33e3bd5cde3211afdf7877d345fc1aea_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

33e3bd5cde3211afdf7877d345fc1aea_JaffaCakes118
Size

73KB
MD5

33e3bd5cde3211afdf7877d345fc1aea
SHA1

af938251dd9107d0e79aac0606185f39a852922b
SHA256

18eff91e5dba6f888eb286c497c4ef352b903184c5e3e3723990cb23b4c54f4c
SHA512

cb294bb7c2e0968808756bc2db868bae3a7064c9fc266524598720746713184a64bd2427aa498676518db7cc8108809ae1778fd6d8992d861793951aaa968d9d
SSDEEP

768:9mVdP9U/efc/FGiFo0cYEJN672kZwv0LD7TcFb2Gh0h2+qFNHHqTnoL9atJ:9IdlU/W0NFo0cm2kQ0v7RI3qTnos

Score

1^/10

Malware Config

Signatures

Files

33e3bd5cde3211afdf7877d345fc1aea_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d7e820b77d267222bd5194de3f6d766b

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:ca:f3
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11-01-2005 23:22

Not After

10-02-2007 16:18

Subject

CN=Integrated Search Technologies,OU=Secure Application Development,O=Integrated Search Technologies,L=Montreal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile

shlwapi

SHDeleteValueA
SHSetValueA
SHDeleteKeyA
SHGetValueA

user32

EnumWindows
PostMessageA
FindWindowA
GetWindowThreadProcessId

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
strchr
strncpy
strncmp
strtok
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
isspace
_mbscmp
__CxxFrameHandler
memset
strrchr
_stricmp

mfc42

ord2818
ord5710
ord3790
ord353
ord3176
ord1979
ord356
ord354
ord2770
ord2781
ord4058
ord800
ord540
ord5683
ord4278
ord2763
ord6283
ord6282
ord858
ord535
ord939
ord940
ord537
ord860
ord668
ord3181
ord1980
ord2393
ord5583
ord665

kernel32

GetStartupInfoA
GetModuleHandleA
lstrcpyA
lstrcatA
CreateMutexA
GetLastError
Sleep
GetWindowsDirectoryA
DeleteFileA
SetErrorMode
LoadLibraryExA
RemoveDirectoryA
HeapAlloc
SetLastError
HeapFree
WideCharToMultiByte
OpenProcess
WaitForSingleObject
TerminateProcess
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress

advapi32

RegOpenKeyExA
RegEnumKeyA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

OleUninitialize
OleInitialize

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d7e820b77d267222bd5194de3f6d766b

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

20:ca:f3Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

wininet

shlwapi

user32

msvcrt

mfc42

kernel32

advapi32

shell32

ole32

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 10KB

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

20:ca:f3
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 10KB