38637c75165af1350c38f6fbcd8e7e6f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

38637c75165af1350c38f6fbcd8e7e6f_JaffaCakes118
Size

123KB
MD5

38637c75165af1350c38f6fbcd8e7e6f
SHA1

f8e6213caf1d944929d69ed29e94d2ce5f288cfe
SHA256

8acb9bd7b3ca515d4b75de7e1c31207111d4a04a37ce22e2328249d18297f1fb
SHA512

9e987eb3ba1607e45d8725adb3f79f2eb9074970fe639f15cabb35508955ad0232f792c0978b765ad6f252a9ac573a41b8ed43af6c04d25e8960291200c78e7c
SSDEEP

3072:W8xiZ9F5oXBFjPsDgEKteJXdYEfTEEa+gIaXY:DifFCPsUEKgJXdZfQEaHXY

Score

1^/10

Malware Config

Signatures

Files

38637c75165af1350c38f6fbcd8e7e6f_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

fec1bb6d197b4fe7cef9e1f3bcf38c07

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

Issuer

CN=Application Compatibility UI

Not Before

31/12/2008, 16:00

Not After

31/12/2014, 16:00

Subject

CN=Application Compatibility UI

Extended Key Usages

ExtKeyUsageCodeSigning

a9:8d:98:4b:d3:fe:ff:07:9d:1d:42:da:b8:b1:cb:68:31:6d:ba:92
Signer

Actual PE Digest

a9:8d:98:4b:d3:fe:ff:07:9d:1d:42:da:b8:b1:cb:68:31:6d:ba:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

GetPixel

wsock32

WSACleanup

wininet

InternetReadFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JSOff
JSOn

Sections

!
Size: - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

(
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

<
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

:
Size: - Virtual size: 193B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

<
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

;
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

4
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

!
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fec1bb6d197b4fe7cef9e1f3bcf38c07

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2Certificate

Extended Key Usages

a9:8d:98:4b:d3:fe:ff:07:9d:1d:42:da:b8:b1:cb:68:31:6d:ba:92Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

wsock32

wininet

Exports

Exports

Sections

! Size: - Virtual size: 125KB

. Size: - Virtual size: 2KB

( Size: - Virtual size: 5KB

< Size: - Virtual size: 3KB

: Size: - Virtual size: 193B

< Size: - Virtual size: 8KB

; Size: 512B - Virtual size: 4KB

1 Size: - Virtual size: 20KB

4 Size: 120KB - Virtual size: 119KB

! Size: 512B - Virtual size: 148B

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

a9:8d:98:4b:d3:fe:ff:07:9d:1d:42:da:b8:b1:cb:68:31:6d:ba:92
Signer

!
Size: - Virtual size: 125KB

.
Size: - Virtual size: 2KB

(
Size: - Virtual size: 5KB

<
Size: - Virtual size: 3KB

:
Size: - Virtual size: 193B

<
Size: - Virtual size: 8KB

;
Size: 512B - Virtual size: 4KB

1
Size: - Virtual size: 20KB

4
Size: 120KB - Virtual size: 119KB

!
Size: 512B - Virtual size: 148B