2840b5b6fbd1dc73e1e5b61029a61fdc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2840b5b6fbd1dc73e1e5b61029a61fdc_JaffaCakes118
Size

274KB
MD5

2840b5b6fbd1dc73e1e5b61029a61fdc
SHA1

c1fffa73341530523f51c372b9e806297510c05d
SHA256

1d98dd6e7725c7c9b2a1c9095f4464692c765c93ff9bf946d26e019d49b0241f
SHA512

2755af1ee7f469187efc525ddd5a3cf30b010d964019056878db5915762bb8d4b5af954ca165bc586d0966b141097de0a419b1b2a5d1193bc14402380a9c3fca
SSDEEP

3072:TVzRw9EyrUFEv/RPfvWFkxHyAIlOyTds31x65501mOZSzGeQEVkZx9tMZf4:BzS2yr/vxfOzAIlOQ8xl1nuQEJZf4

Score

1^/10

Malware Config

Signatures

Files

2840b5b6fbd1dc73e1e5b61029a61fdc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c751b70c46c19435fb3bc5faceaf8a94

Code Sign

27:ad:a2:6a:18:41:0c:50:72:f8:fc:3f:46:57:ba:6b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/02/2011, 00:00

Not After

25/02/2012, 23:59

Subject

CN=NN Group Global Services Inc,O=NN Group Global Services Inc,POSTALCODE=33139,STREET=Suite 502+STREET=407 Lincoln Road,L=Miami Beach,ST=FL,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

17:eb:67:da:87:a1:9e:a5:3f:67:61:44:c5:a9:60:d0:6f:48:27:3a
Signer

Actual PE Digest

17:eb:67:da:87:a1:9e:a5:3f:67:61:44:c5:a9:60:d0:6f:48:27:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
GetSystemTimeAsFileTime
GetProcessHeap
GetStartupInfoA
RtlUnwind
ExitProcess
RaiseException
HeapSize
WritePrivateProfileStringA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
GetACP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
FileTimeToSystemTime
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
GetModuleFileNameW
GlobalFindAtomA
lstrcmpW
GlobalGetAtomNameA
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetThreadLocale
GlobalAddAtomA
GetCurrentProcessId
SetLastError
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
DeleteFileA
GetVersion
CloseHandle
GetVersionExA
CompareStringA
CreateToolhelp32Snapshot
CreateMutexA
GetModuleFileNameA
LockResource
Process32Next
LoadLibraryA
CopyFileA
GetProcAddress
GetLastError
InterlockedExchange
CreateDirectoryA
MultiByteToWideChar
CompareStringW
CreateProcessA
SizeofResource
Sleep
WideCharToMultiByte
GetCommandLineA
WriteFile
Process32First
LoadResource
FreeLibrary
lstrlenA
FindResourceA
CreateFileA
TerminateProcess

user32

TabbedTextOutA
LoadCursorA
GetDC
ReleaseDC
GetSysColorBrush
ClientToScreen
ShowWindow
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
DrawTextA
SetForegroundWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
DrawTextExA
GrayStringA
UnregisterClassA
DestroyMenu
GetCursorPos
ValidateRect
GetSystemMetrics
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
SetCursor
PostMessageA
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
SendMessageA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
CharUpperA
CopyRect

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
CreateBitmap
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

shlwapi

StrStrA
PathRemoveFileSpecA
StrToIntExA
PathFindExtensionA
SHGetValueA
PathFindFileNameA
PathStripToRootA
PathIsDirectoryA
PathIsUNCA

oleaut32

VariantClear
VariantChangeType
VariantInit

ws2_32

send
socket
WSAGetLastError
gethostbyname
recv
getsockname
WSAStartup
closesocket
inet_addr

Sections

.text
Size: 192KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c751b70c46c19435fb3bc5faceaf8a94

Code Sign

27:ad:a2:6a:18:41:0c:50:72:f8:fc:3f:46:57:ba:6bCertificate

Extended Key Usages

Key Usages

17:eb:67:da:87:a1:9e:a5:3f:67:61:44:c5:a9:60:d0:6f:48:27:3aSigner

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

ws2_32

Sections

.text Size: 192KB - Virtual size: 188KB

.rdata Size: 64KB - Virtual size: 61KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 500B

27:ad:a2:6a:18:41:0c:50:72:f8:fc:3f:46:57:ba:6b
Certificate

17:eb:67:da:87:a1:9e:a5:3f:67:61:44:c5:a9:60:d0:6f:48:27:3a
Signer

.text
Size: 192KB - Virtual size: 188KB

.rdata
Size: 64KB - Virtual size: 61KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 500B