039402b7abe83363a8f474e437213356_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

039402b7abe83363a8f474e437213356_JaffaCakes118
Size

268KB
MD5

039402b7abe83363a8f474e437213356
SHA1

80d982039c9ffae08e90280cf5cf158253e3448c
SHA256

d7f7ac20f859c4bc21d716b873e0a9fcc0b5ae79a5a44fd72aa20f41fd540913
SHA512

d3b7930c263b2be4d607894b4cb690e789e754ee4e08ca2f65ac1955c8060f810297266be3e0c150add470961db5f892227db20cfa3de55d69aa3ad0e2b8cb6b
SSDEEP

1536:xnA2g/HTjfVN6Vf4c9xFCrk0sNLU1xdn8+kAN7y4cSWDuoIQsnf4q:AyykNcZcgQG

Score

1^/10

Malware Config

Signatures

Files

039402b7abe83363a8f474e437213356_JaffaCakes118
.exe windows:4 windows x86 arch:x86

42d2f438293346c0e007ff442973d48d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:09:26:5c:db:37:d6:b8:2d:24:d0:b0:6f:93:18:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

12/06/2008, 00:00

Not After

23/07/2011, 23:59

Subject

CN=ALWIL Software,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ALWIL Software,O=ALWIL Software,L=Praha,ST=Praha,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

40:1b:14:e3:9e:a6:39:a2:ca:94:73:ba:83:1a:3e:71:93:92:4e:19
Signer

Actual PE Digest

40:1b:14:e3:9e:a6:39:a2:ca:94:73:ba:83:1a:3e:71:93:92:4e:19

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\400\Release\aswAvast.pdb

Imports

aswbase

_basInitLibrary@4
_basFreeLibrary@0
_basFreeLanguage@4
_basLogEvent@24
_basCheck@0
_basGetErrorString@12
_basGetProfileStringA@20
_basGetProfileInt@12
_basFreeStorage@4
_basGetLanguagePath@0
_basIsOS@4
_basInitThreadLocale@0
_basExecuteAndWait@8
_basCreatePath@16
_basProductInfoFilesOnly@0
_basLoadLanguage@4
_basIsCurrCodePageSkinnable@0
_basIsManagedAvast@0
_basIsWhsEdition@0
_licShowDialog@8
_basPlaySound@4
_basGetProcAddress@8
_basLoadStorage@0
_basProductInfo@0

aswuint

_usiErrorMessage@28
_usiInitLibrary@4
_usiFreeLibrary@0
_usiMakeReboot@4
??0CNewsViewerCtrl@@QAE@XZ
_usiGetALWILRegistryValue@12
_usiFormatDateTime@16
?ShowRecentNews@CNewsViewerCtrl@@QAEKVCOleDateTime@ATL@@AAH_N@Z
?Initialize@CNewsViewerCtrl@@QAEKAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@0K@Z
??1CNewsViewerCtrl@@UAE@XZ
_usiMessage@20

xt1922

?SetXButtonStyle@CXTButton@@QAEKKH@Z
??0CXTButton@@QAE@XZ
??1CXTButton@@UAE@XZ

mfc71

ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2537
ord2731
ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord566
ord757
ord578
ord1123
ord876
ord3850
ord2322
ord310
ord2248
ord764
ord2020
ord1126
ord5975
ord1054
ord3830
ord3641
ord1084
ord3210
ord1934
ord3163
ord1280
ord5182
ord4890
ord1671
ord1670
ord1551
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord1010
ord1908
ord5073
ord6275
ord4185
ord5203
ord3403
ord4722
ord4282
ord1600
ord5960
ord5235
ord5233
ord923
ord928
ord932
ord930
ord934
ord2390
ord2410
ord2394
ord2400
ord2398
ord2396
ord2413
ord2408
ord2392
ord2415
ord2403
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord5175
ord1964
ord1656
ord1655
ord1599
ord5200
ord2862
ord4486
ord4262
ord3182
ord605
ord4125
ord4320
ord6067
ord2657
ord3934
ord911
ord5529
ord2902
ord784
ord297
ord1489
ord299
ord2933
ord6118
ord1903
ord1063
ord1308
ord2176
ord2321
ord5563
ord781
ord304
ord4035
ord354
ord1794
ord4749
ord709
ord501
ord1482
ord907
ord2131
ord4212
ord2164
ord4115
ord6090
ord4580
ord3684
ord3161
ord1279
ord5637
ord3596
ord5915
ord1402
ord5214
ord760
ord572
ord602
ord347
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord6278
ord4014
ord4038
ord3683
ord4541
ord266
ord265
ord762
ord5152
ord1207

msvcr71

_mbsnbcmp
strlen
_setmbcp
fopen
fclose
getc
atoi
_ismbcdigit
_snprintf
_except_handler3
__CxxFrameHandler
free
_mbsnbcpy
_mbscmp
_mbsicmp
_localtime64
swprintf
sprintf
ceil
floor
_time64
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
__security_error_handler
memset

kernel32

GetProcAddress
FreeLibrary
LoadLibraryExA
lstrcatA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
ExitProcess
GetModuleHandleA
GetVersionExA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
GetLastError
CloseHandle
TerminateThread
GetExitCodeThread
WaitForSingleObject
CreateThread
GetModuleFileNameA

user32

LoadBitmapA
GetSystemMetrics
LoadIconA
EnableWindow
SetForegroundWindow
KillTimer
SetTimer
InvalidateRect
GetClientRect
GetWindowRect
IsIconic
SendMessageA
DrawIcon
MessageBoxA

gdi32

StretchBlt
GetObjectA
RealizePalette
CreateCompatibleDC
CreateSolidBrush

comctl32

ord17

oleaut32

SystemTimeToVariantTime

aswcmnos

dep_osIsWow64

aswcmnb

fsGetAvastDataPath
fsGetAvastProgramPath
fsGetAvastLicenseFile

aswengin

BtsSchedule
avscanGetVirusDetails

aswtask

_tskFreeData@4
_tskFreeLibrary@0
_tskCopyResult@4
_tskFreeResult@4
_tskLogResult@12
_tskProcessData@16
_tskVirusAction@4
_tskInitLibrary@0
_tskExecData@8

advapi32

RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

aswcmns

DSA_FileVerify

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42d2f438293346c0e007ff442973d48d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

40:09:26:5c:db:37:d6:b8:2d:24:d0:b0:6f:93:18:57Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

40:1b:14:e3:9e:a6:39:a2:ca:94:73:ba:83:1a:3e:71:93:92:4e:19Signer

Headers

File Characteristics

PDB Paths

Imports

aswbase

aswuint

xt1922

mfc71

msvcr71

kernel32

user32

gdi32

comctl32

oleaut32

aswcmnos

aswcmnb

aswengin

aswtask

advapi32

aswcmns

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 360B

.rsrc Size: 224KB - Virtual size: 223KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

40:09:26:5c:db:37:d6:b8:2d:24:d0:b0:6f:93:18:57
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

40:1b:14:e3:9e:a6:39:a2:ca:94:73:ba:83:1a:3e:71:93:92:4e:19
Signer

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 360B

.rsrc
Size: 224KB - Virtual size: 223KB