2caa009e0025e804dc893068f76ce43f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2caa009e0025e804dc893068f76ce43f_JaffaCakes118
Size

270KB
MD5

2caa009e0025e804dc893068f76ce43f
SHA1

f9e6a642025eb3d0568f71b9243604b1703d3d97
SHA256

a16a51318ea8bb7db03cf6f0da075a30d676bc9274d6812e5920443100628140
SHA512

748a36388c0dadd1aec1ade073a09795933a286f6130036fa1f195ab475b851a463ffc36e277d0f1bba002b404e06411cdb623884710d575e0ce7f32fd5afd7a
SSDEEP

3072:dnbS3vbSmkjABcmG9lz61pPYAV+SwwjC7fptD3cyVxpC8aVKhtsQKY8owgX/FnZ:dnbSfbSBkHpP7Wwe3PfcKrKywc

Score

1^/10

Malware Config

Signatures

Files

2caa009e0025e804dc893068f76ce43f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b33bba204ccfd8468f042374744bdaec

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:26:c6:4d:4e:d9:d8:2a:ab:ef:de:3c:f9:9c:02:15
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

07/10/2011, 00:00

Not After

29/10/2012, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:78:76:30:9c:8c:4c:bb:74:4a:a7:a9:18:0d:51:78:62:bd:63:84
Signer

Actual PE Digest

5b:78:76:30:9c:8c:4c:bb:74:4a:a7:a9:18:0d:51:78:62:bd:63:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\buildbot\win32_build_beta\build\objdir-tb\mozilla\toolkit\mozapps\update\updater\updater.pdb

Imports

advapi32

CreateProcessAsUserW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
CloseServiceHandle
OpenServiceW
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

kernel32

GetLastError
CreateProcessW
MoveFileExW
GetTempFileNameW
WideCharToMultiByte
SetEndOfFile
SetFilePointer
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
MultiByteToWideChar
Sleep
CopyFileW
GetLongPathNameW
GetFileAttributesW
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
WriteFile
FormatMessageW
GetVersionExA
GetProcAddress
SetLastError
GetCurrentProcess
GetStringTypeW
GetStringTypeA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoA
GetTimeZoneInformation
InitializeCriticalSection
LoadLibraryA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetPrivateProfileStringW
LocalFree
IsValidCodePage
GetOEMCP
GetACP
CloseHandle
OpenProcess
GetCPInfo
SetEnvironmentVariableA
RaiseException
HeapSize
GetConsoleMode
GetConsoleCP
RtlUnwind
HeapFree
HeapAlloc
GetProcessHeap
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
SetFileAttributesW
GetDriveTypeW
DeleteFileW
ExitThread
GetCurrentThreadId
CreateThread
CreateDirectoryW
MoveFileW
RemoveDirectoryW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
EnterCriticalSection
LeaveCriticalSection
GetDriveTypeA
HeapReAlloc
ReadFile
CreateFileA
GetModuleHandleA
ExitProcess
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
VirtualAlloc
GetFullPathNameW
GetCurrentDirectoryA

user32

DrawTextW
SendMessageW
GetDlgItem
SetWindowPos
OffsetRect
DialogBoxParamW
EndDialog
SetWindowTextW
LoadIconW
CopyRect
SetWindowLongW
GetDC
GetWindowLongW
GetClientRect
GetParent
ScreenToClient
ReleaseDC
SetTimer
GetDesktopWindow
GetWindowRect

gdi32

SelectObject

wsock32

ntohl

comctl32

InitCommonControlsEx

shell32

ShellExecuteExW

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

shlwapi

PathAppendW
PathRemoveFileSpecW

Sections

.text
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b33bba204ccfd8468f042374744bdaec

Code Sign

01Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6b:26:c6:4d:4e:d9:d8:2a:ab:ef:de:3c:f9:9c:02:15Certificate

Extended Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

5b:78:76:30:9c:8c:4c:bb:74:4a:a7:a9:18:0d:51:78:62:bd:63:84Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

gdi32

wsock32

comctl32

shell32

userenv

shlwapi

Sections

.text Size: 112KB - Virtual size: 110KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 100KB - Virtual size: 96KB

.reloc Size: 12KB - Virtual size: 8KB

01
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6b:26:c6:4d:4e:d9:d8:2a:ab:ef:de:3c:f9:9c:02:15
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

5b:78:76:30:9c:8c:4c:bb:74:4a:a7:a9:18:0d:51:78:62:bd:63:84
Signer

.text
Size: 112KB - Virtual size: 110KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 100KB - Virtual size: 96KB

.reloc
Size: 12KB - Virtual size: 8KB