283ba0669b4d5d246b9d6f93e602f091_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

283ba0669b4d5d246b9d6f93e602f091_JaffaCakes118
Size

783KB
MD5

283ba0669b4d5d246b9d6f93e602f091
SHA1

6d57badbf68c8ba3784a48dc55e109377d25c483
SHA256

5015e68f1b79c1ada988c3c6da0066a1a6a21e8ecd5b163cd47c77ad1597482a
SHA512

6ef7eae98cf570830bc2d81c1ee11c672a126a581c8483afc7326be14fdcc7494e8d42fe7c23defc18ac9eca22f992fd0d3aa395dc81d6bf1e1d4142ff8acdb2
SSDEEP

24576:1eAwwjHMImPINSY+ZklQBpksSbFqpBsnBNr:1UwleoQ5Yqsnv

Score

1^/10

Malware Config

Signatures

Files

283ba0669b4d5d246b9d6f93e602f091_JaffaCakes118
.exe windows:5 windows x86 arch:x86

80d9ffe24663b5d484ff8b1d365445f0

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:69:f8:a9:b3:88:05:f0:89:7a:80:b5:6a:e4:52:75:4e:98:b0:bb
Signer

Actual PE Digest

68:69:f8:a9:b3:88:05:f0:89:7a:80:b5:6a:e4:52:75:4e:98:b0:bb

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\Autoruns\Release\autoruns.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

ImageList_ReplaceIcon
ImageList_Draw
ImageList_GetIcon
ImageList_Add
ord17
CreateToolbarEx
ImageList_Create
ImageList_Remove
ImageList_GetImageCount

kernel32

SetErrorMode
GetCommandLineA
InterlockedDecrement
CreateSemaphoreA
InitializeCriticalSection
TlsAlloc
GetCommandLineW
SearchPathA
FindClose
FindNextFileA
FindFirstFileA
EnumSystemLocalesA
GetUserDefaultLCID
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStringTypeW
GetFileSize
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStdHandle
WriteFile
ExitProcess
HeapDestroy
HeapCreate
VirtualAlloc
VirtualFree
FatalAppExitA
DeleteCriticalSection
GetCurrentThread
GetCurrentThreadId
SetLastError
LoadLibraryExA
GetModuleHandleW
GetStartupInfoA
CreateThread
ResumeThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RaiseException
HeapReAlloc
HeapAlloc
RtlUnwind
lstrlenW
GetProcessHeap
HeapFree
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatA
GetTimeFormatA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileAttributesA
FlushFileBuffers
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
CompareStringA
GetModuleHandleA
LocalAlloc
lstrcmpA
LocalFree
FormatMessageA
GetVersion
MulDiv
lstrcpyA
lstrlenA
lstrcatA
GetTickCount
CreateFileA
ReadFile
SetFilePointer
GetWindowsDirectoryA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
GetLocaleInfoA
GetNumberFormatA
GetModuleFileNameA
TlsSetValue
GetCurrentProcess
GetLastError
FreeLibrary
InterlockedIncrement
ExitThread
WaitForSingleObject
ReleaseSemaphore
MultiByteToWideChar
OpenProcess
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteFileA
GetPrivateProfileStringA
WriteProfileStringA
WritePrivateProfileStringA
GetProfileStringA
CreateDirectoryA
SetFileAttributesA
MoveFileA
RemoveDirectoryA
CreateProcessA
EnterCriticalSection
TlsFree
LeaveCriticalSection
CloseHandle
WideCharToMultiByte
TlsGetValue
CompareStringW
GetStringTypeA
IsValidLocale

user32

GetMessageA
TranslateAcceleratorA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetMenuItemInfoA
DrawMenuBar
LoadStringA
DrawIconEx
InvalidateRgn
MapWindowPoints
ModifyMenuA
GetSysColorBrush
ChildWindowFromPoint
LoadAcceleratorsA
GetPropA
CreateDialogParamA
RegisterClassExA
LoadImageA
RegisterWindowMessageA
DialogBoxIndirectParamA
GetClassNameA
DeferWindowPos
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
OffsetRect
UnionRect
PtInRect
BeginPaint
DrawFrameControl
EndPaint
SetPropA
GetWindowLongA
SetWindowLongA
InflateRect
PostQuitMessage
EnableWindow
EndDialog
TrackPopupMenu
EnableMenuItem
DeleteMenu
GetSubMenu
InsertMenuA
SetDlgItemTextA
EnumDisplaySettingsA
FindWindowA
GetWindowThreadProcessId
SetForegroundWindow
FindWindowExA
WaitForInputIdle
CreateIconIndirect
GetIconInfo
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetMenu
CheckMenuItem
SetWindowTextA
DialogBoxParamA
SetWindowPos
GetWindowRect
IsIconic
IsZoomed
GetDlgItem
SetTimer
GetParent
GetCursorPos
CreateWindowExA
CallWindowProcA
GetSysColor
GetClientRect
GetSystemMetrics
IntersectRect
InvalidateRect
GetFocus
GetDC
DrawTextA
ReleaseDC
MoveWindow
ShowWindow
ClientToScreen
ScreenToClient
DestroyWindow
DefWindowProcA
MessageBoxA
PostMessageA
SetFocus
LoadCursorA
SetCursor
SendMessageA
LoadIconA
DestroyIcon
ReleaseCapture

gdi32

GetDIBits
CreateDIBSection
SetMapMode
StartDocA
StartPage
EndPage
EndDoc
CreateSolidBrush
GetTextMetricsA
DeleteObject
GetStockObject
GetObjectA
CreateCompatibleDC
GetDeviceCaps
DeleteDC
CreateFontIndirectA
SetBkColor
ExtTextOutA
GetTextExtentPoint32A
SelectObject
SetTextColor
SetBkMode
GdiFlush

comdlg32

GetOpenFileNameA
FindTextA
ChooseFontA
GetSaveFileNameA
PrintDlgA

advapi32

RegSetKeySecurity
RegOpenKeyA
RegGetKeySecurity
GetTokenInformation
EqualSid
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegCloseKey
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
RegDeleteKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegUnLoadKeyA
RegLoadKeyA
RegDeleteValueA
RegCreateKeyExA
RegQueryInfoKeyA
LookupAccountSidA
RegQueryValueA
RegEnumKeyA
DeleteService
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CryptReleaseContext
AllocateAndInitializeSid

shell32

SHGetFileInfoA
CommandLineToArgvW
ShellExecuteExA
ShellExecuteA

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

oleaut32

SysAllocStringByteLen
SysStringLen
SysFreeString
SysAllocString
SysStringByteLen
VariantInit
VariantClear
VariantChangeType
GetErrorInfo
SetErrorInfo
CreateErrorInfo

shlwapi

SHCreateStreamOnFileA
UrlUnescapeA

Sections

.text
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

80d9ffe24663b5d484ff8b1d365445f0

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

68:69:f8:a9:b3:88:05:f0:89:7a:80:b5:6a:e4:52:75:4e:98:b0:bbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 428KB - Virtual size: 428KB

.rdata Size: 78KB - Virtual size: 77KB

.data Size: 15KB - Virtual size: 25KB

.rsrc Size: 99KB - Virtual size: 100KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

68:69:f8:a9:b3:88:05:f0:89:7a:80:b5:6a:e4:52:75:4e:98:b0:bb
Signer

.text
Size: 428KB - Virtual size: 428KB

.rdata
Size: 78KB - Virtual size: 77KB

.data
Size: 15KB - Virtual size: 25KB

.rsrc
Size: 99KB - Virtual size: 100KB