3d3a8e28b72e778f114123b6612838bb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3d3a8e28b72e778f114123b6612838bb_JaffaCakes118
Size

2.3MB
MD5

3d3a8e28b72e778f114123b6612838bb
SHA1

4c35f7a452d6aa277c198ee59a502a13b3e59562
SHA256

d5dae4be0e392c121e25078c4e42f6da04fe84b18e9bed65c835e918735ab0c0
SHA512

7a8ecb0ebeaf9d432ed9a7f922b44dbb91cb396404dcf151e4df3191c12a50cb8684210b1b443ea3d7a172ea1961edbe9e18c0437442019e71bb511bd76cd2ee
SSDEEP

24576:3F6UxJvZX3Bl5iwuJNLyxE5qyh/QhaQ0kpWhIlH2nh0n6A8L1PLjpq6uV5PDwouc:BxJF8wub2VyAWpasAsnAsRMV

Score

1^/10

Malware Config

Signatures

Files

3d3a8e28b72e778f114123b6612838bb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

54280cdeea915699b6079b9b5116e941

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:f9:7d:44:f4:ba:b2:4c:73:f8:b7:31:73:69:d7:c1
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

14/05/2009, 00:00

Not After

11/05/2011, 23:59

Subject

CN=SuperAdBlocker.com,OU=SECURE APPLICATION DEVELOPMENT,O=SuperAdBlocker.com,L=Eugene,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Program Files\Microsoft Visual Studio\MyProjects\Nick Skrepetos Projects\SUPERAntiSpyware\Release\SUPERAntiSpyware.pdb

Imports

kernel32

GetFileSize
SetFilePointer
DeleteFileA
DeleteFileW
CopyFileA
CopyFileW
CreateDirectoryA
CreateDirectoryW
GetFileAttributesA
GetFileAttributesW
SetFileAttributesA
SetFileAttributesW
MoveFileExA
MoveFileExW
GetFileTime
GetShortPathNameA
GetShortPathNameW
GetOverlappedResult
RemoveDirectoryA
RemoveDirectoryW
BackupRead
BackupSeek
CreateEventA
CreateEventW
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Toolhelp32ReadProcessMemory
Module32First
Module32FirstW
Module32Next
Module32NextW
Process32First
Process32FirstW
Process32Next
Process32NextW
lstrlenW
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
TlsAlloc
SetNamedPipeHandleState
WaitNamedPipeA
GetSystemTime
SetLastError
TlsSetValue
TlsGetValue
GetWindowsDirectoryA
ExpandEnvironmentStringsA
SearchPathA
GetSystemDirectoryA
QueryPerformanceCounter
lstrcpynA
QueryPerformanceFrequency
VirtualFree
VirtualProtect
VirtualAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsFree
OutputDebugStringA
WaitForSingleObject
FileTimeToSystemTime
FileTimeToLocalFileTime
DosDateTimeToFileTime
GetDiskFreeSpaceExA
MoveFileA
GetTempFileNameA
GetTempPathA
SetEndOfFile
SetFileTime
IsBadReadPtr
GetVolumeInformationA
GetModuleHandleA
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
VirtualQuery
GetDiskFreeSpaceA
GetDriveTypeA
GetCommandLineA
MulDiv
SetProcessAffinityMask
GetProcessAffinityMask
CreateThread
SystemTimeToFileTime
InterlockedIncrement
InterlockedDecrement
AreFileApisANSI
FindNextFileA
UnlockFile
LockFile
LoadLibraryW
FindClose
LockFileEx
GetTempPathW
FormatMessageA
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceW
ResetEvent
GlobalMemoryStatus
OpenEventA
SetUnhandledExceptionFilter
GetSystemDefaultLangID
GetComputerNameA
VerLanguageNameA
CompareFileTime
SetEvent
GetLogicalDriveStringsA
CallNamedPipeA
GetLocaleInfoA
LocalFileTimeToFileTime
GetCurrentDirectoryA
GetFileInformationByHandle
FindFirstFileW
FindFirstFileA
VirtualLock
FindResourceA
LoadResource
LockResource
FreeResource
VirtualUnlock
SetCurrentDirectoryA
SetVolumeLabelA
CreateProcessA
IsBadStringPtrA
FileTimeToDosDateTime
GlobalSize
GlobalReAlloc
IsDBCSLeadByte
lstrcmpA
GlobalLock
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalFree
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetStdHandle
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoA
HeapReAlloc
RtlUnwind
RaiseException
InterlockedExchange
LocalFree
LocalAlloc
WriteFile
ReadFile
CreateFileW
lstrlenA
GetModuleFileNameA
GetTickCount
GetSystemTimeAsFileTime
FindNextFileW
Sleep
LoadLibraryA
GetVersionExA
HeapAlloc
CloseHandle
FreeLibrary
GetLocalTime
lstrcpyA
HeapFree
GetProcAddress
GetCurrentProcessId
DeviceIoControl
GetLastError
CreateFileA
GetCurrentProcess
lstrcmpiA
HeapCreate
GetCurrentThreadId
HeapDestroy
lstrcatA
FlushFileBuffers

user32

GetClientRect
CreateWindowExA
GetWindowRect
SendMessageA
CharUpperBuffA
CharPrevA
CharNextA
OemToCharA
CharUpperA
GetActiveWindow
GetWindowThreadProcessId
WaitForInputIdle
CharLowerA
OemToCharBuffA
CharToOemA
ShowWindow
DestroyWindow
FillRect
GetSysColor
SetWindowsHookExA
DestroyAcceleratorTable
IsDialogMessageA
TranslateAcceleratorA
GetNextDlgTabItem
GetMessageA
LoadAcceleratorsA
GetAsyncKeyState
FindWindowA
EnableWindow
SendMessageTimeoutA
SetWindowTextA
FindWindowExA
SetActiveWindow
BringWindowToTop
GetForegroundWindow
IsIconic
SendDlgItemMessageA
IsWindowVisible
IsWindow
GetDlgItem
DrawIconEx
FrameRect
CreateDialogParamA
PostMessageA
GetSystemMetrics
ExitWindowsEx
wsprintfA
DispatchMessageA
PostQuitMessage
GetMenuItemCount
GetMenuItemInfoA
GetMenuStringA
SetMenuItemInfoA
LoadMenuA
TranslateMessage
PeekMessageA
MessageBoxA
LoadImageA
MoveWindow
ScreenToClient
EndPaint
DrawTextA
DrawEdge
BeginPaint
CallWindowProcA
SetCursor
LoadCursorA
GetWindowTextA
GetWindowLongA
GetSubMenu
CheckMenuItem
DeleteMenu
TrackPopupMenu
DestroyMenu
CallNextHookEx
SetDlgItemInt
EnumWindows
RegisterWindowMessageA
GetCursorPos
GetDesktopWindow
SetRect
GetClassInfoA
LoadIconA
CopyRect
SystemParametersInfoA
GetDC
ReleaseDC
RegisterClassA
InvalidateRect
UpdateWindow
DefWindowProcA
CheckDlgButton
IsDlgButtonChecked
KillTimer
SetTimer
DialogBoxParamA
EndDialog
LoadStringA
SetFocus
GetDlgItemTextA
SetDlgItemTextA
GetParent
SetForegroundWindow
SetWindowPos
EnumChildWindows
GetClassNameA
SetWindowLongA
GetFocus

gdi32

SelectObject
SetBkMode
DeleteDC
BitBlt
GetObjectA
CreateCompatibleDC
SetTextColor
CreateSolidBrush
SetBkColor
GetTextExtentPoint32A
GetStockObject
DeleteObject
SetGraphicsMode
ModifyWorldTransform
SetViewportOrgEx
SetWindowOrgEx
GetDeviceCaps
GetBkColor
ExtTextOutA
CreateFontIndirectA

shell32

SHBrowseForFolderA
Shell_NotifyIconA
ShellExecuteA
ShellExecuteExA
SHFileOperationA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

ole32

StgCreateDocfile
StgCreateStorageEx
StgIsStorageFile
OleUninitialize
CoTaskMemFree
StgOpenStorage
StgOpenStorageEx
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
OleInitialize
CoInitialize
CoUninitialize
CoCreateInstance
CoCreateGuid
StringFromGUID2

oleaut32

SysAllocString
VariantInit
VariantChangeType
VariantCopy
VariantClear
SysAllocStringLen
VarBstrCat
SysFreeString
SysStringByteLen
SysStringLen

shlwapi

StrStrA
PathRemoveExtensionA
PathFindExtensionA
PathFindNextComponentA
PathGetDriveNumberA
PathRemoveBackslashA
StrChrA
PathRemoveBlanksA
PathQuoteSpacesA
PathGetArgsA
PathRemoveArgsA
PathUnquoteSpacesA
StrStrIA
StrCmpNIA
StrCpyW
PathFindFileNameA
PathAppendA
SHCopyKeyW
SHCopyKeyA
SHDeleteValueW
SHDeleteValueA
SHDeleteKeyW
SHDeleteKeyA
SHSetValueW
SHSetValueA
PathStripToRootA
PathIsFileSpecA
PathIsNetworkPathA
UrlUnescapeA
StrCmpNA
PathAddExtensionA
PathSetDlgItemPathA
StrRChrA
PathAddBackslashA
PathRemoveFileSpecA
PathFileExistsA
PathFileExistsW
PathIsDirectoryA
PathIsDirectoryW
SHGetValueA
SHGetValueW

winmm

PlaySoundA
timeGetTime

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA

comctl32

InitCommonControlsEx
ImageList_Create
ImageList_ReplaceIcon
PropertySheetA
CreatePropertySheetPageA

wininet

InternetOpenUrlA
InternetReadFile
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntry
InternetCrackUrlA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetGetCookieA

ws2_32

WSCInstallProvider

comdlg32

GetSaveFileNameA

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 858KB - Virtual size: 858KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54280cdeea915699b6079b9b5116e941

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:f9:7d:44:f4:ba:b2:4c:73:f8:b7:31:73:69:d7:c1Certificate

Extended Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

winmm

iphlpapi

version

comctl32

wininet

ws2_32

comdlg32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 198KB - Virtual size: 197KB

.data Size: 42KB - Virtual size: 348KB

.rsrc Size: 858KB - Virtual size: 858KB

01
Certificate

0a
Certificate

47:f9:7d:44:f4:ba:b2:4c:73:f8:b7:31:73:69:d7:c1
Certificate

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 198KB - Virtual size: 197KB

.data
Size: 42KB - Virtual size: 348KB

.rsrc
Size: 858KB - Virtual size: 858KB