Static task
static1
Behavioral task
behavioral1
Sample
3aff33797fa0b877122472710f7779d5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3aff33797fa0b877122472710f7779d5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
3aff33797fa0b877122472710f7779d5_JaffaCakes118
-
Size
530KB
-
MD5
3aff33797fa0b877122472710f7779d5
-
SHA1
80c0469a52fa8dbe24f82a1c7657c1d618d0228a
-
SHA256
d7696556dd735a475afc5ed2d344ab38e062c998a39860c33021eb38080a096c
-
SHA512
c0c65a22e2b6bee38fd40e06140c1dc90e0f20dfd795706512bbc986b263c77f2cf9fcd5b647524f594bba5e9b3ac7fa38df15efd3ad1ae4140c802a73710369
-
SSDEEP
12288:W4uEbN6OMCVmhqhI5mz6kK1KZcqN+Cj5olTo:WFCVm0m5mzgQiaXolTo
Malware Config
Signatures
Files
-
3aff33797fa0b877122472710f7779d5_JaffaCakes118.exe windows:4 windows x86 arch:x86
21607682c19f7802c7d98afd746dbe9e
Code Sign
01Certificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before01/08/1996, 00:00Not After31/12/2020, 23:59SubjectCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d0aCertificate
IssuerCN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6dNot Before06/08/2003, 00:00Not After05/08/2013, 23:59SubjectCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZAExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
07:7d:be:20:da:cd:0e:78:96:eb:7c:5a:ef:88:35:d7Certificate
IssuerCN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZANot Before19/11/2008, 00:00Not After19/11/2010, 23:59SubjectCN=Seekapp.com,OU=Secure Application Development,O=Seekapp.com,L=El Segundo,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\Develop\Firstlook\vclient\branches\Stable_branch_2008-02-28\src\carrier\Release\carrier.pdb
Imports
shlwapi
wnsprintfA
PathGetArgsA
PathStripPathA
PathAppendA
kernel32
GetTempFileNameA
lstrcpynA
lstrcpyA
lstrcmpA
lstrcatA
CloseHandle
CreateDirectoryA
CreateProcessA
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
LoadResource
LockResource
OpenProcess
Process32First
Process32Next
RemoveDirectoryA
SizeofResource
Sleep
WaitForSingleObject
_lclose
_lcreat
_lwrite
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 520KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ