2eb91c3949a909dc622667bfc5c74a3d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2eb91c3949a909dc622667bfc5c74a3d_JaffaCakes118
Size

110KB
MD5

2eb91c3949a909dc622667bfc5c74a3d
SHA1

4fdb2af83d9b75207a3a274a96965e4752f4d4ba
SHA256

8d3d3df97e091991b12dca48f415d0efba982cc4ea9da8bd191599d225f9a6e9
SHA512

045c41dee52104eb4167bc1d8c666f8547f39af0afa20a8239184b4bd64795202f39a9c0ed57ce39413ab97ba4fdbd2a023cdc55dd05d5cc01259f50f58fc9c9
SSDEEP

3072:PV7dmFsKykk+AoxpJmRbX8pKWumSloYX0q:t7dmOKHpwbMduXefq

Score

1^/10

Malware Config

Signatures

Files

2eb91c3949a909dc622667bfc5c74a3d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

da8373cea01c735179475edd2f2e6f84

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:30

Not After

03/03/2021, 18:30

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:46:5f:76:d4:8d:b7:86:2a:0d:4b:ee:7b:33:fe:00:6b:cc:a8:af:44:6c:33:62:e0:29:89:de:00:39:8e:a0
Signer

Actual PE Digest

c8:46:5f:76:d4:8d:b7:86:2a:0d:4b:ee:7b:33:fe:00:6b:cc:a8:af:44:6c:33:62:e0:29:89:de:00:39:8e:a0

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

advapi32

InitializeSecurityDescriptor
CheckTokenMembership
AllocateAndInitializeSid
SetSecurityDescriptorDacl
FreeSid

kernel32

WaitNamedPipeA
DisconnectNamedPipe
GlobalFree
_lwrite
_lclose
_lcreat
GetCurrentProcessId
GetLastError
Sleep
CreateDirectoryA
CloseHandle
ConnectNamedPipe
GlobalAlloc
CreateNamedPipeA
ReadFile
CallNamedPipeA
GetFileAttributesA
WriteFile
FlushFileBuffers
CreateProcessA

msvbvm60

_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaStrCat
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaBoolVar
_CIsin
__vbaErase
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
ord717
__vbaStrVarVal
_CIlog
__vbaInStr
__vbaNew2
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaAryLock
__vbaStrToAnsi
ord616
_CIatan
__vbaStrMove
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da8373cea01c735179475edd2f2e6f84

Code Sign

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

c8:46:5f:76:d4:8d:b7:86:2a:0d:4b:ee:7b:33:fe:00:6b:cc:a8:af:44:6c:33:62:e0:29:89:de:00:39:8e:a0Signer

Headers

File Characteristics

Imports

advapi32

kernel32

msvbvm60

Sections

.text Size: 16KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 912B

.rsrc Size: 40KB - Virtual size: 39KB

.reloc Size: 4KB - Virtual size: 1KB

33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

c8:46:5f:76:d4:8d:b7:86:2a:0d:4b:ee:7b:33:fe:00:6b:cc:a8:af:44:6c:33:62:e0:29:89:de:00:39:8e:a0
Signer

.text
Size: 16KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 912B

.rsrc
Size: 40KB - Virtual size: 39KB

.reloc
Size: 4KB - Virtual size: 1KB