2590b2a93b22a8b2ac6922cf7bbc8b92_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2590b2a93b22a8b2ac6922cf7bbc8b92_JaffaCakes118
Size

258KB
MD5

2590b2a93b22a8b2ac6922cf7bbc8b92
SHA1

079dc402210e722588af73225a6eaa57aa3a1158
SHA256

efecff6cb3b18f47c451bf151f5220ca9c4083b9a38f8ae4fb5bdfee64fd6546
SHA512

3263e326f9b4004fb84beaff747ff8277f72f67415ea73164d5902b2743dcac94430c6b1515446ca56a7dfad8a61a692648c0a69fe623a241698013e6c5df793
SSDEEP

3072:IsNbSvIikSiXuYbx2XM+MRoqNoJYElCMPzEyxM7O/eFGy1zbhhx2PT:kQipi+6x2XMBozjCMP2pGqXhh

Score

1^/10

Malware Config

Signatures

Files

2590b2a93b22a8b2ac6922cf7bbc8b92_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ebf6735d75029869b73ab1e6e3eb1d21

Code Sign

51:23:09:d5:d0:a2:b9:8c:42:fb:c1:82:e7:8e:4e:92
Certificate

Issuer

CN=w466666345uy inc

Not Before

28/01/2012, 07:40

Not After

31/12/2039, 23:59

Subject

CN=w466666345uy inc

Extended Key Usages

ExtKeyUsageCodeSigning

60:6c:b2:9b:5f:a3:a3:6d:ff:d4:4b:89:9f:bc:a6:a2:56:7c:5b:05
Signer

Actual PE Digest

60:6c:b2:9b:5f:a3:a3:6d:ff:d4:4b:89:9f:bc:a6:a2:56:7c:5b:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
LoadLibraryA
GetProcessHeap
GetProcAddress
GetSystemInfo
AddConsoleAliasA
BackupRead
BuildCommDCBAndTimeoutsW
CreateDirectoryA
CreateEventW
CreateJobObjectA
CreateRemoteThread
CreateWaitableTimerW
DebugBreak
DeleteTimerQueue
DeleteTimerQueueTimer
DosDateTimeToFileTime
EnumResourceLanguagesA
EnumResourceNamesA
EnumSystemCodePagesW
EnumTimeFormatsA
EnumTimeFormatsW
ExitProcess
ExitThread
FatalAppExitA
FileTimeToSystemTime
FindFirstFileW
FindFirstVolumeMountPointA
FindNextFileA
FindNextVolumeMountPointW
FindNextVolumeW
FlushViewOfFile
FoldStringW
GetCalendarInfoA
GetComputerNameW
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetNumberOfConsoleInputEvents
GetPrivateProfileIntW
GetPrivateProfileSectionNamesA
GetProfileIntA
GetQueuedCompletionStatus
GetShortPathNameW
GetThreadSelectorEntry
lstrcatW
GetVolumeInformationW
GlobalFix
GlobalUnlock
HeapFree
InterlockedCompareExchange
IsBadStringPtrW
IsValidLanguageGroup
LCMapStringA
LocalFlags
LocalSize
MoveFileA
MoveFileW
OpenJobObjectA
Process32Next
ProcessIdToSessionId
QueryInformationJobObject
ReadConsoleInputW
ReadConsoleOutputAttribute
ReadFile
ReplaceFile
SetCalendarInfoA
SetCommBreak
SetCommState
SetConsoleCursor
SetEvent
SetMailslotInfo
SetProcessAffinityMask
SetVolumeLabelA
SetVolumeLabelW
SuspendThread
TerminateJobObject
TerminateThread
TransactNamedPipe
TryEnterCriticalSection
UnlockFileEx
VerSetConditionMask
VirtualFreeEx
WaitForMultipleObjectsEx
WaitForSingleObject
WaitNamedPipeA
WriteConsoleW
WriteProcessMemory
_hwrite
_llseek
_lwrite
lstrcat
lstrcatA
lstrcmpi
GetVersion
CreateFileW

msvcrt

memset

user32

CallWindowProcA
DdeInitializeW
DlgDirSelectComboBoxExW
DrawTextW
EndDialog
EnumDisplaySettingsA
EnumWindowStationsA
MapVirtualKeyExA
SetWindowPlacement
SwapMouseButton

advapi32

RegOpenKeyExW

ole32

CLIPFORMAT_UserFree
CLIPFORMAT_UserMarshal
CoCreateInstance
CoCreateObjectInContext
CoFreeUnusedLibraries
CoGetPSClsid
CoGetStdMarshalEx
CoGetTreatAsClass
CoMarshalHresult
CoQueryClientBlanket
CoQueryReleaseObject
CoWaitForMultipleHandles
CreateDataAdviseHolder
CreateFileMoniker
DcomChannelSetHResult
DllGetClassObjectWOW
GetClassFile
GetHGlobalFromStream
GetRunningObjectTable
HACCEL_UserUnmarshal
HBRUSH_UserSize
HBRUSH_UserUnmarshal
HGLOBAL_UserMarshal
HGLOBAL_UserSize
HMENU_UserUnmarshal
HMETAFILE_UserFree
HMETAFILE_UserUnmarshal
HPALETTE_UserFree
HWND_UserFree
HWND_UserSize
IIDFromString
IsAccelerator
MonikerCommonPrefixWith
OleConvertIStorageToOLESTREAMEx
OleConvertOLESTREAMToIStorage
OleCreateDefaultHandler
OleCreateEx
OleCreateLinkToFileEx
OleDraw
OleFlushClipboard
OleGetAutoConvert
OleGetIconOfClass
OleInitializeWOW
OleLoad
OleLoadFromStream
OleLockRunning
OleRegEnumFormatEtc
OleRegGetMiscStatus
OleSetClipboard
OleTranslateAccelerator
ProgIDFromCLSID
PropVariantCopy
ReadClassStg
STGMEDIUM_UserFree
STGMEDIUM_UserUnmarshal
StgOpenPropStg
StgOpenStorage
StgPropertyLengthAsVariant
StringFromIID
UtConvertDvtd32toDvtd16
WriteClassStm
WriteFmtUserTypeStg

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text2
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text2
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ebf6735d75029869b73ab1e6e3eb1d21

Code Sign

51:23:09:d5:d0:a2:b9:8c:42:fb:c1:82:e7:8e:4e:92Certificate

Extended Key Usages

60:6c:b2:9b:5f:a3:a3:6d:ff:d4:4b:89:9f:bc:a6:a2:56:7c:5b:05Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

advapi32

ole32

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 452B

.text2 Size: 1024B - Virtual size: 712B

.text2 Size: 223KB - Virtual size: 223KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 2KB - Virtual size: 1KB

51:23:09:d5:d0:a2:b9:8c:42:fb:c1:82:e7:8e:4e:92
Certificate

60:6c:b2:9b:5f:a3:a3:6d:ff:d4:4b:89:9f:bc:a6:a2:56:7c:5b:05
Signer

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 452B

.text2
Size: 1024B - Virtual size: 712B

.text2
Size: 223KB - Virtual size: 223KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 2KB - Virtual size: 1KB