0e5134605cc12329dff42159655d7f5c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e5134605cc12329dff42159655d7f5c_JaffaCakes118
Size

321KB
MD5

0e5134605cc12329dff42159655d7f5c
SHA1

869a154e5e1e3cc890596b2350df355da7f5575f
SHA256

567bcaf8eb076b7cf122e3eceaeca2d3de8ef3a86ca65cfa9e6bb5b0e85c6d4d
SHA512

8d4d53dbdf3a459d56ab25d6624e9214dccfbf30bf5e1a4340aa39ff3e08ac2a86971b4e53bfe846aaa329f734fcb37a5a4e5d351147a36d2c18d17f69e216af
SSDEEP

6144:oDSOYlwh7ertgM4Gmg/JEgcW5IcW4OHNuLIVbpET:U1YehKrtgMvmycWKcWWGM

Score

1^/10

Malware Config

Signatures

Files

0e5134605cc12329dff42159655d7f5c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cae1148b66c3604cbbd793f252d2d959

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/02/2009, 00:00

Not After

12/04/2012, 23:59

Subject

CN=CyberLink,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CyberLink,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fa:81:ac:a5:9d:d8:8c:1c:79:e5:8a:f6:06:4a:e1:bb:9d:da:3a:e3
Signer

Actual PE Digest

fa:81:ac:a5:9d:d8:8c:1c:79:e5:8a:f6:06:4a:e1:bb:9d:da:3a:e3

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msimg32

AlphaBlend

shlwapi

PathIsDirectoryW
PathIsRelativeW
PathFileExistsW
PathAddBackslashW
PathRemoveFileSpecW
PathCompactPathW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

mfc80u

ord5712
ord1472
ord6094
ord5558
ord4101
ord4074
ord4078
ord2261
ord1182
ord572
ord760
ord605
ord715
ord3678
ord1155
ord1386
ord1021
ord501
ord709
ord4347
ord2011
ord6232
ord1946
ord4094
ord2085
ord3238
ord1058
ord1274
ord2365
ord6140
ord5638
ord2297
ord2250
ord384
ord629
ord5083
ord317
ord584
ord1425
ord1430
ord1894
ord1117
ord1178
ord1202
ord1154
ord3331
ord4480
ord2856
ord5196
ord1590
ord1646
ord1647
ord1955
ord5171
ord1353
ord4961
ord3339
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord2386
ord2402
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord2384
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord5210
ord4179
ord6271
ord5067
ord1899
ord5148
ord4238
ord1393
ord3940
ord1608
ord1611
ord5911
ord6721
ord284
ord6700
ord290
ord282
ord1479
ord900
ord288
ord277
ord410
ord648
ord5711
ord3137
ord2361
ord4123
ord261
ord4267
ord2711
ord1553
ord5162
ord1351
ord3338
ord2414
ord2413
ord2415
ord2412
ord2411
ord1610
ord5910
ord6763
ord3968
ord4854
ord4857
ord4373
ord4378
ord4375
ord4393
ord4395
ord4380
ord4770
ord4581
ord4172
ord4165
ord4974
ord4383
ord4775
ord4198
ord4784
ord4437
ord4438
ord3734
ord4908
ord4513
ord4514
ord4914
ord4553
ord5043
ord4433
ord4362
ord4495
ord4840
ord4964
ord745
ord4474
ord4965
ord4510
ord4667
ord4194
ord4942
ord4788
ord4281
ord4370
ord4371
ord4957
ord4790
ord4704
ord4358
ord4799
ord5047
ord4958
ord4643
ord4940
ord4501
ord4955
ord4668
ord4125
ord1293
ord1999
ord4126
ord3990
ord5524
ord2260
ord5414
ord556
ord744
ord380
ord5489
ord2697
ord2696
ord3195
ord5091
ord5342
ord347
ord602
ord3155
ord1270
ord1271
ord5633
ord5727
ord5884
ord6058
ord3174
ord5715
ord5917
ord5397
ord5410
ord5584
ord5519
ord5643
ord5723
ord6033
ord6053
ord4155
ord6050
ord5604
ord6056
ord5607
ord2521
ord2362
ord531
ord723
ord1476
ord4119
ord354
ord3635
ord4574
ord4729
ord1920
ord1719
ord1720
ord3176
ord4256
ord5199
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord4884
ord4206
ord5178
ord3590
ord3296
ord563
ord753
ord1156
ord557
ord6061
ord6278
ord6063
ord2648
ord5829
ord3756
ord1006
ord6251
ord1939
ord2985
ord657
ord3400
ord2255
ord1561
ord4223
ord2151
ord4755
ord6279
ord3223
ord4231
ord1924
ord6262
ord1388
ord620
ord1545
ord4558
ord5053
ord3395
ord1183
ord4882
ord741
ord4234
ord1582
ord2086
ord3471
ord3644
ord2894
ord3686
ord2789
ord3735
ord5202
ord1634
ord1572
ord3286
ord1785
ord1883
ord2121
ord2897
ord5319
ord432
ord667
ord6288
ord5322
ord3089
ord1435
ord774
ord5398
ord2460
ord283
ord4109
ord896
ord899
ord5485
ord5609
ord2155
ord4112
ord3249
ord1571
ord5327
ord6293
ord5316
ord1172
ord6282
ord1176
ord2340
ord2651
ord3824
ord266
ord776
ord2311
ord265
ord777
ord6086
ord2366
ord2239
ord566
ord3677
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5579
ord3800
ord1007
ord5096
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord3942
ord4562
ord5226
ord5209
ord5562
ord2531
ord2725
ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord762
ord2310
ord4026
ord1079
ord1118
ord280
ord757
ord3198
ord3204
ord1925
ord287
ord577
ord293
ord764
ord1198
ord4523
ord5799

msvcr80

_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
__dllonexit
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_adjust_fdiv
wcslen
memset
free
_wcsdup
wcscpy
wcsncat
wcscat
_wsplitpath
_wcsnicmp
wcscmp
_wtoi
_wcsicmp
_itow
_wfopen
fwrite
fclose
malloc
srand
_time64
rand
_swprintf
memcpy
wcsstr
fwprintf
__iob_func
ceil
floor
_wmkdir
strcpy
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
__CxxFrameHandler3

kernel32

TerminateProcess
GetCurrentProcess
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
GetCurrentThreadId
GetTickCount
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
lstrlenA
SetFileAttributesW
MultiByteToWideChar
GetCurrentDirectoryW
LoadLibraryW
FreeLibrary
CloseHandle
GetProcAddress
GetModuleFileNameW
OutputDebugStringW
FormatMessageW
GetLastError
LocalFree
WaitForSingleObject
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileMappingW
ExitProcess
QueryPerformanceCounter
ExpandEnvironmentStringsW
lstrlenW
TerminateThread
SuspendThread
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
UnhandledExceptionFilter
GetCurrentProcessId
GetPrivateProfileStringW
ResumeThread
Sleep

user32

GetParent
GetWindowDC
GetWindowLongW
SetRectEmpty
FillRect
MessageBoxW
LoadImageW
GrayStringW
DrawTextExW
TabbedTextOutW
IsWindowVisible
DrawTextW
GetClientRect
EnableWindow
PtInRect
GetCursorPos
SetCapture
PostMessageW
IsChild
EnableMenuItem
GetSubMenu
LoadMenuW
SetTimer
IsWindow
SendMessageW
KillTimer
UpdateWindow
SetWindowRgn
LoadCursorW
LoadIconW
DefWindowProcW
GetWindow
BringWindowToTop
GetWindowRect
InvalidateRect
ReleaseCapture
ClientToScreen
WindowFromPoint
IsRectEmpty
InflateRect
GetCapture
SendMessageTimeoutW
GetClassInfoW
GetFocus
SetCursor
RedrawWindow
ScreenToClient
PeekMessageW
TranslateMessage
DispatchMessageW
UnionRect
GetDesktopWindow
GetKeyState
RegisterWindowMessageW
SetRect
SetForegroundWindow
IsIconic
GetLastActivePopup
FindWindowW
ReleaseDC
GetDC
GetSystemMetrics
CopyRect

gdi32

GetStockObject
GetBkColor
GetTextColor
PtInRegion
CreateFontIndirectW
CreateSolidBrush
CombineRgn
CreateRectRgn
CreatePolygonRgn
GetPixel
StretchBlt
CreateDIBSection
CreatePalette
GetSystemPaletteEntries
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
DPtoLP
GetViewportExtEx
GetWindowExtEx
GetMapMode
LPtoDP
SetTextColor
SetBkMode
CreateDCW
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetTextExtentPoint32W
DeleteObject
GetDeviceCaps

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

comctl32

_TrackMouseEvent

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysFreeString
SysAllocString

msvcp80

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

gdiplus

GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingMode
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipAlloc
GdipImageRotateFlip
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
GdipCloneImage

Sections

.text
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 36KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cae1148b66c3604cbbd793f252d2d959

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5fCertificate

Extended Key Usages

Key Usages

fa:81:ac:a5:9d:d8:8c:1c:79:e5:8a:f6:06:4a:e1:bb:9d:da:3a:e3Signer

Headers

File Characteristics

Imports

msimg32

shlwapi

version

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp80

gdiplus

Sections

.text Size: 160KB - Virtual size: 156KB

.rdata Size: 48KB - Virtual size: 46KB

.data Size: 36KB - Virtual size: 47KB

.rsrc Size: 68KB - Virtual size: 140KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

37:d3:74:0f:b0:4d:b7:fa:54:df:df:35:8b:ef:6d:5f
Certificate

fa:81:ac:a5:9d:d8:8c:1c:79:e5:8a:f6:06:4a:e1:bb:9d:da:3a:e3
Signer

.text
Size: 160KB - Virtual size: 156KB

.rdata
Size: 48KB - Virtual size: 46KB

.data
Size: 36KB - Virtual size: 47KB

.rsrc
Size: 68KB - Virtual size: 140KB