: 89KB