1b31b3d452031be49b65c0e215d1822b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1b31b3d452031be49b65c0e215d1822b_JaffaCakes118
Size

2.3MB
MD5

1b31b3d452031be49b65c0e215d1822b
SHA1

a53187b0af4c352ad3eeb352e5567351fcfa8e04
SHA256

bc81aac75e39e8c2708f52471636da534ed91de16be1513a329cc3b06d3f1fb2
SHA512

6185df0a183ff2f763effcb2de71dfbd2a2aaf7e8ef015f8db533f64ec617c0e03c2cd8ce2e611a4198646c12cb953be97a8e4bf64356eeec0da970256e9ce80
SSDEEP

49152:DnQKe1tSrC0tZ3X1mvJO2jr8o3aTdmPizBOWU/vui6Hj0nZJgPxqmtxc36YCZpsh:LQKeWrCUZ3XUvJ5jrZVaz6SD0Ixc3DAk

Score

1^/10

Malware Config

Signatures

Files

1b31b3d452031be49b65c0e215d1822b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:47:74:06:d0:9e:ce:11:69:41:04:30:6c:6b:44:9a
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

19/07/2010, 00:00

Not After

23/06/2012, 23:59

Subject

CN=Ymir Entertainment Co.\, Ltd,O=Ymir Entertainment Co.\, Ltd,L=Mapo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b4:e3:e7:a2:37:9b:88:38:16:f7:41:66:03:61:68:e9:7e:e3:e1:98
Signer

Actual PE Digest

b4:e3:e7:a2:37:9b:88:38:16:f7:41:66:03:61:68:e9:7e:e3:e1:98

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 1.6MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 940KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xptbdmmd
Size: 752KB - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

btekptmf
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

6f:47:74:06:d0:9e:ce:11:69:41:04:30:6c:6b:44:9aCertificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

b4:e3:e7:a2:37:9b:88:38:16:f7:41:66:03:61:68:e9:7e:e3:e1:98Signer

Headers

File Characteristics

Imports

kernel32

comctl32

Sections

Size: 1.6MB - Virtual size: 4.4MB

.rsrc Size: 16KB - Virtual size: 43KB

.idata Size: 4KB - Virtual size: 4KB

Size: 4KB - Virtual size: 940KB

xptbdmmd Size: 752KB - Virtual size: 752KB

btekptmf Size: 4KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

6f:47:74:06:d0:9e:ce:11:69:41:04:30:6c:6b:44:9a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

b4:e3:e7:a2:37:9b:88:38:16:f7:41:66:03:61:68:e9:7e:e3:e1:98
Signer

.rsrc
Size: 16KB - Virtual size: 43KB

.idata
Size: 4KB - Virtual size: 4KB

xptbdmmd
Size: 752KB - Virtual size: 752KB

btekptmf
Size: 4KB - Virtual size: 4KB