24bcae8b11c5dff4622bba8231e597d3_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

24bcae8b11c5dff4622bba8231e597d3_JaffaCakes118
Size

876KB
MD5

24bcae8b11c5dff4622bba8231e597d3
SHA1

02fdf2b7c2f5a2640fba96436874e544a0ae6aad
SHA256

68b54725b535b64f4cbd6c6c50f3b7a9969a047820aa7798bc45a3a556ce8627
SHA512

c188c6ef838f8966d5ffad5fe0d397d19c2f3c5b5638458e2d93381d3be89c2b95c115bfa2ebb5c403b1f5d16799db527ecc89a729b168881e43bbc5eabea492
SSDEEP

24576:DiuUm/SUG9UwSA1/DLRpiN/LFRM+z4NJtEAm:DgazWbSABLRpiNTM+sNJt9m

Score

1^/10

Malware Config

Signatures

Files

24bcae8b11c5dff4622bba8231e597d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a70bc888263260341e288908e530909e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01-02-2008 00:00

Not After

31-01-2009 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UpdateResourceA
GetOverlappedResult
UnlockFileEx
WriteProcessMemory
GetCPInfoExA
Module32First
SetProcessShutdownParameters
FindCloseChangeNotification
GetPrivateProfileIntA
GetModuleFileNameA
SetTimeZoneInformation
SetStdHandle
GlobalAddAtomA
CreateDirectoryExA
Thread32Next
SetFileApisToOEM
GenerateConsoleCtrlEvent
ClearCommBreak
GetSystemPowerStatus
HeapWalk
FatalExit
BuildCommDCBA
lstrcat
Beep
LocalShrink
FlushConsoleInputBuffer
OpenFileMappingA
WriteConsoleOutputAttribute
FileTimeToLocalFileTime
GetTimeZoneInformation
CreateThread
FindAtomA
SetConsoleOutputCP
UTRegister
SwitchToFiber
IsValidCodePage
CreateFileMappingA
VirtualFree
SetConsoleActiveScreenBuffer
GetDriveTypeA
GetFileAttributesExA
WriteProfileStringA
GetNamedPipeHandleStateA
ReadConsoleA
TerminateThread
InitializeCriticalSection
GetCurrentProcessId
GlobalGetAtomNameA
ContinueDebugEvent
DeleteFileA
GetCurrentThreadId
BackupSeek
FlushInstructionCache
MapViewOfFile
CreateFiber
MulDiv
ReadProcessMemory
GlobalReAlloc
SystemTimeToTzSpecificLocalTime
lstrcmpi

shlwapi

PathMakePrettyA
PathQuoteSpacesA
StrChrIA
PathFindOnPathA
PathFileExistsA
StrFormatByteSize64A
UrlCombineA
HashData
UrlIsOpaqueA
PathIsRelativeA
UrlGetLocationA
SHRegWriteUSValueA
SHRegOpenUSKeyA
PathIsUNCA
SHAutoComplete
SHRegEnumUSKeyA
PathIsFileSpecA
PathStripToRootA
PathGetDriveNumberA
StrCSpnA
PathRemoveBlanksA
StrRChrIA
ColorHLSToRGB
SHCreateStreamWrapper
StrSpnA
PathAppendA
SHRegCreateUSKeyA
AssocQueryStringA
PathCommonPrefixA
StrIsIntlEqualA

advapi32

AllocateAndInitializeSid

Sections

.jsl
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xuh
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.grk
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vkvkv
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sfche
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lgpu
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zcxe
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.epyd
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xmp
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a70bc888263260341e288908e530909e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.jsl Size: 638KB - Virtual size: 1.3MB

.xuh Size: 6KB - Virtual size: 8KB

.grk Size: 19KB - Virtual size: 27KB

.vkvkv Size: 512B - Virtual size: 21KB

.sfche Size: 6KB - Virtual size: 15KB

.lgpu Size: 512B - Virtual size: 56B

.zcxe Size: 512B - Virtual size: 24B

.epyd Size: 48KB - Virtual size: 77KB

.xmp Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.jsl
Size: 638KB - Virtual size: 1.3MB

.xuh
Size: 6KB - Virtual size: 8KB

.grk
Size: 19KB - Virtual size: 27KB

.vkvkv
Size: 512B - Virtual size: 21KB

.sfche
Size: 6KB - Virtual size: 15KB

.lgpu
Size: 512B - Virtual size: 56B

.zcxe
Size: 512B - Virtual size: 24B

.epyd
Size: 48KB - Virtual size: 77KB

.xmp
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB