081c0b7fc0ce1af7355ef3d0cadad385_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

081c0b7fc0ce1af7355ef3d0cadad385_JaffaCakes118
Size

113KB
MD5

081c0b7fc0ce1af7355ef3d0cadad385
SHA1

a2d0e341c103af9afbd568470601e2cf572971cb
SHA256

911f02a9d5411e6b1c8d77440bdc4877e269c15ae826bea5b543e5f1d35e0ebd
SHA512

633b2b215f40d2ff507a480dcf34f0c8613210fb86818a9e4fe961206f5a060c36b59c1102f0afbef728b24f277e76037bbd2a497ddc3761ae5eefa1131db745
SSDEEP

3072:MIuPz4jHCwz0yrEtWJf7SiG+BAyIlA/27Q3yyNpLN:CPMjvE4pG+BAzAe7QJLN

Score

1^/10

Malware Config

Signatures

Files

081c0b7fc0ce1af7355ef3d0cadad385_JaffaCakes118
.gz
sample
.exe windows:4 windows x86 arch:x86

d3acb09aec9120315de6b1965e98c1bc

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:6f:03:49:d2:1f:37:5a:cf:79:31:91
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/04/2020, 09:56

Not After

25/04/2023, 09:56

Subject

CN=Biz Secure Labs Pvt. Ltd,O=Biz Secure Labs Pvt. Ltd,L=Pune,ST=Maharashtra,C=IN,1.2.840.113549.1.9.1=#0c1a737570706f727440696e646961616e746976697275732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

94:01:9f:89:d3:71:fd:2c:38:58:f0:53:1a:e9:99:5b:34:86:82:2d
Signer

Actual PE Digest

94:01:9f:89:d3:71:fd:2c:38:58:f0:53:1a:e9:99:5b:34:86:82:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveExtensionA
StrStrIA
PathIsDirectoryA
PathFileExistsA
SHDeleteKeyA

advapi32

ChangeServiceConfig2A
CheckTokenMembership
GetServiceKeyNameA
QueryServiceConfigA
EnumDependentServicesA
QueryServiceStatusEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
SetNamedSecurityInfoA
SetEntriesInAclA
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
CloseServiceHandle
StartServiceA
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetKeySecurity
AddAccessAllowedAceEx
InitializeAcl
GetLengthSid
RegOpenKeyExA
InitializeSid
GetSidLengthRequired
ChangeServiceConfigA
QueryServiceStatus
ControlService

ws2_32

inet_ntoa
gethostname
gethostbyname
WSACleanup
WSAStartup

mpr

WNetEnumResourceA
WNetCloseEnum
WNetOpenEnumA

mfc42

ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord1146
ord1168
ord4224
ord3337
ord548
ord823
ord800
ord4160
ord540
ord2863
ord2379
ord755
ord470
ord1105
ord551
ord2820
ord5572
ord2915
ord1576
ord2818
ord920
ord5216
ord860
ord537
ord858
ord4129
ord4853
ord4376
ord5265
ord1134
ord2621
ord2514
ord641
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord825
ord4710
ord6877

msvcrt

_onexit
__dllonexit
_mbsupr
_mbsstr
_CxxThrowException
_mbscmp
_ftol
atol
srand
rand
free
strtok
_local_unwind2
_except_handler3
fgets
atoi
strchr
strtol
??1type_info@@UAE@XZ
ftell
malloc
fread
fwrite
sscanf
fopen
fputs
fclose
strrchr
_strcmpi
sprintf
_strupr
strstr
exit
printf
__CxxFrameHandler
_exit
_XcptFilter
_acmdln
__getmainargs
_setmbcp
_itoa
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
fseek
_controlfp

kernel32

GetPrivateProfileIntA
MultiByteToWideChar
GetStartupInfoA
GetLastError
GetComputerNameA
GetFileTime
LoadLibraryA
FreeLibrary
CreateProcessA
WaitForSingleObject
SetFilePointer
GetTempPathA
GetTickCount
GetSystemDirectoryA
GetSystemTime
CloseHandle
ReadFile
CreateFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ReleaseMutex
CreateMutexA
LocalFree
GetCurrentProcess
WritePrivateProfileStringA
DeleteFileA
GetLocalTime
CreateDirectoryA
Sleep
GetPrivateProfileStringA
GetVersionExA
GetVersion
RemoveDirectoryA
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileExA
GetEnvironmentVariableA
FindClose
FindNextFileA
SetFileAttributesA
FindFirstFileA
GetWindowsDirectoryA
lstrlenA
MoveFileA
CopyFileA
GetDriveTypeA
GetLogicalDriveStringsA
OpenMutexA
GetProcAddress
GetModuleHandleA
HeapFree
HeapAlloc
GetProcessHeap
LocalAlloc
GetModuleFileNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetFileSize

user32

EnableWindow
GetLastInputInfo
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
LoadIconA
GetSystemMenu
AppendMenuA
SendMessageA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

msvcirt

?read@istream@@QAEAAV1@PADH@Z
??0ifstream@@QAE@XZ
?close@ifstream@@QAEXXZ
??1ifstream@@UAE@XZ
?sh_read@filebuf@@2HB
?open@ifstream@@QAEXPBDHH@Z
??_Difstream@@QAEXXZ
??1ios@@UAE@XZ

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3acb09aec9120315de6b1965e98c1bc

Code Sign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

10:6f:03:49:d2:1f:37:5a:cf:79:31:91Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

94:01:9f:89:d3:71:fd:2c:38:58:f0:53:1a:e9:99:5b:34:86:82:2dSigner

Headers

File Characteristics

Imports

shlwapi

advapi32

ws2_32

mpr

mfc42

msvcrt

kernel32

user32

shell32

ole32

msvcirt

Sections

.text Size: 108KB - Virtual size: 107KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 20KB - Virtual size: 18KB

.rsrc Size: 160KB - Virtual size: 158KB

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

10:6f:03:49:d2:1f:37:5a:cf:79:31:91
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

94:01:9f:89:d3:71:fd:2c:38:58:f0:53:1a:e9:99:5b:34:86:82:2d
Signer

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 20KB - Virtual size: 18KB

.rsrc
Size: 160KB - Virtual size: 158KB