0b147d5f4fcf4c665f142d6209fa1cb2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b147d5f4fcf4c665f142d6209fa1cb2_JaffaCakes118
Size

148KB
MD5

0b147d5f4fcf4c665f142d6209fa1cb2
SHA1

9f0a8a886ac19b5caa841059da793c11935924d3
SHA256

77293255d2e6c1d3ceaeed6739073a6844b976ff8497924a4695318f0f61f993
SHA512

494f1cb36e28ae870bebb32ae537ec31bcd75c38e3479ca589b9c2c6fdae723168eca004d4627fa8a9a3255147a225bcb81ee89bcf29f33ebd11dab1e6517f04
SSDEEP

3072:IzoO/uK1i+hXsSQMo9+IL4BHtfeePs6DF2O6E3SFZOKF7rBQY0VZ3LQuwbgZ9V:IsO/uKyMa0BHzvDVCFZOhLcuw8Zb

Score

1^/10

Malware Config

Signatures

Files

0b147d5f4fcf4c665f142d6209fa1cb2_JaffaCakes118
.exe windows:4 windows x64 arch:x64

92e40efa6765f8361e596bcdc63c9f88

Code Sign

01:00:00:00:00:01:09:bb:94:49:48
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

02/03/2006, 15:29

Not After

02/03/2009, 15:29

Subject

CN=Jonathan Bennett,C=GB,1.2.840.113549.1.9.1=#0c18737570706f7274406175746f69747363726970742e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

02:00:00:00:00:00:d6:78:b7:94:05
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01/09/1998, 12:00

Not After

28/01/2014, 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:b4:f6:88:f7:4a:9c:9c:d5:1e:cb:f5:87:64:e3:b4:75:82:f5:af
Signer

Actual PE Digest

ea:b4:f6:88:f7:4a:9c:9c:d5:1e:cb:f5:87:64:e3:b4:75:82:f5:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

InitCommonControlsEx

winmm

timeGetTime

kernel32

GetVersionExA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSection
LoadLibraryA
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
HeapSetInformation
DeleteCriticalSection
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleFileNameA
GetStdHandle
WriteFile
RtlUnwindEx
ExitProcess
HeapSize
Sleep
LCMapStringW
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
FlsAlloc
SetLastError
FlsFree
TlsFree
GetCurrentThreadId
FreeLibrary
GlobalUnlock
GetProcAddress
GlobalLock
GetModuleHandleW
GlobalAlloc
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CloseHandle
FlsSetValue
ReadProcessMemory
OpenProcess
GetVersionExW
MulDiv
FlsGetValue
GetModuleHandleA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
GetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

user32

SetWindowTextW
GetDC
GetWindowRect
GetForegroundWindow
GetCursorPos
CloseClipboard
MoveWindow
GetParent
GetDesktopWindow
SetClipboardData
GetWindowLongPtrW
EmptyClipboard
OpenClipboard
AttachThreadInput
SendMessageTimeoutW
ReleaseCapture
SendDlgItemMessageW
DispatchMessageW
SetCapture
TranslateMessage
GetWindowDC
SetCursor
IsDialogMessageW
EndDeferWindowPos
GetMessageW
DeferWindowPos
SetTimer
BeginDeferWindowPos
ShowWindow
DefWindowProcW
GetClientRect
SetWindowPos
WindowFromPoint
GetMenu
MessageBoxW
GetWindowThreadProcessId
CheckMenuItem
DestroyWindow
LoadCursorW
KillTimer
LoadImageW
PostQuitMessage
IsWindowVisible
RegisterHotKey
GetCursor
GetWindowPlacement
ClientToScreen
SendMessageW
EnumChildWindows
CreateWindowExW
GetWindowTextW
RegisterClassExW
GetDlgCtrlID
LoadIconW
EnableWindow
DestroyIcon
RedrawWindow
GetWindowLongW
InvalidateRect
ReleaseDC
GetClassNameW
ScreenToClient

gdi32

Rectangle
GetStockObject
SelectObject
CreatePen
DeleteDC
BitBlt
LineTo
DeleteObject
MoveToEx
GetPixel
SetROP2
CreateFontW
StretchBlt
PatBlt
CreateCompatibleBitmap
CreateCompatibleDC

comdlg32

ChooseColorW

advapi32

RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92e40efa6765f8361e596bcdc63c9f88

Code Sign

01:00:00:00:00:01:09:bb:94:49:48Certificate

Key Usages

02:00:00:00:00:00:d6:78:b7:94:05Certificate

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:08:d9:61:1c:d6Certificate

Key Usages

04:00:00:00:00:01:08:d9:61:24:48Certificate

Key Usages

ea:b4:f6:88:f7:4a:9c:9c:d5:1e:cb:f5:87:64:e3:b4:75:82:f5:afSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

winmm

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 78KB - Virtual size: 78KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 6KB - Virtual size: 1.4MB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 30KB - Virtual size: 29KB

01:00:00:00:00:01:09:bb:94:49:48
Certificate

02:00:00:00:00:00:d6:78:b7:94:05
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

ea:b4:f6:88:f7:4a:9c:9c:d5:1e:cb:f5:87:64:e3:b4:75:82:f5:af
Signer

.text
Size: 78KB - Virtual size: 78KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 6KB - Virtual size: 1.4MB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 30KB - Virtual size: 29KB