2203d42abef458b171cc65e0cb06220a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
2203d42abef458b171cc65e0cb06220a_JaffaCakes118
Size 325KB
Sample240703-mftmbssblk
SHA256 5907b4b9f7d3ea58ea57928ab93ed29373aa5bf8db6533edd317da7f974514be
MD5 2203d42abef458b171cc65e0cb06220a
SHA1 01e335d69c507d6f236ca1e94ebda49b12e37a80
SHA512 8a4a7539adfad73424d68a36d34cb0ce6753443892f699a86348fd403cf003dab7346fde3bf9ae158e7cce39876d1af2d74b599821ccf7a481ea4bd607062656
SSDEEP 6144:Nog6HWHerPZ9NWVHPjBrScBWigGUWWWWWW+d7WTi6x38O/F2+ZbM35qGcBgKvKRu:Nl7+LZ9c7BWigGUWWWWWWk6Ti6x38OAM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2203d42abef458b171cc65e0cb06220a_JaffaCakes118

.exe 325KB

2203d42abef458b171cc65e0cb06220a_JaffaCakes118

IMPHASH 98e53b2cb31fce4d393c9de9e623875b
SHA256 5907b4b9f7d3ea58ea57928ab93ed29373aa5bf8db6533edd317da7f974514be
MD5 2203d42abef458b171cc65e0cb06220a
SHA1 01e335d69c507d6f236ca1e94ebda49b12e37a80
SHA512 8a4a7539adfad73424d68a36d34cb0ce6753443892f699a86348fd403cf003dab7346fde3bf9ae158e7cce39876d1af2d74b599821ccf7a481ea4bd607062656
SSDEEP 6144:Nog6HWHerPZ9NWVHPjBrScBWigGUWWWWWW+d7WTi6x38O/F2+ZbM35qGcBgKvKRu:Nl7+LZ9c7BWigGUWWWWWWk6Ti6x38OAM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

5c:36:94:45:1f:aa:a4:55:22:fc:ab:4c:25:46:56:bb:7b:54:d9:55:f9:2d:77:73:4f:ac:c5:a1:be:4a:df:f9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Jul 3, 2024

PE Signature issue

Digest

2c:c9:68:a9:01:78:3c:7e:04:24:1a:93:c3:28:ee:b4:73:fc:d1:52

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

May 23, 2018

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Tim Kosse,O=Tim Kosse,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

01:bc:a2:f9:59:37:e3:f8:50:f5:46:b3:b6:0d:a8:6f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 9, 2016 - Feb 13, 2019

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

7056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vaxavubo57\ciyiy\muwecoyepaxiw\tobuwusi.pdb

kernel32

GetThreadContext SetInformationJobObject lstrlenA FindResourceExW InterlockedDecrement GetSystemWindowsDirectoryW SetConsoleScreenBufferSize FreeEnvironmentStringsA OutputDebugStringW CreateNamedPipeW GetUserDefaultLangID GetCommandLineA SetFileShortNameW LoadLibraryW FreeConsole GetSystemWow64DirectoryW InterlockedPopEntrySList HeapDestroy GetModuleFileNameW GetStartupInfoA GetCPInfoExW OpenMutexW GetLastError SetLastError GetProcAddress MoveFileW SetStdHandle SearchPathA VirtualAllocEx GetPrivateProfileStringA LocalAlloc GetProfileStringA SetSystemTime GetModuleFileNameA WriteProfileStringA WTSGetActiveConsoleSessionId CreateIoCompletionPort HeapSetInformation GetCurrentDirectoryA ReadConsoleInputW FindAtomW DeleteFileW CloseHandle CreateFileW WideCharToMultiByte GetCommandLineW GetStartupInfoW DecodePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InterlockedIncrement GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree GetModuleHandleW HeapValidate IsBadReadPtr RtlUnwind QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate WriteFile IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection OutputDebugStringA WriteConsoleW LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer GetConsoleCP GetConsoleMode HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree RaiseException FlushFileBuffers

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

2203d42abef458b171cc65e0cb06220a_JaffaCakes118

PE Signature issue

PE Signature issue

kernel32

winhttp

generic