0e62875041e16ce16a7a63c3145b9c7a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0e62875041e16ce16a7a63c3145b9c7a_JaffaCakes118
Size

306KB
MD5

0e62875041e16ce16a7a63c3145b9c7a
SHA1

68886142e537867aa57852173a46d46ab0f12724
SHA256

70204c3d6db75a1f111fa42cd58a96610eeb283a207995c8247749226aafc489
SHA512

990b0480fe6a58e08b0ca33d6b425040b47bf1d902f2c0200b2cf0e81f9a34868b40020ac9499eb385913f55a603dba68230a1b2ad252bf2b2dc84bda91b7671
SSDEEP

6144:qWZQU+xdNzh+z2m6waiXlSIYSqcOYeQm19xOqXsP7EsK1R6:YU+g2eF1SHdcOGM9x/IjK1R6

Score

1^/10

Malware Config

Signatures

Files

0e62875041e16ce16a7a63c3145b9c7a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3725e6571af6364d86d42b70fc7114ca

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

Issuer

CN=55666123h

Not Before

14-02-2012 20:22

Not After

31-12-2039 23:59

Subject

CN=55666123h

Extended Key Usages

ExtKeyUsageCodeSigning

35:df:b4:1b:d8:33:df:f4:6a:ae:86:72:7a:49:4a:0e:47:f5:41:0d
Signer

Actual PE Digest

35:df:b4:1b:d8:33:df:f4:6a:ae:86:72:7a:49:4a:0e:47:f5:41:0d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
lstrlenW
lstrcpyW
CreateFileW
VirtualAlloc
GetTempPathW
MulDiv
SetProcessWorkingSetSize
GetProcessShutdownParameters
FillConsoleOutputAttribute
SetComputerNameExW
FindResourceExW
GetWriteWatch
GetTimeFormatW
SetThreadPriority
Module32First
GetModuleHandleA
PulseEvent
lstrcmp
GetPrivateProfileIntA
DebugActiveProcess
VerifyVersionInfoW
SetLocalTime
RemoveDirectoryW
AreFileApisANSI
SetCommBreak
FindVolumeClose
ReadConsoleOutputW
UnlockFile
TransmitCommChar
OpenProcess
GetSystemTimeAsFileTime
SetLocaleInfoW
GetSystemPowerStatus
CommConfigDialogA
GetStringTypeExA
EnumDateFormatsExA
GetCPInfoExA
ReleaseSemaphore
VirtualFreeEx
GetShortPathNameA
SetConsoleOutputCP
TerminateJobObject
EnumResourceLanguagesA
HeapSize
DeviceIoControl
SleepEx
GetVersionExW
DebugBreak
BeginUpdateResourceW
OpenFileMappingA
GetTapePosition
Sleep
LocalHandle
SetEnvironmentVariableW
SetHandleInformation
lstrlenA
MoveFileExA
GetPrivateProfileSectionA
WaitForSingleObject
CreateJobObjectW
LockFile
CreateDirectoryExA
ReadConsoleInputA
WriteProfileStringW
CallNamedPipeA
LCMapStringW
FindFirstChangeNotificationA
CreateHardLinkW
WriteProcessMemory
OpenSemaphoreW
GetProfileStringA
CopyFileW
_lclose
ReleaseMutex
EnumSystemCodePagesW
RtlFillMemory
SetConsoleTitleA
FlushViewOfFile
EraseTape
SetLocaleInfoA
GetConsoleTitleA
SetEvent
GetBinaryTypeW
BackupSeek
DeleteTimerQueueEx
SetComputerNameW
GetConsoleDisplayMode
ScrollConsoleScreenBufferW
RequestWakeupLatency
GlobalGetAtomNameA
PostQueuedCompletionStatus
OpenSemaphoreA
SearchPathW
SetThreadIdealProcessor
MapUserPhysicalPagesScatter
GetConsoleAliasA
SetSystemTime
OpenMutexW
CreateFileA
GetHandleInformation
EscapeCommFunction
GetDiskFreeSpaceExA
GetSystemDirectoryW
ResetWriteWatch
EnumDateFormatsA
FlushFileBuffers
GetProfileIntA
MapViewOfFile
IsValidLanguageGroup
RemoveDirectoryA
PrepareTape
CreateMutexW
LockResource
GetThreadSelectorEntry
PurgeComm
GlobalReAlloc
ReadFileScatter
FatalExit
QueryPerformanceCounter
CreateTimerQueueTimer
IsProcessorFeaturePresent
SetCriticalSectionSpinCount
GetFileSizeEx
GetProfileSectionA
WritePrivateProfileStringA
LockFileEx
GetConsoleFontSize
SetConsoleMode
GetPrivateProfileSectionW
GetTempPathA
DnsHostnameToComputerNameW
InitAtomTable
ReadConsoleOutputA
IsSystemResumeAutomatic
CreateIoCompletionPort
WritePrivateProfileStructA
GetCommandLineA
FindNextChangeNotification
CreateMutexA

advapi32

RegOpenKeyW

ole32

OleCreateLinkToFileEx
CoGetCancelObject
CoUninitialize
CreateItemMoniker
HACCEL_UserSize
OleLoadFromStream
CoGetObject
OleCreateFromFile
CoReleaseServerProcess
HMENU_UserFree
MkParseDisplayName
StringFromGUID2
CoGetCallContext
OleCreateLinkFromDataEx
HMETAFILEPICT_UserFree
OleSetContainedObject
HACCEL_UserMarshal
StgOpenStorageOnILockBytes
OleIsCurrentClipboard
CoGetMalloc
STGMEDIUM_UserMarshal
CoUnmarshalInterface
WdtpInterfacePointer_UserUnmarshal
OleLoad
CoTestCancel
HBITMAP_UserUnmarshal
CoAllowSetForegroundWindow
UtGetDvtd16Info
CoRevokeClassObject
CLSIDFromProgID
GetHGlobalFromStream
StgGetIFillLockBytesOnFile
CoFreeAllLibraries
WriteStringStream
GetDocumentBitStg
OleCreateLinkFromData
StgConvertVariantToProperty
CoDosDateTimeToFileTime
SNB_UserMarshal
CoSuspendClassObjects
STGMEDIUM_UserSize
OleCreateDefaultHandler
CoDeactivateObject
OleGetClipboard
OleSetMenuDescriptor
StgIsStorageFile
OleNoteObjectVisible
CoLoadLibrary
StgIsStorageILockBytes
CoUnloadingWOW
OleCreateLinkToFile
ReadStringStream
HENHMETAFILE_UserSize
HMENU_UserMarshal
CoFileTimeToDosDateTime
UtConvertDvtd16toDvtd32
StringFromCLSID
OleRun
CoIsHandlerConnected
GetRunningObjectTable
CoRegisterSurrogateEx
OleFlushClipboard
HGLOBAL_UserSize
CoRegisterChannelHook
HDC_UserMarshal
HMETAFILEPICT_UserMarshal
CoQueryClientBlanket
CreateStdProgressIndicator
CreateAntiMoniker
OleSaveToStream
CoSwitchCallContext
CoGetMarshalSizeMax
UpdateDCOMSettings
CoLockObjectExternal
CoGetClassVersion
CoInitializeEx
OleSave
HkOleRegisterObject
WriteClassStm
CoCreateInstanceEx
CoFileTimeNow
OleRegGetUserType
BindMoniker
HENHMETAFILE_UserMarshal
CoWaitForMultipleHandles
OleConvertOLESTREAMToIStorage
CoReleaseMarshalData
CreateOleAdviseHolder
ProgIDFromCLSID
HICON_UserUnmarshal
StgConvertPropertyToVariant
ReadClassStg
CoCopyProxy
HDC_UserFree
ReadClassStm
PropVariantClear
StgCreatePropSetStg
CoCreateFreeThreadedMarshaler
HGLOBAL_UserUnmarshal
STGMEDIUM_UserFree
OleGetIconOfFile
SNB_UserFree
OleQueryCreateFromData
CoRevertToSelf
RevokeDragDrop
DllDebugObjectRPCHook
HBRUSH_UserSize
CreatePointerMoniker
CoMarshalHresult
HMETAFILE_UserMarshal
OleRegGetMiscStatus
CoRegisterClassObject
CreateStreamOnHGlobal
CreateGenericComposite
CoResumeClassObjects
CoGetCurrentProcess
StgOpenPropStg
CoRevokeMallocSpy
CoDisconnectObject
WriteOleStg
OleCreateFromDataEx
OleCreateStaticFromData
HMETAFILEPICT_UserSize
ReadFmtUserTypeStg
OleCreateFromData
CoQueryProxyBlanket
OleDestroyMenuDescriptor

comctl32

ord4
ImageList_GetImageCount
ImageList_Draw
ImageList_GetImageInfo
ImageList_GetIcon
CreatePropertySheetPageA
InitMUILanguage
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_ReplaceIcon
ImageList_GetDragImage
ImageList_Add
ord15
ImageList_Merge
ord13
FlatSB_GetScrollInfo
ImageList_Read
ImageList_Copy
ImageList_DragMove
FlatSB_SetScrollInfo
PropertySheet
ord16
ImageList_SetFilter
ImageList_DragEnter
ImageList_GetIconSize
ImageList_DragShowNolock
ImageList_SetOverlayImage
ord17
ord3
CreatePropertySheetPageW
CreateStatusWindow
DrawStatusTextW
_TrackMouseEvent
ImageList_LoadImage
ImageList_SetImageCount
ord14
ImageList_Destroy
UninitializeFlatSB
ImageList_EndDrag
ImageList_Write
ImageList_LoadImageW
FlatSB_SetScrollPos
ImageList_GetBkColor
PropertySheetA
FlatSB_SetScrollProp
ImageList_DrawEx
DrawStatusText
ImageList_Duplicate
CreateStatusWindowW
InitializeFlatSB
ImageList_BeginDrag
ord7
ord8
FlatSB_GetScrollProp
ImageList_Remove
DestroyPropertySheetPage
ImageList_Replace
FlatSB_EnableScrollBar
FlatSB_GetScrollPos
ImageList_LoadImageA
ord2
FlatSB_GetScrollRange
CreateToolbarEx
ord5
ImageList_Create
ImageList_GetImageRect

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV2
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textF4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.textV3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV1
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3725e6571af6364d86d42b70fc7114ca

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86Certificate

Extended Key Usages

35:df:b4:1b:d8:33:df:f4:6a:ae:86:72:7a:49:4a:0e:47:f5:41:0dSigner

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

comctl32

Sections

.text Size: 4KB - Virtual size: 4KB

.textV2 Size: 278KB - Virtual size: 278KB

.textF4 Size: 2KB - Virtual size: 2KB

.data Size: 10KB - Virtual size: 9KB

.textV3 Size: 1024B - Virtual size: 1000B

.textV4 Size: 1024B - Virtual size: 1000B

.textV1 Size: 1024B - Virtual size: 1000B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 1KB

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

35:df:b4:1b:d8:33:df:f4:6a:ae:86:72:7a:49:4a:0e:47:f5:41:0d
Signer

.text
Size: 4KB - Virtual size: 4KB

.textV2
Size: 278KB - Virtual size: 278KB

.textF4
Size: 2KB - Virtual size: 2KB

.data
Size: 10KB - Virtual size: 9KB

.textV3
Size: 1024B - Virtual size: 1000B

.textV4
Size: 1024B - Virtual size: 1000B

.textV1
Size: 1024B - Virtual size: 1000B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 1KB