3a241c739e7dfb4b01864b25cf111ddc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3a241c739e7dfb4b01864b25cf111ddc_JaffaCakes118
Size

702KB
MD5

3a241c739e7dfb4b01864b25cf111ddc
SHA1

cfa77d175d37f7ffc5c730bb4dee7596c269fd85
SHA256

dbe7befdeed258364e920d3b8f8e875defa7b67902768a72dcf24aed297220b0
SHA512

aec5104933ef05029006f3f88c50681b2ca40ed00b2fbc5bb1dcf9f013bad0f71b166acd92bc8c29c45b15283d1015c57c8691d0b9abd2f77b4aef1d8ae442c2
SSDEEP

12288:xqv7f6chryPLscuqBLAKpHB2IfIpbQYFo:/chryDXuspHB2IfIpEZ

Score

1^/10

Malware Config

Signatures

Files

3a241c739e7dfb4b01864b25cf111ddc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d837a42e8295dd60bc22c9e883fffe0b

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:94:e7:39:6a:31:10:5e:db:d1:c6:43:a4:60:e5:91
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

15/01/2007, 00:00

Not After

15/01/2008, 23:59

Subject

CN=Korg Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development Dept.,O=Korg Inc.,L=Inagi-City,ST=Tokyo,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Documents and Settings\nakajima\My Documents\src\KLC\LegacyWin\LegacyHost_Win32\Program\LEGACY\Program\v10\MainWnd_WaveStation\temp_Release\MainWnd_WaveStation.pdb

Imports

comctl32

ord17
CreatePropertySheetPageA
PropertySheetA
InitCommonControlsEx

winmm

timeEndPeriod
timeKillEvent
midiInReset
midiOutShortMsg
midiOutReset
midiOutClose
midiInGetNumDevs
midiInGetDevCapsA
midiOutGetNumDevs
midiOutGetDevCapsA
midiInAddBuffer
midiInPrepareHeader
midiOutOpen
midiInOpen
midiInClose
midiInUnprepareHeader
timeGetDevCaps
timeBeginPeriod
timeSetEvent
midiOutUnprepareHeader
midiOutPrepareHeader
midiOutLongMsg
timeGetTime
midiInStart

kernel32

GetModuleFileNameA
FreeLibrary
LoadLibraryA
GetProcAddress
GetLastError
FindClose
FindNextFileA
FindFirstFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
SetCurrentDirectoryA
GetCurrentDirectoryA
DeleteFileA
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
SetEvent
ReadFile
CreateFileA
SetFilePointer
GetFileSize
WriteFile
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
GetModuleHandleA
InterlockedExchange
Sleep
QueryPerformanceCounter
GlobalSize
GetSystemDefaultLangID
lstrlenA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetCurrentThreadId
GetTickCount
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapSize
HeapReAlloc
GetFileType
GetStdHandle
SetHandleCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetOEMCP
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetCommandLineA
GetStartupInfoA
IsBadReadPtr
HeapAlloc
HeapFree
TerminateProcess
ExitProcess
RtlUnwind
GetLocaleInfoA
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
RaiseException
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualProtect
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
IsBadCodePtr
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
SetEndOfFile
QueryPerformanceFrequency

user32

LoadCursorA
GetWindow
FillRect
GetMenuItemCount
DeleteMenu
AppendMenuA
CheckMenuItem
EnableMenuItem
GetSubMenu
PostQuitMessage
SendDlgItemMessageA
GetClassInfoA
RegisterClassA
UnregisterClassA
KillTimer
SetTimer
TranslateAcceleratorA
DestroyAcceleratorTable
CreateAcceleratorTableA
GetDesktopWindow
GetWindowLongA
SystemParametersInfoA
DefWindowProcA
CallWindowProcA
CreateWindowExA
GetSystemMetrics
LoadMenuA
GetMenu
SetMenu
DestroyMenu
LoadStringA
MessageBoxA
SendMessageA
LoadIconA
GetSysColor
GetDlgItem
ReleaseDC
GetDC
GetClientRect
ScreenToClient
GetParent
GetWindowRect
DialogBoxParamA
EndDialog
GetClassLongA
EnableWindow
DestroyWindow
ShowWindow
UpdateWindow
InvalidateRect
SetWindowPos
MoveWindow
PostMessageA
GetMessageA
TranslateMessage
PeekMessageA
DispatchMessageA
WaitMessage
SetWindowLongA

gdi32

DeleteObject
CreateRectRgn
CreateSolidBrush
CreateHatchBrush
GetStockObject
CreateFontIndirectA
GetTextFaceA
EnumFontFamiliesA
GetDeviceCaps
SelectObject

comdlg32

GetOpenFileNameA
GetSaveFileNameA

shell32

SHGetSpecialFolderPathA
SHGetDesktopFolder

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream
CoUninitialize
CoInitialize

Sections

.text
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d837a42e8295dd60bc22c9e883fffe0b

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

11:94:e7:39:6a:31:10:5e:db:d1:c6:43:a4:60:e5:91Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

winmm

kernel32

user32

gdi32

comdlg32

shell32

ole32

Sections

.text Size: 220KB - Virtual size: 219KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 12KB - Virtual size: 194KB

.rsrc Size: 272KB - Virtual size: 270KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

11:94:e7:39:6a:31:10:5e:db:d1:c6:43:a4:60:e5:91
Certificate

.text
Size: 220KB - Virtual size: 219KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 12KB - Virtual size: 194KB

.rsrc
Size: 272KB - Virtual size: 270KB