347afb83305a09bf86a67913dba4c4f4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

347afb83305a09bf86a67913dba4c4f4_JaffaCakes118
Size

65KB
MD5

347afb83305a09bf86a67913dba4c4f4
SHA1

786ddd310e35528755d39a905d0f55bc692783e5
SHA256

fd1eeaa328285e462a38283914c866cde53505ef481c2aebe3c671d442ad2ffe
SHA512

da1cef4097b855c06a1f3a3012742f51c4cc79ff9d0de444b498d25a67bc670bd1a2fa2a83da2f798dbc5b2366670ca64f941d0bb7096e869f2a497a6f5aac06
SSDEEP

1536:XKKjs3dDm5ysl4tv1iV16v1f1rp4iDsDTbp:6s0EyslwAnC1fROiD8Xp

Score

1^/10

Malware Config

Signatures

Files

347afb83305a09bf86a67913dba4c4f4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0e1786ba0ea8829ab454ce12c2a1d5f8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DeregisterEventSource
IsTextUnicode
ObjectDeleteAuditAlarmA
CryptSignHashA
CryptContextAddRef
RevertToSelf
GetAclInformation
GetServiceDisplayNameA
AllocateAndInitializeSid
BuildSecurityDescriptorA
EnumDependentServicesA
GetSecurityDescriptorControl
RegUnLoadKeyA
RegOpenKeyA
CryptSetKeyParam
BackupEventLogA
SetEntriesInAuditListA
OpenEventLogA
PrivilegeCheck
GetNumberOfEventLogRecords
CopySid
AccessCheck
ChangeServiceConfigA
ControlService
SetServiceStatus
CryptGetKeyParam
CryptHashSessionKey
RegSaveKeyA
InitializeAcl
CryptEncrypt
GetTrusteeTypeA
RegDeleteValueA
FindFirstFreeAce
CryptDestroyHash
GetSidSubAuthority
RegFlushKey
GetMultipleTrusteeA

user32

EndMenu
ArrangeIconicWindows
SwitchToThisWindow
RegisterWindowMessageA
SetCaretBlinkTime
DispatchMessageA
WinHelpA
DdeClientTransaction
GetKBCodePage
TranslateAccelerator
CharToOemBuffA
InsertMenuItemA
GetWindowWord
MapVirtualKeyExA
UnhookWinEvent
SetProcessWindowStation
IsWindowUnicode
FindWindowExA
DrawTextExA
GetIconInfo
GetDC
InSendMessage
SetMenuDefaultItem
CopyIcon
TileWindows
LookupIconIdFromDirectory
BringWindowToTop
UnpackDDElParam
EnumPropsExA
DdeQueryStringA
DdeUnaccessData
EnumDisplayMonitors
DestroyAcceleratorTable
GetMenuItemCount
DrawMenuBar
DrawCaption
ShowCursor
OemToCharA
DlgDirSelectExA
PackDDElParam
DrawFrame
RedrawWindow
CascadeWindows
SetSysColors
EnableScrollBar
PostQuitMessage
GetUserObjectSecurity
RegisterDeviceNotificationA
GetNextDlgTabItem
ToUnicodeEx
IMPGetIMEA
SetMessageExtraInfo
DestroyMenu

kernel32

ReadConsoleOutputA

Sections

.qpohw
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.czkd
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wla
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.etszy
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e1786ba0ea8829ab454ce12c2a1d5f8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.qpohw Size: 22KB - Virtual size: 45KB

.czkd Size: 5KB - Virtual size: 10KB

.wla Size: 1KB - Virtual size: 2KB

.etszy Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.qpohw
Size: 22KB - Virtual size: 45KB

.czkd
Size: 5KB - Virtual size: 10KB

.wla
Size: 1KB - Virtual size: 2KB

.etszy
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB