3906dcbb75eb4cf39fb7c04a8a512fd3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3906dcbb75eb4cf39fb7c04a8a512fd3_JaffaCakes118
Size

77KB
MD5

3906dcbb75eb4cf39fb7c04a8a512fd3
SHA1

ed311d3265e1c26d573deb8501527c690da7ee55
SHA256

970609737f201c813c12f89325b493bc5d128b03e793a6272bb44332ca17d3ee
SHA512

b0469826d55c584324af6488515d784820eb8e5b5182e028ff2ebb506c0e5732c0f6aa620782b6bf0ec577a1aafa01436fb9acfd8c54f8f3a02ab3764f470fd6
SSDEEP

1536:ap9EwpG7UD3HMa8uyX9cQdRHyX/S5n+DCEBanoGX:I9EzUDvfyX9cQdRi/S5BEBanl

Score

1^/10

Malware Config

Signatures

Files

3906dcbb75eb4cf39fb7c04a8a512fd3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e952e05892cad8ce9c9d7bee92ead1d4

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:ca:f3
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/01/2005, 23:22

Not After

10/02/2007, 16:18

Subject

CN=Integrated Search Technologies,OU=Secure Application Development,O=Integrated Search Technologies,L=Montreal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle

shlwapi

SHSetValueA
SHGetValueA
PathRemoveFileSpecA
PathFileExistsA
PathAppendA
SHDeleteKeyA
SHDeleteValueA

user32

GetWindowThreadProcessId
GetWindowTextA
FindWindowA
wsprintfA
PostMessageA
EnumWindows

msvcrt

_stricmp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
memcpy
_CxxThrowException
strchr
strncpy
strncmp
_mbscmp
_mbsicmp
strtok
??2@YAPAXI@Z
??3@YAXPAX@Z
strcmp
strcpy
strcat
strstr
sprintf
isspace
__CxxFrameHandler
strlen
memset
strrchr
_controlfp

mfc42

ord6059
ord6282
ord6283
ord2818
ord1187
ord5710
ord5683
ord4278
ord3790
ord3176
ord1567
ord858
ord941
ord939
ord356
ord354
ord2770
ord2781
ord4058
ord860
ord540
ord800
ord535
ord940
ord537
ord665
ord1979
ord6385
ord353
ord5207
ord268
ord389
ord2763
ord3181
ord668
ord1980
ord2393
ord5583

kernel32

GetLastError
GetStartupInfoA
GetModuleHandleA
lstrcpyA
lstrcatA
GetTempPathA
CreateFileA
WriteFile
CreateMutexA
Sleep
GetWindowsDirectoryA
DeleteFileA
SetErrorMode
LoadLibraryExA
RemoveDirectoryA
HeapAlloc
SetLastError
HeapFree
WideCharToMultiByte
OpenProcess
WaitForSingleObject
TerminateProcess
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress

advapi32

RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
SetNamedSecurityInfoA
RegEnumKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e952e05892cad8ce9c9d7bee92ead1d4

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

20:ca:f3Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

wininet

shlwapi

user32

msvcrt

mfc42

kernel32

advapi32

shell32

ole32

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 15KB

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

20:ca:f3
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 15KB