045ebcafafe03e2077070124b30caa47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

045ebcafafe03e2077070124b30caa47_JaffaCakes118
Size

391KB
MD5

045ebcafafe03e2077070124b30caa47
SHA1

b47e583ae5d84f58800d1493736b3cc23c6992c1
SHA256

c3940f3708fe33ae0926f1ab39e9cefbba41a9a15c9afb72eb830ffa2d8ff876
SHA512

6ad2950008eded82766af76ada0b8143c089342eee8ef9983e67876d73cf7a1b9ce9983e678952810d841a2c3de55eaed4fb506daedeaf8b8c7bdb3e461c8fc2
SSDEEP

6144:QZTiGQQq3mkUGFcdMy0vz4ayNLnG2DvWy7jHmSaLFHcftGVblytM7XwGPgI9mK:x1+GFcqymz4ayNLGFGja5rbGM7gGPgNK

Score

1^/10

Malware Config

Signatures

Files

045ebcafafe03e2077070124b30caa47_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9a0d3d6b98f2f2975d7b5cfe34d044b5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:85:e6:b4:33:5a:a8:51:6e:f8:34:b8:2d:3e:90:cc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/11/2011, 00:00

Not After

05/01/2013, 23:59

Subject

CN=NHN corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NHN corp.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:92:35:90:6f:fd:5f:f4:f8:02:81:20:7a:28:1a:07:85:11:98:5a
Signer

Actual PE Digest

1d:92:35:90:6f:fd:5f:f4:f8:02:81:20:7a:28:1a:07:85:11:98:5a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

n:\export\toolbar\toolbar\4.0.137.13-real\build\pdb\Uninstall.pdb

Imports

wininet

FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
InternetQueryDataAvailable
InternetCloseHandle
HttpQueryInfoW
DeleteUrlCacheEntryW
HttpSendRequestW
HttpOpenRequestW
InternetAttemptConnect
InternetConnectW
InternetSetOptionW
InternetOpenW
InternetCrackUrlW
InternetOpenUrlW
InternetGetConnectedState
FindCloseUrlCache
InternetReadFile
InternetGetCookieW

kernel32

TlsSetValue
TlsFree
GetCurrentThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
ExitProcess
RtlUnwind
WriteFile
GetStdHandle
GetModuleFileNameA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
GetStringTypeA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
TlsAlloc
FindClose
InterlockedExchange
LoadLibraryA
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
FlushFileBuffers
CompareStringA
SetEnvironmentVariableA
GetModuleHandleA
GetVersionExW
lstrcpyW
GetExitCodeProcess
OpenProcess
ReleaseMutex
CreateMutexW
lstrcpynW
GetSystemTime
OutputDebugStringW
Process32Next
Process32First
CreateToolhelp32Snapshot
CopyFileW
OpenFile
GetTempFileNameW
GetTempPathW
GetShortPathNameA
CreateDirectoryW
GetFullPathNameW
WritePrivateProfileStringW
GetPrivateProfileStringW
OutputDebugStringA
Sleep
CreateThread
FreeLibrary
InitializeCriticalSection
TlsGetValue
GetOEMCP
GetACP
HeapAlloc
InitializeCriticalSectionAndSpinCount
HeapFree
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
LoadResource
InterlockedCompareExchange
GetProcessHeap
IsProcessorFeaturePresent
LocalAlloc
LocalFree
lstrcmpA
LockResource
SizeofResource
GetCurrentProcess
FlushInstructionCache
SetLastError
DeleteCriticalSection
CloseHandle
CreateMutexA
GetLastError
GetCurrentThreadId
RaiseException
SetConsoleCtrlHandler

user32

SetForegroundWindow
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
GetClassNameW
MonitorFromRect
GetActiveWindow
PostQuitMessage
EndDialog
EnableMenuItem
DestroyMenu
GetMonitorInfoW
MonitorFromWindow
UnregisterClassA
GetMenuItemInfoW
SetMenuItemInfoW
UpdateWindow
GetParent
GetWindow
GetWindowRect
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItem
GetSystemMenu
GetSystemMetrics
DestroyWindow
IsWindow
ShowWindow
TranslateMessage
GetWindowTextW

gdi32

SetBkColor
ExtTextOutW

advapi32

GetUserNameW
RegEnumKeyW
AllocateAndInitializeSid
RegCloseKey
FreeSid
EqualSid
GetTokenInformation
OpenProcessToken

shell32

SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoUninitialize
CLSIDFromString
OleRun
StringFromCLSID
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize

oleaut32

VariantClear
SetErrorInfo
VariantInit
SysAllocString
CreateErrorInfo
SysStringLen
VarUI4FromStr
SysFreeString
GetErrorInfo
VariantChangeType

shlwapi

StrCmpNW
StrRetToStrW
StrChrW
PathCombineW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
SHDeleteKeyW
SHDeleteValueW
PathFileExistsW

comctl32

InitCommonControlsEx

winmm

PlaySoundA

imm32

ImmReleaseContext
ImmSetCompositionStringW
ImmGetConversionStatus
ImmGetContext
ImmSetConversionStatus

wintrust

WinVerifyTrust

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptDecodeObject
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CertFreeCertificateContext

urlmon

URLDownloadToFileW
ObtainUserAgentString

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoW

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a0d3d6b98f2f2975d7b5cfe34d044b5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

17:85:e6:b4:33:5a:a8:51:6e:f8:34:b8:2d:3e:90:ccCertificate

Extended Key Usages

Key Usages

1d:92:35:90:6f:fd:5f:f4:f8:02:81:20:7a:28:1a:07:85:11:98:5aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

winmm

imm32

wintrust

crypt32

urlmon

version

Sections

.text Size: 283KB - Virtual size: 282KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 33KB - Virtual size: 33KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

17:85:e6:b4:33:5a:a8:51:6e:f8:34:b8:2d:3e:90:cc
Certificate

1d:92:35:90:6f:fd:5f:f4:f8:02:81:20:7a:28:1a:07:85:11:98:5a
Signer

.text
Size: 283KB - Virtual size: 282KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 33KB - Virtual size: 33KB