2b872062b17228cfe574966679fa3d19_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2b872062b17228cfe574966679fa3d19_JaffaCakes118
Size

281KB
MD5

2b872062b17228cfe574966679fa3d19
SHA1

42051028e172333e52445d87a70d2a5f922556d4
SHA256

f78d9103b6b70c2dd6b60cf8fc1a60d930b98abc91277b3a677afd777f823fcb
SHA512

d01f8e92e8ef4430c1b8a21bb8a69660678c94f26aebd7f155a1d441cd7c4172fa8e97a36b3e65ccfc4361d84bf0c17dcdfe2be83ee20fb8d294fea391da0dc1
SSDEEP

6144:3MMAOnshblglp0y9WkZ49wmaDkc9ZzP35Bh8alTxzrs7s:F3KblgsyDZHmabzJBhDXXs7s

Score

1^/10

Malware Config

Signatures

Files

2b872062b17228cfe574966679fa3d19_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d8a287106021959ab31ce63256d6176a

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

Issuer

CN=55666123h

Not Before

14/02/2012, 20:22

Not After

31/12/2039, 23:59

Subject

CN=55666123h

Extended Key Usages

ExtKeyUsageCodeSigning

90:36:0c:86:2d:14:50:7e:ee:be:25:e4:b1:08:eb:7e:b1:f3:3f:00
Signer

Actual PE Digest

90:36:0c:86:2d:14:50:7e:ee:be:25:e4:b1:08:eb:7e:b1:f3:3f:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetWindowsDirectoryW
lstrlenW
lstrcpyW
CreateFileW
ExpandEnvironmentStringsW
LoadModule
SetConsoleOutputCP
AreFileApisANSI
GetPrivateProfileIntW
GetSystemWindowsDirectoryA
GetEnvironmentStringsA
HeapDestroy
SetSystemPowerState
GlobalAlloc
SetFileTime
ResetWriteWatch
GetVersionExA
GetCPInfoExW
CreateMailslotW
SetVolumeLabelW
ReadConsoleA
SetMailslotInfo
IsBadHugeReadPtr
EndUpdateResourceA
WritePrivateProfileStructW
GetProcAddress
HeapValidate
EnumDateFormatsA
lstrcpynW
FindAtomA
FillConsoleOutputCharacterA
GetEnvironmentStrings
CreateWaitableTimerW
SetComputerNameA
SetConsoleTitleW
WritePrivateProfileStringW
RemoveDirectoryW
AllocateUserPhysicalPages
GetProfileStringW
HeapFree
ReadFile
WriteProcessMemory
SetUnhandledExceptionFilter
GlobalUnlock
FindNextVolumeMountPointW
SetConsoleCursorPosition
ExitProcess
GlobalFindAtomW
TerminateThread
WritePrivateProfileStringA
CreateRemoteThread
SetCalendarInfoA
GetFileAttributesA
TlsSetValue
LocalLock
WaitNamedPipeW
GetProfileStringA
GetProfileIntA
FindResourceA
SetCalendarInfoW
GenerateConsoleCtrlEvent
OpenFileMappingA
SetDefaultCommConfigW
MoveFileWithProgressW
BeginUpdateResourceA
GetProcessAffinityMask
DefineDosDeviceW
GetThreadTimes
CancelDeviceWakeupRequest
SetSystemTimeAdjustment
GetDiskFreeSpaceExW
BackupSeek
CreateProcessW
GetLogicalDriveStringsA
OpenWaitableTimerW
SetThreadPriorityBoost
GetPrivateProfileSectionNamesA
GetACP
EraseTape
IsDebuggerPresent
LockResource
MapViewOfFile
GetAtomNameA
SetPriorityClass
ReadConsoleOutputW
SetLastError
GetDefaultCommConfigW
FindNextVolumeA
VirtualProtectEx
DebugBreak
RtlFillMemory
GetComputerNameA
UnregisterWait
FindFirstChangeNotificationA
ReadFileEx
SetEnvironmentVariableA
GetDriveTypeW
lstrcpyA
SetComputerNameExW
WriteProfileSectionA
GetPrivateProfileSectionW
OpenMutexA
GetFileSize
LocalAlloc
FindNextVolumeW
GlobalUnWire
VirtualFreeEx
lstrcatA
GetSystemTimeAdjustment
LocalUnlock
GetSystemDefaultLangID
UpdateResourceW
lstrcmpi
GetStringTypeW
GetSystemDefaultUILanguage
TlsAlloc
SetThreadContext
GetBinaryTypeA
ReadConsoleOutputCharacterA
SetErrorMode
lstrcmpiA
GetModuleHandleW
SetConsoleCursorInfo
GetOverlappedResult
FlushConsoleInputBuffer
LCMapStringW
ReadConsoleInputA
_lcreat
GetNumberFormatA
CreateJobObjectA
FreeEnvironmentStringsA
HeapCreate
OpenJobObjectA
WaitForDebugEvent
GetConsoleAliasExesLengthA
GetTimeFormatA
GetCommTimeouts
GetFullPathNameA

advapi32

RegOpenKeyExW

shell32

ShellExecuteExA
ShellExecuteEx
SHGetFileInfoW
SHBrowseForFolderA
DuplicateIcon
ShellExecuteA
SHGetIconOverlayIndexA
SHGetFolderLocation
SHCreateProcessAsUserW
SHAddToRecentDocs
SHGetFileInfo
SHPathPrepareForWriteA
Shell_NotifyIcon
SHGetFolderPathA
SHGetIconOverlayIndexW
SHFileOperation
SHGetSpecialFolderPathA
SHGetMalloc
DragFinish
SHChangeNotify
DoEnvironmentSubstW
SHFileOperationA
SHIsFileAvailableOffline
ShellHookProc
FindExecutableW
SHGetPathFromIDListW
CommandLineToArgvW
SHBindToParent
ExtractIconEx
ExtractAssociatedIconExW
SHLoadInProc
DragQueryFileA
ExtractAssociatedIconW
DragQueryFileW
SHGetFileInfoA
ExtractAssociatedIconA
ExtractIconExW
SHAppBarMessage
SHGetSpecialFolderLocation
SHFileOperationW
SHInvokePrinterCommandA
SHGetDesktopFolder
DragQueryFile
SHEmptyRecycleBinA
FindExecutableA
SHGetSettings
SHBrowseForFolderW
ShellAboutW
SHEmptyRecycleBinW
CheckEscapesW
Shell_NotifyIconA
SHGetInstanceExplorer
SHBrowseForFolder
ExtractAssociatedIconExA
WOWShellExecute
SHGetDataFromIDListA
SHFreeNameMappings
SHQueryRecycleBinW
SHLoadNonloadedIconOverlayIdentifiers
SHFormatDrive
ExtractIconW
DragQueryPoint
DragAcceptFiles
ShellExecuteW
ShellExecuteExW
SHGetDiskFreeSpaceA

shlwapi

StrChrW
StrStrIA
StrCmpNIW
StrRChrIW
StrCmpNW
StrStrW
StrChrIA
StrRChrA
StrRStrIW
StrCmpNA
StrRChrW
StrRStrIA
StrStrIW
StrCmpNIA

comctl32

ImageList_BeginDrag
ImageList_ReplaceIcon
ImageList_SetFilter
ImageList_SetDragCursorImage
CreateStatusWindowW
ord13
ImageList_Replace
DestroyPropertySheetPage
ImageList_GetImageInfo
FlatSB_GetScrollInfo
FlatSB_EnableScrollBar
CreatePropertySheetPage
ImageList_SetOverlayImage
GetMUILanguage
ImageList_Draw
ord3
ord17
FlatSB_SetScrollRange
ord5
ord2
ImageList_Write
ImageList_LoadImageA
ImageList_SetImageCount
FlatSB_SetScrollPos
ImageList_Copy
DrawStatusText
ImageList_SetBkColor
CreateStatusWindow
FlatSB_GetScrollPos
ImageList_Merge
CreatePropertySheetPageW
ord16
CreatePropertySheetPageA
ImageList_Add
InitCommonControlsEx
CreateToolbarEx
ImageList_GetIcon
ImageList_Destroy
ord14
DrawStatusTextW
UninitializeFlatSB
ImageList_GetIconSize
ImageList_SetIconSize
ImageList_DragShowNolock
FlatSB_SetScrollProp
_TrackMouseEvent
ImageList_DragEnter
ImageList_GetBkColor
FlatSB_SetScrollInfo
ord8
ImageList_DrawIndirect
ImageList_DragMove
ord7
ImageList_AddMasked
ImageList_Remove
ord15
FlatSB_ShowScrollBar
ord6
PropertySheet
ImageList_Read
PropertySheetW
ord4
ImageList_GetDragImage
ImageList_EndDrag
InitMUILanguage
ImageList_LoadImage

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV2
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textF4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV3
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV4
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV1
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV5
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV6
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV7
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d8a287106021959ab31ce63256d6176a

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86Certificate

Extended Key Usages

90:36:0c:86:2d:14:50:7e:ee:be:25:e4:b1:08:eb:7e:b1:f3:3f:00Signer

Headers

File Characteristics

Imports

kernel32

advapi32

shell32

shlwapi

comctl32

Sections

.text Size: 4KB - Virtual size: 3KB

.textV2 Size: 256KB - Virtual size: 255KB

.textF4 Size: 2KB - Virtual size: 2KB

.textV3 Size: 512B - Virtual size: 500B

.textV4 Size: 512B - Virtual size: 500B

.textV1 Size: 512B - Virtual size: 500B

.textV5 Size: 512B - Virtual size: 500B

.textV6 Size: 512B - Virtual size: 500B

.textV7 Size: 512B - Virtual size: 500B

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 1KB

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

90:36:0c:86:2d:14:50:7e:ee:be:25:e4:b1:08:eb:7e:b1:f3:3f:00
Signer

.text
Size: 4KB - Virtual size: 3KB

.textV2
Size: 256KB - Virtual size: 255KB

.textF4
Size: 2KB - Virtual size: 2KB

.textV3
Size: 512B - Virtual size: 500B

.textV4
Size: 512B - Virtual size: 500B

.textV1
Size: 512B - Virtual size: 500B

.textV5
Size: 512B - Virtual size: 500B

.textV6
Size: 512B - Virtual size: 500B

.textV7
Size: 512B - Virtual size: 500B

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 1KB