afc022b732a0a5c8fe8c0ea495807b99_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

afc022b732a0a5c8fe8c0ea495807b99_JaffaCakes118
Size

15.4MB
MD5

afc022b732a0a5c8fe8c0ea495807b99
SHA1

e667b5e2a98ecb592e80335146e54fbb91db2a15
SHA256

ad03ffb994bbc9878783f029b932ec88daa511d3a8bd9e30624fce1f32c6e899
SHA512

4acbe2a5f20ebe8c45ae36afb7e48f89d03c413829239a986102bdbebc20a94d158afcdce0639ffc790d57cce156087bc78e65a67c706576fcd41ce28864bdbe
SSDEEP

393216:eO0Vhwv5OXpOiNcPYcExJHCa68bul7P0gYzbdVC5iL:evCv5OXpOrP+viaZbS7pYPdV4iL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Crk/DOLKR.exe

Files

afc022b732a0a5c8fe8c0ea495807b99_JaffaCakes118
.rar
Crk/DOLKR.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 615KB - Virtual size: 614KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 57B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Read me.txt
dolkr.exe
.exe windows:4 windows x86 arch:x86

a604c6ea79d5ea984febff3382a81f77

Code Sign

01:cf:d4:29:00:61:05:4f:f2:62:57:21:b2:1e:97:5b
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/03/2020, 00:00

Not After

02/12/2020, 12:00

Subject

SERIALNUMBER=4124331,CN=DataNumen\, Inc.,O=DataNumen\, Inc.,L=Wilmington,ST=Delaware,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:51:41:53:b4:04:b9:8a:fb:eb:56:c2:04:d5:d6:5b
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26/09/2017, 00:00

Not After

02/12/2020, 12:00

Subject

SERIALNUMBER=4124331,CN=DataNumen\, Inc.,O=DataNumen\, Inc.,L=Wilmington,ST=Delaware,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:cc:43:df:e2:aa:8d:5e:ec:db:63:61:3a:70:7b:9d:73:4d:2a:b9:60:4d:2a:23:a2:c6:aa:15:b5:02:b9:4c
Signer

Actual PE Digest

fb:cc:43:df:e2:aa:8d:5e:ec:db:63:61:3a:70:7b:9d:73:4d:2a:b9:60:4d:2a:23:a2:c6:aa:15:b5:02:b9:4c

Digest Algorithm

sha256

PE Digest Matches

true

bd:29:c1:ec:c9:52:b1:aa:a9:20:71:d2:da:d4:cd:d3:3e:83:58:3b
Signer

Actual PE Digest

bd:29:c1:ec:c9:52:b1:aa:a9:20:71:d2:da:d4:cd:d3:3e:83:58:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetCommandLineA
CloseHandle
UnmapViewOfFile
WriteFile
MapViewOfFile
CreateFileMappingA
GetTempFileNameA
GetTempPathA
CreateFileA
GetShortPathNameA
GetModuleFileNameA

user32

wsprintfA

Sections

.text
Size: 1024B - Virtual size: 521B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 597B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
安下载帮助.htm
.html

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 615KB - Virtual size: 614KB

DATA Size: 12KB - Virtual size: 11KB

BSS Size: - Virtual size: 4KB

.idata Size: 11KB - Virtual size: 10KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 57B

.reloc Size: 42KB - Virtual size: 42KB

.rsrc Size: 7.2MB - Virtual size: 7.2MB

a604c6ea79d5ea984febff3382a81f77

Code Sign

01:cf:d4:29:00:61:05:4f:f2:62:57:21:b2:1e:97:5bCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

09:51:41:53:b4:04:b9:8a:fb:eb:56:c2:04:d5:d6:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

fb:cc:43:df:e2:aa:8d:5e:ec:db:63:61:3a:70:7b:9d:73:4d:2a:b9:60:4d:2a:23:a2:c6:aa:15:b5:02:b9:4cSigner

bd:29:c1:ec:c9:52:b1:aa:a9:20:71:d2:da:d4:cd:d3:3e:83:58:3bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 1024B - Virtual size: 521B

.rdata Size: 1024B - Virtual size: 597B

.rsrc Size: 8.4MB - Virtual size: 8.4MB

CODE
Size: 615KB - Virtual size: 614KB

DATA
Size: 12KB - Virtual size: 11KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 11KB - Virtual size: 10KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 57B

.reloc
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 7.2MB - Virtual size: 7.2MB

01:cf:d4:29:00:61:05:4f:f2:62:57:21:b2:1e:97:5b
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

09:51:41:53:b4:04:b9:8a:fb:eb:56:c2:04:d5:d6:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

fb:cc:43:df:e2:aa:8d:5e:ec:db:63:61:3a:70:7b:9d:73:4d:2a:b9:60:4d:2a:23:a2:c6:aa:15:b5:02:b9:4c
Signer

bd:29:c1:ec:c9:52:b1:aa:a9:20:71:d2:da:d4:cd:d3:3e:83:58:3b
Signer

.text
Size: 1024B - Virtual size: 521B

.rdata
Size: 1024B - Virtual size: 597B

.rsrc
Size: 8.4MB - Virtual size: 8.4MB