a55aea3c8743890bd5c868d930736c22_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a55aea3c8743890bd5c868d930736c22_JaffaCakes118
Size 794KB
Sample240613-nvvcvaxbrd
SHA256 cab95b63dba93782ac3650e07819e627b12e789a6989a8ad6896cd353870c2e7
MD5 a55aea3c8743890bd5c868d930736c22
SHA1 c17173d0ae302783c7080e7b15b5246a10cf715a
SHA512 c92b1c47e5cc494f56416f339a1d1ad250b718c20302617af047b0bc433ac21c00ce00258cc72b964f210083da44b195c3f5679672e9958f011466ffc989f13d
SSDEEP 12288:1R0ZqpeRguNUonUuNSSSSuSSXEShSSSSziNsvFIqPf:f0ZqpZQnSSSSuSSXEShSSSSzcUNPf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a55aea3c8743890bd5c868d930736c22_JaffaCakes118

.exe 794KB

a55aea3c8743890bd5c868d930736c22_JaffaCakes118

IMPHASH bfecaaab94acbf4570f22de5aced082c
SHA256 cab95b63dba93782ac3650e07819e627b12e789a6989a8ad6896cd353870c2e7
MD5 a55aea3c8743890bd5c868d930736c22
SHA1 c17173d0ae302783c7080e7b15b5246a10cf715a
SHA512 c92b1c47e5cc494f56416f339a1d1ad250b718c20302617af047b0bc433ac21c00ce00258cc72b964f210083da44b195c3f5679672e9958f011466ffc989f13d
SSDEEP 12288:1R0ZqpeRguNUonUuNSSSSuSSXEShSSSSziNsvFIqPf:f0ZqpZQnSSSSuSSXEShSSSSzcUNPf
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

c9:16:ae:6d:a2:4e:f2:24:f1:57:f2:98:5d:a1:f0:00:7e:82:53:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=AVANQUEST SOFTWARE,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technology,O=AVANQUEST SOFTWARE,L=Paris,ST=Paris,C=FR

Chains

Oct 24, 2012

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=AVANQUEST SOFTWARE,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technology,O=AVANQUEST SOFTWARE,L=Paris,ST=Paris,C=FR

Serial Number

79:cc:3e:5a:3d:b6:21:e7:88:98:c3:b6:69:10:4f:68

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 7, 2012 - Jan 31, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

253821

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

GetFileSize GetPrivateProfileIntW FindResourceExW GetDriveTypeW WriteFile lstrcpynW lstrcmpiW GetFileAttributesW FindClose FindFirstFileW UnmapViewOfFile MapViewOfFile GetSystemInfo VirtualQuery CompareStringA IsBadReadPtr CreateFileMappingW CreateDirectoryW CompareStringW GetCurrentDirectoryW ExpandEnvironmentStringsW SetFileAttributesW FileTimeToLocalFileTime GetFileTime HeapFree HeapAlloc GetProcessHeap TlsAlloc TlsSetValue GetCurrentThreadId GetProcAddress SetFilePointer GetModuleFileNameW lstrcpyW lstrlenW Sleep CloseHandle CreateProcessW RemoveDirectoryW DeleteFileW SetLastError CreateEventW QueryPerformanceFrequency GetSystemTimeAsFileTime ReleaseMutex GetUserDefaultLangID GetSystemDefaultLangID CreateMutexW SetErrorMode LoadLibraryW lstrcatW FreeLibrary GetDiskFreeSpaceW VerLanguageNameW WideCharToMultiByte ReadFile GetTickCount GetCommandLineW ExitThread CreateThread GetExitCodeProcess GetLocaleInfoW GetDateFormatA GetTimeFormatA CreateFileA FreeResource lstrcatA MulDiv lstrcmpiA GetPrivateProfileIntA GetPrivateProfileStringA GetPrivateProfileSectionNamesA GetOEMCP GetACP FlushFileBuffers SetStdHandle LoadLibraryA GetStringTypeW GetStringTypeA IsBadCodePtr IsValidLocale lstrcpyA lstrlenA GetWindowsDirectoryW InterlockedDecrement LocalFree InterlockedIncrement FormatMessageW GetTempPathW GetVersionExW CreateFileW GlobalFree FindResourceW LoadResource SizeofResource GlobalAlloc LockResource GlobalLock GlobalUnlock MultiByteToWideChar GetSystemDirectoryW SetCurrentDirectoryW GetModuleHandleW WaitForSingleObject ExitProcess GetCurrentProcess DuplicateHandle TerminateProcess MoveFileExW GetThreadContext VirtualProtectEx WriteProcessMemory FlushInstructionCache SetThreadContext ResumeThread GetLastError GetCPInfo GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCommandLineA GetEnvironmentStrings GetEnvironmentStringsW FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetStartupInfoW GetModuleHandleA HeapReAlloc RaiseException RtlUnwind DeleteCriticalSection InterlockedExchange lstrcmpW IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA GetModuleFileNameA SetUnhandledExceptionFilter HeapSize LCMapStringW LCMapStringA TlsGetValue GetTempFileNameW OpenProcess CompareFileTime GetProcessTimes GetLocalTime InitializeCriticalSection GetCurrentProcessId GetVersion LeaveCriticalSection EnterCriticalSection GetCurrentThread VirtualProtect SearchPathW ResetEvent SetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA FindNextFileW

user32

CharUpperW WaitForInputIdle DialogBoxIndirectParamW MessageBoxW wsprintfW SetForegroundWindow SetWindowLongW SetWindowTextW SendMessageW GetDlgItem LoadIconW EndDialog MoveWindow SetActiveWindow MapDialogRect SetFocus BeginPaint LoadStringW FillRect EndPaint GetMessageW DefWindowProcW GetWindow SystemParametersInfoW GetSystemMetrics MapWindowPoints GetPropW EnableMenuItem SetPropW RemovePropW GetSysColor LoadImageW GetDC ReleaseDC CreateDialogParamW GetParent GetWindowTextW IsWindowVisible ExitWindowsEx RegisterClassExW InvalidateRect IntersectRect EnumChildWindows GetWindowDC GetDlgItemTextW GetWindowRect UpdateWindow DrawIcon CreateWindowExW wsprintfA GetClassNameW CallWindowProcW DrawFocusRect InflateRect DrawTextW CopyRect CreateDialogIndirectParamW GetDesktopWindow GetClientRect IsWindowEnabled FindWindowExW IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects TranslateMessage DispatchMessageW EnableWindow ShowWindow SendDlgItemMessageW PostMessageW ScreenToClient SetWindowPos IsWindow DestroyWindow GetWindowLongW SetDlgItemTextW

gdi32

SetBkMode SetTextColor TextOutW RestoreDC SetBkColor CreateSolidBrush UnrealizeObject SelectPalette RealizePalette BitBlt CreateCompatibleDC SelectObject GetDIBColorTable GetSystemPaletteEntries CreatePalette DeleteDC CreateHalftonePalette GetDeviceCaps TranslateCharsetInfo GetObjectW CreateFontIndirectW DeleteObject DeleteMetaFile CreateCompatibleBitmap CreateDCW GetStockObject GetTextExtentPoint32W CreatePatternBrush CreateDIBitmap SetMetaFileBitsEx SetStretchBltMode SelectClipRgn CreateRectRgn SetPixel PatBlt PlayMetaFile StretchBlt CreateBitmap SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx SetMapMode SaveDC

advapi32

RegCreateKeyExW RegOpenKeyExA RegQueryValueExA OpenThreadToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyW RegEnumKeyW RegEnumKeyExW RegDeleteKeyW RegSetValueExW RegEnumValueW RegQueryValueExW RegDeleteValueW InitializeSecurityDescriptor SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegOpenKeyExW RegCloseKey

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoInitializeEx CoUninitialize CoInitializeSecurity

oleaut32

VariantChangeType VariantClear GetErrorInfo SysStringLen SysReAllocStringLen SysAllocString SysFreeString SysAllocStringLen

lz32

LZOpenFileW LZCopy LZClose

msi

ord88 ord137 ord141 ord169 ord8

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

Sharing

General

Malware Config

Signatures

File Explorer

a55aea3c8743890bd5c868d930736c22_JaffaCakes118

PE Signature issue

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

lz32

msi

rpcrt4

generic