335edabb277d297b0c48aff80f6ae782_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

335edabb277d297b0c48aff80f6ae782_JaffaCakes118
Size

508KB
MD5

335edabb277d297b0c48aff80f6ae782
SHA1

339c60575c658329dbcbe01afd41f57236879591
SHA256

2a395a0cdfe53b712e1fa5cae03be81fca7cb28061e75859bf47d5db65fcf17d
SHA512

6e3393eb41674798298b96920191dd9fb748750bd1832bfccfed2830c315cb3d14bff36e49d212fc12861b0796d318667fb33d5df1bc862eb79683de19cacf33
SSDEEP

12288:QH8P9/piqhUplwQMTOkU9EB7TxVBZxCUt43paB:QH8P9Y1k+EBx1xCUtIaB

Score

1^/10

Malware Config

Signatures

Files

335edabb277d297b0c48aff80f6ae782_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2104448d89b7497e85a4a189bd8ab8b3

Code Sign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:a7:bc:7c:a7:67:cb:18:02:01:ad:72:f9:d2:bb:25
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/08/2011, 00:00

Not After

03/08/2012, 23:59

Subject

CN=JooSoft.com GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=JooSoft.com GmbH,L=Hergiswil,ST=Kanton Nidwalden,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

df:1f:a8:59:2a:b1:6a:ed:9b:58:aa:4f:ac:1d:b1:28:9a:42:bc:85
Signer

Actual PE Digest

df:1f:a8:59:2a:b1:6a:ed:9b:58:aa:4f:ac:1d:b1:28:9a:42:bc:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DLA.PDB

Imports

ws2_32

inet_ntoa
closesocket
connect
htons
socket
ntohl
ntohs

oleacc

CreateStdAccessibleObject
LresultFromObject

comctl32

InitCommonControlsEx

comdlg32

GetFileTitleW

shlwapi

PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
UrlUnescapeW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

shell32

ShellExecuteW

advapi32

CheckTokenMembership
FreeSid
RegCloseKey
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW

wininet

InternetGetLastResponseInfoW
InternetOpenW
InternetSetStatusCallbackW
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpSendRequestW
InternetConnectW
HttpOpenRequestW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetSetOptionExW
InternetQueryDataAvailable
InternetCloseHandle
HttpQueryInfoW
HttpAddRequestHeadersW

ole32

CoUninitialize
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal
CoCreateGuid

oleaut32

VariantInit
VariantChangeType
VariantClear
SysFreeString
SysAllocString

gdi32

CreateBitmap
DeleteDC
EnumFontFamiliesExW
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetClipBox
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
CreateDIBitmap
GetTextMetricsW
CreatePatternBrush
CreatePen
CreateSolidBrush
GetObjectW
GetStockObject
CreateFontIndirectW
EnumFontFamiliesW
GetTextCharsetInfo
DeleteObject
GetDeviceCaps

kernel32

SetThreadPriority
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
SuspendThread
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenA
lstrcmpA
VirtualProtect
InterlockedIncrement
GetCurrentProcessId
VirtualQuery
LocalFree
MulDiv
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
lstrcmpW
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
WaitForMultipleObjects
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
DeleteFileW
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
GlobalFlags
TlsGetValue
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
FindResourceExW
GetFileAttributesExW
GetFileAttributesW
GetFileSizeEx
GetFileTime
SetErrorMode
RaiseException
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
RtlUnwind
ExitThread
CreateThread
HeapQueryInformation
HeapSize
SetStdHandle
GetFileType
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsW
SetHandleCount
HeapCreate
QueryPerformanceCounter
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
GetStringTypeW
IsProcessorFeaturePresent
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetEnvironmentVariableA
FormatMessageW
SetLastError
DeactivateActCtx
GetLastError
ActivateActCtx
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
GetSystemDirectoryW
LoadLibraryW
GetVersionExW
GetProcAddress
lstrcpyW
FreeLibrary
GetModuleHandleW
GetCurrentProcess
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CloseHandle
WaitForSingleObject
CreateMutexW
ReleaseMutex
GetModuleFileNameW
CreateFileW
SetFilePointer
ReadFile
GetFileSize
CopyFileW
WriteFile
ResumeThread
GetTickCount
CreateProcessW
GetTempPathW
CreateDirectoryW
MoveFileExW
SetEnvironmentVariableW
GetEnvironmentStringsW
lstrlenW
WideCharToMultiByte
CreateEventW
SetEvent

user32

UnregisterClassW
RealChildWindowFromPoint
GetClassInfoW
DefWindowProcW
GetWindow
GetClassNameW
SendMessageW
GetClientRect
GetSystemMetrics
GetMonitorInfoW
CopyRect
SetRectEmpty
EnumDisplayMonitors
SystemParametersInfoW
GetSysColor
GetSysColorBrush
GetParent
MapWindowPoints
LoadCursorW
PostMessageW
EnableWindow
RegisterWindowMessageW
SetTimer
KillTimer
keybd_event
GetWindowRect
GetWindowLongW
SetWindowLongW
GetDC
GetMenuItemCount
GetSubMenu
CreateWindowExW
GetMenu
IsWindow
AdjustWindowRectEx
GetMenuItemID
GetActiveWindow
UnhookWindowsHookEx
PtInRect
SetWindowPos
CallWindowProcW
GetDlgCtrlID
ScreenToClient
RegisterClassW
GetClassInfoExW
MessageBoxW
UpdateWindow
ValidateRect
IsWindowVisible
RedrawWindow
SetForegroundWindow
SetMenu
GetKeyState
MonitorFromWindow
PeekMessageW
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
DispatchMessageW
SetActiveWindow
GetLastActivePopup
GetForegroundWindow
GetWindowTextW
GetWindowTextLengthW
SetFocus
GetFocus
RemovePropW
GetPropW
SetPropW
GetClassLongW
CallNextHookEx
SetWindowsHookExW
GetCapture
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
LoadIconW
GetMenuState
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
IsWindowEnabled
GetWindowThreadProcessId
InvalidateRect
GetAsyncKeyState
ShowWindow
MapDialogRect
SetDlgItemTextW
IsDialogMessageW
SetWindowTextW
MoveWindow
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamW
GetDesktopWindow
CheckMenuItem
EnableMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
PostQuitMessage
GetCursorPos
TranslateMessage
GetMessageW
SetCursor
CharUpperW
DestroyMenu

gdiplus

GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreateBitmapFromStream

rpcrt4

UuidToStringW

dnsapi

DnsQuery_W
DnsFree

Sections

.text
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2104448d89b7497e85a4a189bd8ab8b3

Code Sign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

17:a7:bc:7c:a7:67:cb:18:02:01:ad:72:f9:d2:bb:25Certificate

Extended Key Usages

Key Usages

df:1f:a8:59:2a:b1:6a:ed:9b:58:aa:4f:ac:1d:b1:28:9a:42:bc:85Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

oleacc

comctl32

comdlg32

shlwapi

winspool.drv

shell32

advapi32

wininet

ole32

oleaut32

gdi32

kernel32

user32

gdiplus

rpcrt4

dnsapi

Sections

.text Size: 241KB - Virtual size: 241KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 11KB - Virtual size: 27KB

.rsrc Size: 100KB - Virtual size: 99KB

.reloc Size: 45KB - Virtual size: 45KB

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

17:a7:bc:7c:a7:67:cb:18:02:01:ad:72:f9:d2:bb:25
Certificate

df:1f:a8:59:2a:b1:6a:ed:9b:58:aa:4f:ac:1d:b1:28:9a:42:bc:85
Signer

.text
Size: 241KB - Virtual size: 241KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 11KB - Virtual size: 27KB

.rsrc
Size: 100KB - Virtual size: 99KB

.reloc
Size: 45KB - Virtual size: 45KB