26bfe524e92f5e0142c87b5e2d0a0eb4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

26bfe524e92f5e0142c87b5e2d0a0eb4_JaffaCakes118
Size

435KB
MD5

26bfe524e92f5e0142c87b5e2d0a0eb4
SHA1

6d5b8756f3468e4f8aeadd808ccc8ebb735b4db3
SHA256

084e0347f4969f8cb5bd6cf2cce01a5de77e17743f9e8bd7d3b93163e766b231
SHA512

f8373722f39273950f964b8cfc1e8be8cb017d0f4a8ab440346b454d2a01fbcc0ea8037a872e7777a1b7bcb3ac387536bd9c4282adbdf5b4bc2e793900fe5837
SSDEEP

12288:t06VDh8pAcIHEYWXZj/x9Op1gXHj0y1xKCI:1kpAHUZOEXHr1xKCI

Score

1^/10

Malware Config

Signatures

Files

26bfe524e92f5e0142c87b5e2d0a0eb4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ac4511615c5b1723fcf2ee11196794c6

Code Sign

4f:02:6b:26:65:b4:98:ac:47:d8:d5:e6:80:e7:94:2e
Certificate

Issuer

CN=oktioezdnxw

Not Before

01/12/2011, 19:37

Not After

28/06/2013, 22:00

Subject

CN=Loretusa

67:d3:5e:bb:fb:56:d0:fb:36:4c:97:f3:e1:05:16:26:05:6b:5a:9d
Signer

Actual PE Digest

67:d3:5e:bb:fb:56:d0:fb:36:4c:97:f3:e1:05:16:26:05:6b:5a:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ChildWindowFromPoint
EnumChildWindows
GetParent
IsWindowUnicode

ole32

CoRegisterClassObject
OleRegGetMiscStatus
CoLockObjectExternal
CoGetClassObject
CoTaskMemAlloc

comctl32

ord2
ord14

urlmon

CreateFormatEnumerator

shlwapi

StrCSpnA
StrCSpnW

kernel32

LoadLibraryA
HeapReAlloc
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
LCMapStringW
VirtualAlloc
GetStringTypeA
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetThreadLocale
HeapSize
IsBadStringPtrA
LocalAlloc
CreateFileA
GetModuleHandleA
GetProcAddress
ExitProcess
GetStartupInfoA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
HeapAlloc
InitializeCriticalSection

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 279KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac4511615c5b1723fcf2ee11196794c6

Code Sign

4f:02:6b:26:65:b4:98:ac:47:d8:d5:e6:80:e7:94:2eCertificate

67:d3:5e:bb:fb:56:d0:fb:36:4c:97:f3:e1:05:16:26:05:6b:5a:9dSigner

Headers

File Characteristics

Imports

user32

ole32

comctl32

urlmon

shlwapi

kernel32

Sections

.text Size: 17KB - Virtual size: 16KB

.rdata Size: 127KB - Virtual size: 126KB

.data Size: 279KB - Virtual size: 366KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 3KB - Virtual size: 2KB

4f:02:6b:26:65:b4:98:ac:47:d8:d5:e6:80:e7:94:2e
Certificate

67:d3:5e:bb:fb:56:d0:fb:36:4c:97:f3:e1:05:16:26:05:6b:5a:9d
Signer

.text
Size: 17KB - Virtual size: 16KB

.rdata
Size: 127KB - Virtual size: 126KB

.data
Size: 279KB - Virtual size: 366KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 3KB - Virtual size: 2KB