2fb309739b51d420c458e90ca01c7fb6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2fb309739b51d420c458e90ca01c7fb6_JaffaCakes118
Size

214KB
MD5

2fb309739b51d420c458e90ca01c7fb6
SHA1

594bc0bf69e216b1e4b9915e56975a67d3351a28
SHA256

0d86814adeab20029732d5f8df28c7c3c3ffea76f10901c3e4ee81f282545aca
SHA512

a87ac3116d7f75275ef0b260540c4ed6bd35abb96af88564f3b0caadcc3b6980b8e69d955291effe0925372530e92111b7b3fe43a1db70d57d2e4c20a34bb9bb
SSDEEP

3072:bWfcv+RRMWBGtnDvv82e+tNg7WKZCqSwCR/eZt6oW0EzHaJoR4eTxONKZ0BrHO:6fXfMW4V82vM+wCRWL6o1EzHaJwV2Gg

Score

1^/10

Malware Config

Signatures

Files

2fb309739b51d420c458e90ca01c7fb6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9e3f972aea128f33c150645fa3580a52

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/02/2009, 00:00

Not After

11/02/2012, 23:59

Subject

CN=Avira GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development 2009,O=Avira GmbH,L=Tettnang,ST=Baden-Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeThread
GetStartupInfoA
EndUpdateResourceA
GetProcessHeap
CopyFileExW
SearchPathW
CreateFiber
RemoveDirectoryA
GetThreadLocale
lstrcpyA
GetVolumeInformationW
FindAtomW
lstrlenA
GetFullPathNameW
OpenMutexA
lstrlen
InitializeCriticalSection
GetWindowsDirectoryA
GetHandleInformation
lstrlenW
BeginUpdateResourceA
GetProcAddress
IsBadReadPtr
FindAtomA
SleepEx
GetUserDefaultLCID
CreateFileMappingW
ReplaceFileA
EndUpdateResourceW
GetModuleFileNameA
VirtualAlloc
EnumDateFormatsA

user32

GetDlgItem
GetClassInfoA
RemoveMenu
DrawTextA
DefFrameProcW
EndDialog
EnumDesktopWindows
ShowWindow
LoadBitmapA
GetDlgItemInt

gdi32

Escape
Chord
CreateColorSpaceW
StartPage
GetCharABCWidthsA
GetGraphicsMode
FlattenPath
GetOutlineTextMetricsA
GetSystemPaletteEntries
SetTextColor
SetTextJustification
GdiGetBatchLimit
SetRectRgn

advapi32

RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueW
RegDeleteValueA

comctl32

ImageList_SetDragCursorImage

ole32

CoLoadLibrary

setupapi

SetupGetFileCompressionInfoExA
CM_Get_Child
CM_Get_Device_Interface_List_Size_ExW
CM_Get_Version_Ex
SetupSetFileQueueFlags
CM_Register_Device_Driver_Ex
SetupGetBackupInformationA
SetupDiEnumDeviceInfo
SetupDiSetDriverInstallParamsA
CM_Set_DevNode_Registry_Property_ExW

urlmon

IsJITInProgress
URLDownloadToFileA
CDLGetLongPathNameA
CoInternetCombineUrl
IsLoggingEnabledA
CreateAsyncBindCtxEx
CDLGetLongPathNameW
GetSoftwareUpdateInfo
CopyBindInfo
ObtainUserAgentString
IsAsyncMoniker
RevokeFormatEnumerator
URLDownloadToCacheFileA
CreateURLMonikerEx
URLOpenPullStreamW

winmm

midiInAddBuffer

winspool.drv

PerfCollect
SpoolerPrinterEvent
SetPortA
AddPrinterDriverExW
GetJobA
GetPrinterA
FreePrinterNotifyInfo

sqlunirl

_GetMenuItemInfo_@16
_ShellExecuteEx_@4
_GetCharABCWidths_@16
_GetKeyboardLayoutName_@4
_OpenFileMapping_@12

Sections

.pA#M$m
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.+Rz;
Size: 2KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.OS
Size: 1024B - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.t)o
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.=!si
Size: 512B - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9
Size: 512B - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.-t
Size: 3KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pfiwV=
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.P*3Q
Size: 1KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e3f972aea128f33c150645fa3580a52

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

comctl32

ole32

setupapi

urlmon

winmm

winspool.drv

sqlunirl

Sections

.pA#M$m Size: 11KB - Virtual size: 13KB

.+Rz; Size: 2KB - Virtual size: 47KB

.OS Size: 1024B - Virtual size: 30KB

.t)o Size: 4KB - Virtual size: 3KB

.=!si Size: 512B - Virtual size: 46KB

.9 Size: 512B - Virtual size: 15KB

.-t Size: 3KB - Virtual size: 38KB

.pfiwV= Size: 512B - Virtual size: 18KB

.P*3Q Size: 1KB - Virtual size: 14KB

.rsrc Size: 180KB - Virtual size: 180KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

75:e8:09:36:1d:af:be:7b:d7:2e:0e:5b:b7:65:95:52
Certificate

.pA#M$m
Size: 11KB - Virtual size: 13KB

.+Rz;
Size: 2KB - Virtual size: 47KB

.OS
Size: 1024B - Virtual size: 30KB

.t)o
Size: 4KB - Virtual size: 3KB

.=!si
Size: 512B - Virtual size: 46KB

.9
Size: 512B - Virtual size: 15KB

.-t
Size: 3KB - Virtual size: 38KB

.pfiwV=
Size: 512B - Virtual size: 18KB

.P*3Q
Size: 1KB - Virtual size: 14KB

.rsrc
Size: 180KB - Virtual size: 180KB