b64d5708e1913d20d1a9434f4d51ef1b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b64d5708e1913d20d1a9434f4d51ef1b_JaffaCakes118
Size

1.6MB
MD5

b64d5708e1913d20d1a9434f4d51ef1b
SHA1

a4f34383b7f86ecaffbad964bae8fd0f1a0a2bd8
SHA256

6cc9d12a3a4f057d9a433803c1e5212a5df4bf2240f6eb5d3f9802fad58e952b
SHA512

469f31a85f0a78d4e7424c42c14c83fe1c00c66e117aecd252a42e40670489eb99f02a230b1dc58af450631654069a6570c6d0b599cbef0aec9ae012d9ef8201
SSDEEP

24576:xqX4BKmKg4AquAPshjPSwngtHDZ+wKG8dfK5saLBH:G5TIAUtPSEgZZ+wKG8haTBH

Score

1^/10

Malware Config

Signatures

Files

b64d5708e1913d20d1a9434f4d51ef1b_JaffaCakes118
.exe windows:6 windows x86 arch:x86

89d47becf69dc9767e3cdd6757a27938

Code Sign

05:ad:73:47:54:97:a5:6f:b4:50:1a:b1:5e:fd:24:5b
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

09/01/2019, 00:00

Not After

09/01/2020, 23:59

Subject

CN=Springtech ltd,O=Springtech ltd,L=Limassol,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:b2:1d:8e:52:70:c0:f1:7e:39:f5:3e:e2:22:6c:3b:99:41:a8:7d
Signer

Actual PE Digest

26:b2:1d:8e:52:70:c0:f1:7e:39:f5:3e:e2:22:6c:3b:99:41:a8:7d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Autobuild\Work\trunk\SearchBar\Release\SearchBar.pdb

Imports

urlmon

CoInternetSetFeatureEnabled

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

HttpOpenRequestW
InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetOptionW

kernel32

GetTempFileNameW
GlobalUnlock
lstrcmpW
MulDiv
WriteFile
CreateFileW
CloseHandle
GetVersionExW
VerSetConditionMask
FreeLibrary
VerifyVersionInfoW
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
ReadFile
SetNamedPipeHandleState
CreateNamedPipeW
DisconnectNamedPipe
QueueUserWorkItem
CreateEventW
WaitForSingleObjectEx
WaitNamedPipeW
ConnectNamedPipe
FlushFileBuffers
OutputDebugStringW
CreateThread
GetCommandLineW
Sleep
GetCurrentProcessId
lstrcmpiW
LoadLibraryExW
TerminateProcess
K32GetModuleFileNameExW
GetTempPathW
LocalAlloc
OpenProcess
CreateToolhelp32Snapshot
GetPrivateProfileStringW
Process32NextW
Process32FirstW
LocalFree
CopyFileW
WaitForSingleObject
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
ExitProcess
ExitThread
VirtualQuery
GetSystemInfo
GetModuleHandleW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
VirtualProtect
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
QueryPerformanceCounter
GetCurrentThread
GetCurrentProcess
DuplicateHandle
GetStringTypeW
TryEnterCriticalSection
GetModuleHandleExW
IsProcessorFeaturePresent
EncodePointer
GetProcessHeap
DeleteCriticalSection
GlobalLock
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
ResetEvent
WriteConsoleW
FindResourceExW
LoadLibraryW
RaiseException
HeapReAlloc
DeleteFileW
GlobalAlloc
LockResource
SetEvent
GetLastError
MultiByteToWideChar
HeapSize
GetCurrentThreadId
InitializeCriticalSectionEx
WideCharToMultiByte
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
SetLastError
HeapFree
SizeofResource
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
SetEndOfFile
RtlUnwind

user32

DialogBoxParamW
RegisterWindowMessageW
ReleaseCapture
SetForegroundWindow
InvalidateRect
ReleaseDC
GetCursorPos
BeginPaint
EndPaint
EnableWindow
GetWindowTextW
TranslateMessage
SetLayeredWindowAttributes
DispatchMessageW
GetKeyState
GetMessageW
LoadImageW
SendMessageW
GetParent
GetClassInfoExW
GetDesktopWindow
PostQuitMessage
KillTimer
GetDlgItem
GetClientRect
EndDialog
MapWindowPoints
GetUpdateRect
SetCursor
DrawTextW
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
CallWindowProcW
PostMessageW
GetWindow
GetWindowRect
GetFocus
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
FillRect
CreateWindowExW
DeleteMenu
ScreenToClient
InsertMenuW
GetSystemMetrics
UnregisterClassW
SetWindowTextW
CreatePopupMenu
SetMenuItemBitmaps
RegisterClassExW
TrackPopupMenu
GetActiveWindow
ShowWindow
IsWindow
InvalidateRgn
SetTimer
RedrawWindow
GetMonitorInfoW
ClientToScreen
DestroyAcceleratorTable
IsChild
GetSysColor
IsWindowEnabled
MoveWindow
CreateAcceleratorTableW
LoadBitmapW
DestroyMenu
SetFocus
CharNextW
LoadIconW
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
GetObjectW
DeleteObject
CreateSolidBrush
ExtTextOutW
SetBkColor
SetViewportOrgEx
SetBkMode
SetTextColor
CreateFontIndirectW
DeleteDC

advapi32

OpenProcessToken
ConvertSidToStringSidW
GetLengthSid
DuplicateTokenEx
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetSecurityDescriptorLength
MakeSelfRelativeSD
CopySid
IsValidSid

shell32

SHAppBarMessage
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW

ole32

CoGetClassObject
OleUninitialize
OleLockRunning
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
VarBstrCat
VarUI4FromStr
LoadTypeLi
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
VariantClear

shlwapi

PathRemoveExtensionW
PathAppendW
PathFileExistsW
PathFindFileNameW

userenv

UnloadUserProfile

uxtheme

OpenThemeData
DrawThemeText
GetThemeSysColor
CloseThemeData

Sections

.text
Size: 629KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 767KB - Virtual size: 767KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89d47becf69dc9767e3cdd6757a27938

Code Sign

05:ad:73:47:54:97:a5:6f:b4:50:1a:b1:5e:fd:24:5bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

26:b2:1d:8e:52:70:c0:f1:7e:39:f5:3e:e2:22:6c:3b:99:41:a8:7dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

urlmon

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

uxtheme

Sections

.text Size: 629KB - Virtual size: 628KB

.rdata Size: 181KB - Virtual size: 180KB

.data Size: 29KB - Virtual size: 33KB

.rsrc Size: 767KB - Virtual size: 767KB

.reloc Size: 41KB - Virtual size: 41KB

05:ad:73:47:54:97:a5:6f:b4:50:1a:b1:5e:fd:24:5b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

26:b2:1d:8e:52:70:c0:f1:7e:39:f5:3e:e2:22:6c:3b:99:41:a8:7d
Signer

.text
Size: 629KB - Virtual size: 628KB

.rdata
Size: 181KB - Virtual size: 180KB

.data
Size: 29KB - Virtual size: 33KB

.rsrc
Size: 767KB - Virtual size: 767KB

.reloc
Size: 41KB - Virtual size: 41KB