353e060a9eb1291532100e30c7975a03_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

353e060a9eb1291532100e30c7975a03_JaffaCakes118
Size

2.7MB
MD5

353e060a9eb1291532100e30c7975a03
SHA1

94d7461eeab9097d5dabf11086ab417d3374e37c
SHA256

972a03aa7daa41e1b60ad8e6d47af019e258cdb8a352292f7f7c3a54ed66c7ab
SHA512

5289ea739107eadde0c56a6348d783f2198ffda3a4da1888da310d2d40ea9de1843b00f9c3db67b3aeca23152f2154af4fe21b94f9db35536f4e65f3ed23c196
SSDEEP

49152:MKyjAAvqCEgRFO0cgl3WEOKNp8Mubr1zpzQqsT4mJSIO3z+/8oXE4VZKfyaDQgy:MKyjBvqCEgR1rJeMk1VznS4mJSIcz+/N

Score

1^/10

Malware Config

Signatures

Files

353e060a9eb1291532100e30c7975a03_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0ee50be9da81348b2200cc544c199dcf

Code Sign

7c:32:43:81:10:c7:43:c1
Certificate

Issuer

CN=CA365 Free Root Certificate,O=CA365,L=Beijing,ST=Beijing,C=CN

Not Before

19/05/2009, 03:33

Not After

19/05/2010, 03:33

Subject

CN=MicroSoft,OU=MicroSoft,O=MicroSoft,L=NewYork,ST=NewYork,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

24:e1:bd:38:4a:95:29:f8
Certificate

Issuer

CN=CA365 Free Root Certificate,O=CA365,L=Beijing,ST=Beijing,C=CN

Not Before

12/05/2001, 08:40

Not After

05/05/2031, 08:40

Subject

CN=CA365 Free Root Certificate,O=CA365,L=Beijing,ST=Beijing,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:96:be:a0:29:e7:db:3e:3c:30:fe:d0:13:1b:56:3b:44:2c:ed:8c
Signer

Actual PE Digest

b6:96:be:a0:29:e7:db:3e:3c:30:fe:d0:13:1b:56:3b:44:2c:ed:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
GetLastError
GetFileTime
CreateFileA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersion
WinExec
WriteFile
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0ee50be9da81348b2200cc544c199dcf

Code Sign

7c:32:43:81:10:c7:43:c1Certificate

Extended Key Usages

Key Usages

24:e1:bd:38:4a:95:29:f8Certificate

Key Usages

b6:96:be:a0:29:e7:db:3e:3c:30:fe:d0:13:1b:56:3b:44:2c:ed:8cSigner

Headers

File Characteristics

Imports

kernel32

Sections

.data Size: 16KB - Virtual size: 15KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

7c:32:43:81:10:c7:43:c1
Certificate

24:e1:bd:38:4a:95:29:f8
Certificate

b6:96:be:a0:29:e7:db:3e:3c:30:fe:d0:13:1b:56:3b:44:2c:ed:8c
Signer

.data
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB