14fa8708e5b8bb49c0e67c4dba765fce_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

14fa8708e5b8bb49c0e67c4dba765fce_JaffaCakes118
Size

192KB
MD5

14fa8708e5b8bb49c0e67c4dba765fce
SHA1

932facfdc88f7ade240de426960547f494c72ac0
SHA256

8446b5562065b2262b9f9f3a583df3630c2a07b60ee813b853bde372136b4564
SHA512

92ffd8e0a4fbddb2a585d6c533fdc7be2f66039e924994ad7039f8ea13f7639e38014f9b2e503331a92f3293c40e5455e12a73c6b7dcc89a1f42fd8f6bb81e8c
SSDEEP

3072:RnS2RBvS1HXrP97TkUttGR3qGk6Tzsk12XhaJoTJo:RKZXL9cUg3NVTzsk12RCo9o

Score

1^/10

Malware Config

Signatures

Files

14fa8708e5b8bb49c0e67c4dba765fce_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6687aee4f6fe6696aa78124113656e35

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:41:9f:c3:ee:18:59:a6:bd:80:c3:5c:c4:70:5a:c2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

13/04/2006, 00:00

Not After

22/04/2008, 23:59

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:3d:40:25:2a:ba:aa:31:95:80:f5:e2:e5:72:0c:56:54:9b:17:bd
Signer

Actual PE Digest

08:3d:40:25:2a:ba:aa:31:95:80:f5:e2:e5:72:0c:56:54:9b:17:bd

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
lstrcmpiA
GetSystemPowerStatus
Sleep
InterlockedIncrement
GetModuleFileNameA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetVersionExA
GetProcAddress
LoadLibraryA
CloseHandle
GetCurrentThreadId
GetCommandLineA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
SetFilePointer
LCMapStringW
LCMapStringA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
CompareFileTime
CreateMutexA
InterlockedDecrement
GetStringTypeW
GetStringTypeA
GetOEMCP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
EnterCriticalSection
LeaveCriticalSection
LocalFree
RtlUnwind
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

UnregisterClassA
EnumDisplaySettingsA
PostThreadMessageA
RegisterClassA
GetMessageA
DispatchMessageA
SetTimer
PostQuitMessage
DefWindowProcA
CreateWindowExA
KillTimer
CharNextA

advapi32

RegDeleteValueA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegQueryInfoKeyA

ole32

CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoInitialize
CoSuspendClassObjects
CoTaskMemFree
StringFromGUID2
CoRegisterClassObject

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysFreeString
SysAllocString
VariantClear

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

roqocww
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6687aee4f6fe6696aa78124113656e35

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

5e:41:9f:c3:ee:18:59:a6:bd:80:c3:5c:c4:70:5a:c2Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

08:3d:40:25:2a:ba:aa:31:95:80:f5:e2:e5:72:0c:56:54:9b:17:bdSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 84KB - Virtual size: 81KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 43KB - Virtual size: 43KB

roqocww Size: 32KB - Virtual size: 32KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

5e:41:9f:c3:ee:18:59:a6:bd:80:c3:5c:c4:70:5a:c2
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

08:3d:40:25:2a:ba:aa:31:95:80:f5:e2:e5:72:0c:56:54:9b:17:bd
Signer

.text
Size: 84KB - Virtual size: 81KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 43KB - Virtual size: 43KB

roqocww
Size: 32KB - Virtual size: 32KB