24856e83d17bfd6ab2e34c3eeb8a3927_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

24856e83d17bfd6ab2e34c3eeb8a3927_JaffaCakes118
Size

138KB
MD5

24856e83d17bfd6ab2e34c3eeb8a3927
SHA1

3ae1450585952a003252aeb5dcb8a3d39b5e617a
SHA256

f9a729afcd61d59b4bac95cfae054f16682160d1d6a86317ffbf9a0bfd509708
SHA512

3f50599d057bab6669b5b0eef89d61b5e01e3ec7b0ec4de1022939ac21155dc4878e7c6f69a648a6d27c2a2ace3f0cfaf3a05afa64f78db2614b42ac6f8bf79b
SSDEEP

3072:yrX/uUkgrwlQmdHT0rARSMbHLsyaQfCpy3HGMtij1VkG8:yrmZlQmdHdcMPsyaYCimjPkn

Score

1^/10

Malware Config

Signatures

Files

24856e83d17bfd6ab2e34c3eeb8a3927_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

7e62333301cd02549753b9c93204faf8

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

Issuer

CN=Application Compatibility UI

Not Before

31/12/2008, 16:00

Not After

31/12/2014, 16:00

Subject

CN=Application Compatibility UI

Extended Key Usages

ExtKeyUsageCodeSigning

65:dd:e7:bd:10:61:d1:f1:dd:21:bd:22:25:71:3a:7b:02:57:e4:35
Signer

Actual PE Digest

65:dd:e7:bd:10:61:d1:f1:dd:21:bd:22:25:71:3a:7b:02:57:e4:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

SetPixel

wsock32

WSACleanup

wininet

InternetReadFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JumpHookOff
JumpHookOn

Sections

.
Size: - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

;
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

<
Size: - Virtual size: 6KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

"
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

$
Size: - Virtual size: 209B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

-
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

"
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

=
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e62333301cd02549753b9c93204faf8

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2Certificate

Extended Key Usages

65:dd:e7:bd:10:61:d1:f1:dd:21:bd:22:25:71:3a:7b:02:57:e4:35Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

wsock32

wininet

Exports

Exports

Sections

. Size: - Virtual size: 143KB

; Size: - Virtual size: 3KB

< Size: - Virtual size: 6KB

" Size: - Virtual size: 3KB

$ Size: - Virtual size: 209B

- Size: - Virtual size: 10KB

1 Size: 512B - Virtual size: 4KB

" Size: - Virtual size: 24KB

6 Size: 135KB - Virtual size: 134KB

= Size: 512B - Virtual size: 168B

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

65:dd:e7:bd:10:61:d1:f1:dd:21:bd:22:25:71:3a:7b:02:57:e4:35
Signer

.
Size: - Virtual size: 143KB

;
Size: - Virtual size: 3KB

<
Size: - Virtual size: 6KB

"
Size: - Virtual size: 3KB

$
Size: - Virtual size: 209B

-
Size: - Virtual size: 10KB

1
Size: 512B - Virtual size: 4KB

"
Size: - Virtual size: 24KB

6
Size: 135KB - Virtual size: 134KB

=
Size: 512B - Virtual size: 168B