37040e4806063cb022c460fff18cc748_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

37040e4806063cb022c460fff18cc748_JaffaCakes118
Size

617KB
MD5

37040e4806063cb022c460fff18cc748
SHA1

a5e591d72faa1f73b01957f281b7310bf8680d53
SHA256

db20aef85c761ed9f74ddfc57fb2fd8ffb741c75a9ec8f56c4e40bad5d6c21c0
SHA512

749b2b60f72456bea411804badc00b2e4b40ddd042bae9dd2905bf00cabd6bc2703a9ad4153aeb5d22a2c0f9cb4ecccc8c8b4c62a097a5020bd2e8e4428eeffa
SSDEEP

3072:QsAOhFMusr4kMBHr066qvEWp7tJb88OJ8IGKCNJIWufG1mbmY/sv9jXBSKs2vpud:dsMBLPjv+6M8JIzrQVXBphvpugwYUH9

Score

1^/10

Malware Config

Signatures

Files

37040e4806063cb022c460fff18cc748_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c5162a3810a4ca48bac62589e61c1658

Code Sign

05:ab:96
Certificate

Issuer

OU=Equifax Secure Certificate Authority,O=Equifax,C=US

Not Before

01/02/2006, 21:44

Not After

30/01/2016, 21:44

Subject

CN=GeoTrust TrustCenter CodeSigning CA I,OU=GeoTrust TrustCenter CodeSigning CA,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d6:a9:00:01:00:20:17:4b:f3:e4:1e:4a:11:a9
Certificate

Issuer

CN=GeoTrust TrustCenter CodeSigning CA I,OU=GeoTrust TrustCenter CodeSigning CA,O=GeoTrust Inc,C=US

Not Before

24/03/2006, 16:52

Not After

24/03/2007, 16:52

Subject

CN=Mountain Systems,OU=Software+OU=GeoTrust Code Signing,O=Mountain Systems,L=Abingdon,ST=VA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

56:3a:e8:49:f4:fd:8b:28:b1:21:91:7e:af:d2:67:05:cf:35:28:32
Signer

Actual PE Digest

56:3a:e8:49:f4:fd:8b:28:b1:21:91:7e:af:d2:67:05:cf:35:28:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiOutPrepareHeader
midiInGetDevCapsA
midiInReset
midiInStart
midiInClose
midiInOpen
midiInGetNumDevs
midiInAddBuffer
midiInUnprepareHeader
midiInGetErrorTextA
midiInPrepareHeader
midiOutUnprepareHeader
midiOutLongMsg
midiOutOpen
midiOutGetNumDevs
midiOutGetDevCapsA
midiOutClose
midiOutShortMsg
midiOutGetErrorTextA

mfc42

ord5943
ord2621
ord1134
ord804
ord693
ord656
ord616
ord1871
ord3126
ord3613
ord350
ord2817
ord1200
ord823
ord772
ord812
ord500
ord559
ord2845
ord6142
ord2848
ord6144
ord5860
ord5862
ord2614
ord5606
ord5610
ord1567
ord268
ord4129
ord922
ord924
ord4277
ord6283
ord6282
ord4278
ord801
ord541
ord6883
ord5572
ord2915
ord2818
ord2859
ord6143
ord3701
ord4204
ord665
ord1979
ord5186
ord354
ord5442
ord6055
ord1776
ord5290
ord3742
ord3619
ord713
ord6141
ord414
ord3626
ord2414
ord4275
ord3573
ord755
ord2381
ord5875
ord5794
ord5789
ord6172
ord5787
ord1641
ord470
ord6458
ord2152
ord1233
ord5859
ord6880
ord6605
ord3089
ord5604
ord926
ord2763
ord816
ord2764
ord562
ord3797
ord6197
ord6379
ord6311
ord4171
ord5710
ord532
ord2820
ord6874
ord5981
ord5873
ord283
ord1105
ord561
ord3522
ord353
ord3698
ord2575
ord4396
ord3574
ord3402
ord3721
ord609
ord765
ord795
ord6199
ord2078
ord2108
ord2116
ord4284
ord2642
ord2574
ord3572
ord3571
ord3092
ord1146
ord3693
ord4133
ord4297
ord5788
ord3643
ord696
ord394
ord909
ord5628
ord4185
ord1949
ord1176
ord640
ord2450
ord4023
ord1640
ord323
ord3103
ord4076
ord4083
ord1803
ord2860
ord3138
ord613
ord5791
ord289
ord6571
ord3692
ord1264
ord6383
ord5440
ord472
ord3597
ord2086
ord6129
ord3920
ord5148
ord5768
ord4694
ord6128
ord3790
ord3811
ord6778
ord1247
ord6877
ord791
ord1995
ord2029
ord2077
ord523
ord5951
ord3095
ord1779
ord2302
ord6217
ord4148
ord3499
ord2515
ord355
ord4055
ord3177
ord2527
ord482
ord4476
ord2587
ord4406
ord3394
ord3729
ord4538
ord2582
ord4402
ord3370
ord3640
ord3719
ord3610
ord2114
ord2089
ord1576
ord798
ord1997
ord6407
ord5194
ord533
ord5465
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord5450
ord6394
ord2841
ord2107
ord2393
ord837
ord920
ord2919
ord3810
ord5207
ord1988
ord3638
ord690
ord389
ord2638
ord6467
ord1154
ord1737
ord676
ord3189
ord2782
ord2771
ord369
ord5922
ord3215
ord3173
ord5355
ord815
ord3738
ord4424
ord4622
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord567
ord1651
ord6215
ord2463
ord818
ord537
ord941
ord939
ord521
ord6307
ord858
ord413
ord711
ord3663
ord4673
ord1175
ord5280
ord6453
ord4160
ord5953
ord2379
ord3097
ord535
ord4317
ord6402
ord3521
ord3874
ord4299
ord4710
ord1168
ord2864
ord1768
ord2863
ord4234
ord825
ord324
ord540
ord860
ord641
ord800
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord1816
ord6403
ord793

msvcrt

_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_ftol
atoi
_strdup
_mbsupr
strncpy
sscanf
setlocale
_makepath
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
memmove
__getmainargs
_msize
vsprintf
_open
_errno
_close
_setmbcp
_initterm
__setusermatherr
__p__commode
_adjust_fdiv
__p__fmode
__set_app_type
realloc
__CxxFrameHandler
strcpy
abs
_mbscmp
strlen
_purecall
_CxxThrowException
free
memset
_splitpath
_mbsnbcpy
_except_handler3
sprintf
memcpy
strcat
strstr
time
malloc
_mkdir
_itoa
_controlfp

kernel32

GlobalFree
GlobalAlloc
GlobalMemoryStatus
GetSystemInfo
GetLocaleInfoA
GetTempPathA
DeleteFileA
GetTempFileNameA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleFileNameA
WinExec
GetTickCount
CopyFileA
GetTimeZoneInformation
GlobalUnlock
GlobalLock
GlobalHandle
GlobalReAlloc
GlobalSize
SetLastError
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
GetStartupInfoA
GetWindowsDirectoryA
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThread
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
LocalFree
FormatMessageA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
SetThreadPriority
GetThreadPriority
GetExitCodeThread
GetLastError
SetEvent
CreateEventA
WaitForSingleObject
CreateThread
TerminateThread
GetComputerNameA

user32

GetWindow
DrawTextA
FrameRect
GetDC
SetRect
UpdateWindow
GetWindowLongA
RedrawWindow
GetParent
CopyImage
DrawFocusRect
DrawStateA
TranslateMessage
InflateRect
SetWindowLongA
CallWindowProcA
SetRectEmpty
EqualRect
GetClassLongA
TabbedTextOutA
SetCapture
ReleaseCapture
LoadIconA
AppendMenuA
DrawIcon
SetCursorPos
DispatchMessageA
ShowWindow
ClientToScreen
WindowFromPoint
ChildWindowFromPointEx
OffsetRect
InvalidateRect
GetDlgCtrlID
LoadStringA
IsChild
PtInRect
CopyRect
LoadCursorA
SetFocus
GetCursorPos
GetClientRect
GetSysColor
FillRect
IsWindow
ReleaseDC
GetLastActivePopup
MessageBeep
EnableWindow
SendMessageA
ScreenToClient
KillTimer
CheckMenuItem
GetWindowRect
SetWindowPos
GetForegroundWindow
GetSystemMetrics
PostMessageA
GetSystemMenu
GetDesktopWindow
IsIconic
SystemParametersInfoA
GetDlgItem
GetCursor
SetCursor
PeekMessageA
SetTimer
SetForegroundWindow
DrawFrameControl

gdi32

StartDocA
CreateFontA
SelectObject
EndDoc
EndPage
StartPage
SetStretchBltMode
GetMapMode
SetDIBitsToDevice
StretchDIBits
CreatePalette
SelectPalette
RealizePalette
GetDCOrgEx
CreatePen
DeleteObject
GetStockObject
PatBlt
CreateFontIndirectA
GetObjectA
CreateSolidBrush
Rectangle
GetTextExtentPoint32A
Polygon
CreateICA
GetDeviceCaps
DeleteDC
GetTextMetricsA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ord8

msvcp60

?_Doraise@bad_alloc@std@@MBEXXZ
??_7bad_alloc@std@@6B@
??0bad_alloc@std@@QAE@ABV01@@Z

wsock32

WSACleanup
WSAStartup
gethostbyname
socket
WSASetLastError
ioctlsocket
htons
connect
send
recv
closesocket
select
gethostname
inet_addr

Sections

.text
Size: 196KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5162a3810a4ca48bac62589e61c1658

Code Sign

05:ab:96Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

d6:a9:00:01:00:20:17:4b:f3:e4:1e:4a:11:a9Certificate

Extended Key Usages

Key Usages

56:3a:e8:49:f4:fd:8b:28:b1:21:91:7e:af:d2:67:05:cf:35:28:32Signer

Headers

File Characteristics

Imports

winmm

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

msvcp60

wsock32

Sections

.text Size: 196KB - Virtual size: 192KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 36KB - Virtual size: 84KB

.rsrc Size: 328KB - Virtual size: 327KB

05:ab:96
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

d6:a9:00:01:00:20:17:4b:f3:e4:1e:4a:11:a9
Certificate

56:3a:e8:49:f4:fd:8b:28:b1:21:91:7e:af:d2:67:05:cf:35:28:32
Signer

.text
Size: 196KB - Virtual size: 192KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 36KB - Virtual size: 84KB

.rsrc
Size: 328KB - Virtual size: 327KB