27597d64d01c12ace7f0883dadc1cb5c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27597d64d01c12ace7f0883dadc1cb5c_JaffaCakes118
Size

178KB
MD5

27597d64d01c12ace7f0883dadc1cb5c
SHA1

29382948d0ae76c104be67faa546c18082fc48ab
SHA256

9a9665945db59cde73b1b606f80a6a85ed8f59aa0c5b6ddfa7b9bbd9bb937d3f
SHA512

d230046eaecb32fbb6696b7a20c9bceeb4b7ba911b4901bae6feb3834480248e3d28429b1d6933355d67377e5c6082c12885361d0cdf326f1ebf52ebc65ab339
SSDEEP

3072:DrKoV/JGTsAjgKqzVfI9Pd60XrFcShxT4EEVouG5QxkzEpoKKRXzpyFtdVdbvt:3hJosAjgKqzZI9l60XryShxT4EEyuGmD

Score

1^/10

Malware Config

Signatures

Files

27597d64d01c12ace7f0883dadc1cb5c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ca5205d29d2e0fa326b0238a3aaed518

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

Issuer

CN=Application Compatibility UI

Not Before

31/12/2008, 16:00

Not After

31/12/2014, 16:00

Subject

CN=Application Compatibility UI

Extended Key Usages

ExtKeyUsageCodeSigning

12:b6:aa:86:e7:f4:78:8b:01:fa:58:a7:2a:12:64:3e:65:0e:13:91
Signer

Actual PE Digest

12:b6:aa:86:e7:f4:78:8b:01:fa:58:a7:2a:12:64:3e:65:0e:13:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType
MessageBoxA

advapi32

RegQueryValueExA

Sections

;
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

*
Size: - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

%
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

+
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

*
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

#
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

*
Size: 512B - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

7
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

!
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

@
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca5205d29d2e0fa326b0238a3aaed518

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2Certificate

Extended Key Usages

12:b6:aa:86:e7:f4:78:8b:01:fa:58:a7:2a:12:64:3e:65:0e:13:91Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

; Size: - Virtual size: 15KB

* Size: - Virtual size: 164B

% Size: - Virtual size: 1KB

/ Size: - Virtual size: 1KB

+ Size: - Virtual size: 8B

* Size: 512B - Virtual size: 24B

# Size: - Virtual size: 1KB

* Size: 512B - Virtual size: 132KB

7 Size: - Virtual size: 17KB

! Size: 175KB - Virtual size: 174KB

@ Size: 512B - Virtual size: 84B

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

12:b6:aa:86:e7:f4:78:8b:01:fa:58:a7:2a:12:64:3e:65:0e:13:91
Signer

;
Size: - Virtual size: 15KB

*
Size: - Virtual size: 164B

%
Size: - Virtual size: 1KB

/
Size: - Virtual size: 1KB

+
Size: - Virtual size: 8B

*
Size: 512B - Virtual size: 24B

#
Size: - Virtual size: 1KB

*
Size: 512B - Virtual size: 132KB

7
Size: - Virtual size: 17KB

!
Size: 175KB - Virtual size: 174KB

@
Size: 512B - Virtual size: 84B