0cfa4c860c004b9f67182be60d7b0dd5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0cfa4c860c004b9f67182be60d7b0dd5_JaffaCakes118
Size

263KB
MD5

0cfa4c860c004b9f67182be60d7b0dd5
SHA1

808caf30c69f6b5c9accd212fcb6638819f605d9
SHA256

970048091f330ef69e7bb6b6c2d2e2d1b356b09058ab8ae69e8df0ca9ba59b32
SHA512

e19017010620f7aa39911646a5098d0ab0b48bb737f4b61afacb9ebc56a40f6c7b762fcd6bf0af0d72f20bc0e9d42db0737bec928ea6f26983d99d1a1d799d21
SSDEEP

3072:eXGmjPHxd5aVVYe4ilwPhvqnWeFbUfaUMqqDL2/zkHM0KKtgoj2dQfcLl:eXHv5yYbilwZynWexq6qqDL6T0JtfTo

Score

1^/10

Malware Config

Signatures

Files

0cfa4c860c004b9f67182be60d7b0dd5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32416aed9f894d8a6113cc9004ecc9c1

Code Sign

04:00:00:00:00:00:f9:7f:aa:2e:1e
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16/12/2003, 13:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:10:92:eb:82:95
Certificate

Issuer

CN=GlobalSign RootSign Partners CA,OU=RootSign Partners CA,O=GlobalSign nv-sa,C=BE

Not Before

05/02/2007, 09:00

Not After

27/01/2014, 09:00

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign,1.2.840.113549.1.9.1=#0c1c74696d657374616d70696e666f40676c6f62616c7369676e2e636f6d

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:00:00:00:00:01:1a:d9:8a:14:a9
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

30/06/2008, 12:54

Not After

30/06/2011, 12:54

Subject

CN=Dr. Kaiser Systemhaus GmbH,O=Dr. Kaiser Systemhaus GmbH,C=DE,1.2.840.113549.1.9.1=#0c11696e666f4064722d6b61697365722e6465

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:17:ab:50:b9:15
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:8d:10:99:7c:b4:40:32:bc:2d:de:19:4a:4a:d9:92:44:10:4c:ab
Signer

Actual PE Digest

0c:8d:10:99:7c:b4:40:32:bc:2d:de:19:4a:4a:d9:92:44:10:4c:ab

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Projects\dks\51\LC51\PdsLspService\Release\PdsLspSvDKS.pdb

Imports

kernel32

SetLastError
DeviceIoControl
FreeLibrary
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
GetVersionExA
GetStartupInfoA
GetModuleFileNameA
FindFirstFileA
GetCurrentThreadId
SuspendThread
GetLocalTime
OutputDebugStringA
InterlockedExchange
GetWindowsDirectoryA
CreateProcessA
TerminateProcess
FindClose
GetCurrentDirectoryA
GetCurrentProcess
GetComputerNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoA
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
ResumeThread
ExitThread
QueryPerformanceCounter
CreateEventA
SetEvent
CreateThread
CloseHandle
Sleep
TerminateThread
WriteFile
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
HeapSize
LCMapStringW
MultiByteToWideChar
LCMapStringA
LoadLibraryW
SetFilePointer
SetHandleCount
GetModuleHandleA
RtlUnwind
FlushFileBuffers
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
GetModuleHandleW
VirtualAlloc
VirtualFree
HeapCreate
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
WaitForSingleObject
CreateFileA
GetConsoleMode
GetConsoleCP
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
HeapReAlloc
WideCharToMultiByte

user32

ExitWindowsEx
GetThreadDesktop
SwitchDesktop
SetThreadDesktop
FindWindowA
SendMessageA
CloseDesktop

advapi32

OpenSCManagerA
CloseServiceHandle
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CreateProcessAsUserA
ControlService
QueryServiceStatus
StartServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
CreateServiceA
RegisterServiceCtrlHandlerA
DeleteService
OpenServiceA

shell32

SHGetSpecialFolderPathA

ole32

CoInitializeEx
CoCreateInstance

ws2_32

WSACleanup
select
ntohl
htonl
getsockname
bind
socket
closesocket
sendto
accept
setsockopt
recv
send
inet_addr
htons
ntohs
shutdown
connect
recvfrom
WSAStartup
ioctlsocket
gethostbyname
gethostbyaddr
WSASetLastError
getservbyname
listen
getservbyport
inet_ntoa
WSAGetLastError

winmm

mixerGetControlDetailsA
mixerGetNumDevs
mixerClose
mixerGetLineInfoA
mixerGetLineControlsA
mixerOpen
timeGetTime
mixerSetControlDetails

netapi32

Netbios

iphlpapi

GetAdaptersInfo

shlwapi

PathAppendA

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32416aed9f894d8a6113cc9004ecc9c1

Code Sign

04:00:00:00:00:00:f9:7f:aa:2e:1eCertificate

Key Usages

04:00:00:00:00:01:08:d9:61:1c:d6Certificate

Key Usages

04:00:00:00:00:01:10:92:eb:82:95Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:1a:d9:8a:14:a9Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:17:ab:50:b9:15Certificate

Key Usages

0c:8d:10:99:7c:b4:40:32:bc:2d:de:19:4a:4a:d9:92:44:10:4c:abSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

ws2_32

winmm

netapi32

iphlpapi

shlwapi

Sections

.text Size: 158KB - Virtual size: 157KB

.rdata Size: 89KB - Virtual size: 88KB

.data Size: 7KB - Virtual size: 34KB

.rsrc Size: 2KB - Virtual size: 2KB

04:00:00:00:00:00:f9:7f:aa:2e:1e
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

04:00:00:00:00:01:10:92:eb:82:95
Certificate

01:00:00:00:00:01:1a:d9:8a:14:a9
Certificate

04:00:00:00:00:01:17:ab:50:b9:15
Certificate

0c:8d:10:99:7c:b4:40:32:bc:2d:de:19:4a:4a:d9:92:44:10:4c:ab
Signer

.text
Size: 158KB - Virtual size: 157KB

.rdata
Size: 89KB - Virtual size: 88KB

.data
Size: 7KB - Virtual size: 34KB

.rsrc
Size: 2KB - Virtual size: 2KB