0eeef02febeab364345e942bb4c1d4ed_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0eeef02febeab364345e942bb4c1d4ed_JaffaCakes118
Size

141KB
MD5

0eeef02febeab364345e942bb4c1d4ed
SHA1

2e9ef3f07c6e086799f241c570639ff247d9cd56
SHA256

ca4866fe01cd89d2ce01fa7b59dfb26a94b1efae04d03f592fb64a72047062fe
SHA512

af8dfd2a31ce1d7fc8074146ccb6cc40a1fcf07975300533c779d4629ecfb19027364cba159c98b8cf93ed35333b6a91c5d5c4e21a6287b3373ae666c4e715af
SSDEEP

1536:A1twZHXh5r6HLsNeGdIqA0OxBPdoy9RGPJPC+cOoE7HOvo1F1qRH1B157g1M1x8i:v5XvW4NwDdryPpCrOoE7HwrODdXOD

Score

1^/10

Malware Config

Signatures

Files

0eeef02febeab364345e942bb4c1d4ed_JaffaCakes118
.dll windows:4 windows x86 arch:x86

09b2d8b6759054d700bbc9ecdcbd2cfc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:54:da:ca:83:da:f0:fe:c3:da:2f:c8:e8:1a:66:84
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2009, 00:00

Not After

16/01/2012, 23:59

Subject

CN=Oracle USA\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Engineering,O=Oracle USA\, Inc.,L=Pleasanton,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

84:2b:c7:c8:97:f4:5d:4f:bd:59:5c:22:86:44:18:49:17:c4:81:06
Signer

Actual PE Digest

84:2b:c7:c8:97:f4:5d:4f:bd:59:5c:22:86:44:18:49:17:c4:81:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

m:\CM_commonaddin_11.1.1.4.000\commonaddin\addinsrc\output\MigrationUtility.pdb

Imports

mfc80u

ord1611
ord3756
ord4301
ord5911
ord2648
ord2829
ord6721
ord2725
ord1538
ord2531
ord2080
ord5196
ord4092
ord1590
ord1474
ord1646
ord1922
ord1647
ord1955
ord5171
ord1353
ord762
ord4961
ord558
ord3339
ord746
ord6275
ord5434
ord3796
ord1004
ord6273
ord2893
ord1513
ord3424
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord774
ord2409
ord2386
ord2402
ord3678
ord2407
ord2390
ord2392
ord2394
ord1176
ord2388
ord2404
ord2384
ord2362
ord931
ord927
ord929
ord925
ord920
ord5229
ord5231
ord2366
ord5956
ord1591
ord4276
ord4716
ord658
ord1182
ord557
ord6002
ord1178
ord745
ord1245
ord3645
ord5869
ord3017
ord2460
ord265
ord2876
ord3043
ord2250
ord6282
ord3789
ord1154
ord288
ord2651
ord5316
ord2297
ord3483
ord1172
ord4232
ord2867
ord2083
ord4026
ord432
ord3508
ord667
ord1273
ord284
ord1027
ord317
ord584
ord1202
ord1908
ord5337
ord266
ord1002
ord1476
ord899
ord776
ord5712
ord2260
ord5414
ord5485
ord3842
ord1906
ord495
ord1472
ord496
ord896
ord6700
ord2266
ord2121
ord1003
ord866
ord860
ord282
ord427
ord4061
ord1479
ord664
ord462
ord789
ord283
ord2708
ord777
ord4101
ord6161
ord1971
ord5524
ord2261
ord2361
ord354
ord605
ord4574
ord1388
ord6262
ord1924
ord1475
ord4093
ord4256
ord2082
ord1561
ord5199
ord4231
ord4238
ord1392
ord5908
ord6720
ord3223
ord1542
ord1661
ord1662
ord4884
ord4729
ord5178
ord657
ord1785
ord3635
ord314
ord6751
ord4098
ord2011
ord4206
ord4119
ord1386
ord6232
ord6086
ord6063
ord3435
ord3795
ord6272
ord4008
ord4032
ord3677
ord566
ord757
ord3824
ord3327
ord4475
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord2077
ord1536
ord4226
ord5427
ord5740
ord3082
ord5558
ord3158
ord383
ord5398
ord629
ord2155
ord6284
ord6173
ord6303
ord5609
ord1425
ord587
ord900
ord2488
ord3400
ord1235
ord287
ord385
ord630
ord4502
ord3050
ord4090
ord6293
ord2078
ord5327
ord1537
ord4227
ord919
ord2383
ord2406
ord2401
ord2935
ord2012
ord5748
ord3249
ord3161
ord3051
ord3032
ord1608
ord2856
ord591
ord3940
ord2534
ord1894
ord765
ord315
ord1079
ord1033
ord1087
ord1197
ord1199
ord1093
ord371
ord1162
ord1115
ord1192
ord1168
ord1170
ord1200
ord581
ord577
ord1393
ord2640
ord4228
ord2527
ord572
ord5148
ord3712
ord5829
ord1899
ord3713
ord5067
ord3703
ord6271
ord2638
ord4179
ord3943
ord5210
ord4480
ord4255
ord3397
ord2985
ord3901
ord293
ord5406
ord461
ord280
ord3990
ord764

msvcr80

_except_handler4_common
_malloc_crt
_encoded_null
free
malloc
memcpy_s
__CxxFrameHandler3
?terminate@@YAXXZ
memset
_CxxThrowException
_unlock
__dllonexit
__clean_type_info_names_internal
_encode_pointer
_lock
_onexit
_initterm
_initterm_e
_decode_pointer
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
LocalFree
CloseHandle
CreateFileW
DeleteFileW
GetLastError
OutputDebugStringW
InterlockedDecrement
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime

user32

GetWindowLongW
MessageBoxW
ReleaseDC
EnableWindow
PostMessageW
SendMessageW
GetParent
GetKeyState
GetClientRect
PtInRect
InvalidateRect
GetDC

gdi32

GetTextExtentPoint32W

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW

ole32

CoUninitialize
CoInitialize

oleaut32

SysStringLen
SysAllocStringByteLen
VariantClear
VariantInit
VariantCopy
SysFreeString
VariantChangeType
SysAllocString
SysStringByteLen

Exports

Exports

CallActiveMigration
CallMigrationUtility

Sections

.text
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09b2d8b6759054d700bbc9ecdcbd2cfc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4c:54:da:ca:83:da:f0:fe:c3:da:2f:c8:e8:1a:66:84Certificate

Extended Key Usages

Key Usages

84:2b:c7:c8:97:f4:5d:4f:bd:59:5c:22:86:44:18:49:17:c4:81:06Signer

Headers

File Characteristics

PDB Paths

Imports

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 82KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 12KB - Virtual size: 11KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4c:54:da:ca:83:da:f0:fe:c3:da:2f:c8:e8:1a:66:84
Certificate

84:2b:c7:c8:97:f4:5d:4f:bd:59:5c:22:86:44:18:49:17:c4:81:06
Signer

.text
Size: 84KB - Virtual size: 82KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 12KB - Virtual size: 11KB