29e613e18c28003aea988f6a33b44797_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

29e613e18c28003aea988f6a33b44797_JaffaCakes118
Size

2.2MB
MD5

29e613e18c28003aea988f6a33b44797
SHA1

f87a2a6fa8fbad340bd6cf54c32ea64385234852
SHA256

f4fb4918cac1eaa98e32773b88f909ca14e98a0b1b3dd5f9f88b4fa67040c465
SHA512

b1d89a80358a40ecc60ee2a2a113675528e7891c74fbb88541c7fa53fc279faa837f6829928d5a7b961abce23a299740d213da7c6e59e8779d234987fb06c8a9
SSDEEP

49152:LzVfXasmt36h8JTKAURjWH+bMtrCjfcFqpOtuSJmYM:dfqsmS8JTKAURAsKbqYtZmYM

Score

1^/10

Malware Config

Signatures

Files

29e613e18c28003aea988f6a33b44797_JaffaCakes118
.exe windows:5 windows x86 arch:x86

52c5691b876d07d6f11342f2efac675a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

69:63:82:dc:b5:32:37:46:c7:45:85:b8:a9:b5:74:86
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

06/04/2011, 00:00

Not After

05/04/2012, 23:59

Subject

CN=BINGOOO AG,O=BINGOOO AG,L=Bonn,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:f4:56:77:e9:ec:ff:53:5b:bc:20:6b:d8:06:db:c6:cf:3d:fd:91
Signer

Actual PE Digest

42:f4:56:77:e9:ec:ff:53:5b:bc:20:6b:d8:06:db:c6:cf:3d:fd:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

oleaut32

SysFreeString

advapi32

RegQueryValueExW

user32

LoadStringW

msimg32

GradientFill

gdi32

UpdateColors

version

VerQueryValueA

ole32

CreateStreamOnHGlobal

comctl32

InitializeFlatSB

wininet

HttpSendRequestExW

shell32

SHFileOperationW

comdlg32

PrintDlgW

wsock32

WSACleanup

winspool.drv

OpenPrinterW

winmm

timeGetTime

powrprof

CallNtPowerInformation

oleacc

LresultFromObject

netapi32

Netbios

gdiplus

GdipGetImageGraphicsContext

Sections

.text
Size: 2.2MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

52c5691b876d07d6f11342f2efac675a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

69:63:82:dc:b5:32:37:46:c7:45:85:b8:a9:b5:74:86Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

42:f4:56:77:e9:ec:ff:53:5b:bc:20:6b:d8:06:db:c6:cf:3d:fd:91Signer

Headers

File Characteristics

Imports

kernel32

oleaut32

advapi32

user32

msimg32

gdi32

version

ole32

comctl32

wininet

shell32

comdlg32

wsock32

winspool.drv

winmm

powrprof

oleacc

netapi32

gdiplus

Sections

.text Size: 2.2MB - Virtual size: 8.5MB

.rsrc Size: 37KB - Virtual size: 40KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

69:63:82:dc:b5:32:37:46:c7:45:85:b8:a9:b5:74:86
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

42:f4:56:77:e9:ec:ff:53:5b:bc:20:6b:d8:06:db:c6:cf:3d:fd:91
Signer

.text
Size: 2.2MB - Virtual size: 8.5MB

.rsrc
Size: 37KB - Virtual size: 40KB