2b460f1d0fc03f3dd8344e4ae27830eb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b460f1d0fc03f3dd8344e4ae27830eb_JaffaCakes118
Size

320KB
MD5

2b460f1d0fc03f3dd8344e4ae27830eb
SHA1

7d1258f21b7dd8b9b6f41d1f72d73a7dcee73f00
SHA256

4fdca0276d551fcea666142b5633e3b323677505dc42a0deb305869761d90828
SHA512

71b5927a7c71a7ffac4aebd129e6aca94e598c879ba6e00af220c3ea89fe0572ca0a29969e0bd188214d82271e464a2a17c543040b0ce2b9436f70c59556216b
SSDEEP

6144:z/pcdrBdwnFJsQdeR1VDZwczSbpjcVRjChE5QQ7b+X1dDVP0cKCb:rp2BOFJsoeQczGpj21Ldb+PpscKCb

Score

1^/10

Malware Config

Signatures

Files

2b460f1d0fc03f3dd8344e4ae27830eb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f02ae2e5809794ea6653463e341ff484

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:02:30:7e:00:00:00:00:00:06
Certificate

Issuer

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/03/2008, 21:57

Not After

10/06/2009, 22:07

Subject

CN=Microsoft Windows Component Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

11/10/2005, 21:55

Not After

26/04/2010, 07:00

Subject

CN=Microsoft Windows Verification Intermediate PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

9a:9d:c5:f0:1e:1b:27:04:85:37:a0:02:ba:9e:b7:5a:dd:2d:e7:2e
Signer

Actual PE Digest

9a:9d:c5:f0:1e:1b:27:04:85:37:a0:02:ba:9e:b7:5a:dd:2d:e7:2e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameA
GetLastError
CreateMutexA
Process32Next
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
CloseHandle
WriteFile
CreateFileA
GetCurrentThreadId
DeviceIoControl
FreeLibrary
GlobalFree
LoadLibraryExA
GlobalAlloc
GetProcAddress
ReadFile
GetCommandLineA
SetFileAttributesA
WaitForSingleObject
CreateProcessA
DeleteFileA
OpenProcess
lstrcmpiA
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
CreateThread
WideCharToMultiByte
lstrlenW
ReadProcessMemory
VirtualAllocEx
VirtualFreeEx
WinExec
ExitProcess
GetModuleHandleA
EnumResourceTypesA
lstrcatA
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
GetFileSize
EnumResourceNamesA

user32

FindWindowA
FindWindowExA
MessageBoxA
PostMessageA
TranslateMessage
DispatchMessageA
wsprintfA
SendMessageA
GetWindowThreadProcessId
GetForegroundWindow
GetWindow
GetClassNameA
GetWindowTextA
GetWindowRect
SetCursorPos
GetMessageA
SendInput

advapi32

ControlService
OpenServiceA
OpenSCManagerA
StartServiceA
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegOpenKeyA
CloseServiceHandle

shell32

ShellExecuteA

msvcrt

atoi
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_stricmp

psapi

GetModuleFileNameExA
EnumProcessModules

Sections

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f02ae2e5809794ea6653463e341ff484

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:02:30:7e:00:00:00:00:00:06Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88Certificate

Extended Key Usages

Key Usages

9a:9d:c5:f0:1e:1b:27:04:85:37:a0:02:ba:9e:b7:5a:dd:2d:e7:2eSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

psapi

Sections

.data Size: 26KB - Virtual size: 26KB

.rsrc Size: 284KB - Virtual size: 283KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:02:30:7e:00:00:00:00:00:06
Certificate

6a:0b:99:4f:c0:00:1b:ab:11:da:3a:a1:b6:df:ec:88
Certificate

9a:9d:c5:f0:1e:1b:27:04:85:37:a0:02:ba:9e:b7:5a:dd:2d:e7:2e
Signer

.data
Size: 26KB - Virtual size: 26KB

.rsrc
Size: 284KB - Virtual size: 283KB