3f9688a9a6858d83ae238d88358f4333_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3f9688a9a6858d83ae238d88358f4333_JaffaCakes118
Size

113KB
MD5

3f9688a9a6858d83ae238d88358f4333
SHA1

d78d3ff8f07026869955588065754168a11ca201
SHA256

6631d1de3970c538864c2d92bf7f45ebced5a854cee4657b10d1168da13c773a
SHA512

76da746eeba3e0da8d775261d278cd425780e4926cd6dbe1808d6bfc911d7a4e8acf2315905f3d985e24b2928355f3913c5814b7dd6f8a48a05d089982d9d3ab
SSDEEP

3072:uAea9u+6xDPdTaTadGMwlm0lSyAtlmyZECK:Pu+opK9tgTyalmNCK

Score

1^/10

Malware Config

Signatures

Files

3f9688a9a6858d83ae238d88358f4333_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

e0d500202eb1dde5226a9177a1cdf11d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:4c:af:a8:85:be:9f:2e:d9:48:57:59:df:05:fe:9b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

30-03-2009 00:00

Not After

30-03-2010 23:59

Subject

CN=Beijing ZhongQian WangRun Infomation Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Research,O=Beijing ZhongQian WangRun Infomation Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:95:6b:d4:90:53:a8:1f:f8:31:39:4c:5b:33:d8:db:fb:3e:7d:47
Signer

Actual PE Digest

c3:95:6b:d4:90:53:a8:1f:f8:31:39:4c:5b:33:d8:db:fb:3e:7d:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord6467
ord1116
ord1131
ord1575
ord1168
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord2725
ord3953
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord4274
ord823
ord825
ord1176

msvcrt

rename
_stat
_filelength
_onexit
__dllonexit
?terminate@@YAXXZ
memcmp
fgets
_mbschr
_mbsnbcpy
_snprintf
atol
ftell
strstr
_purecall
fread
_atoi64
atoi
fopen
fwrite
fclose
free
_initterm
malloc
_adjust_fdiv
??1type_info@@UAE@XZ
_except_handler3
_access
fflush
fseek
strncpy
_beginthreadex
_mbsstr
_mbslwr
strchr
__CxxFrameHandler
_EH_prolog
time
memcpy
wcslen
memset
strlen
sprintf
remove
strcpy
strcat
calloc
_strnicmp
_stricmp
_CxxThrowException
_beginthread

kernel32

InitializeCriticalSection
DeleteCriticalSection
lstrcmpA
lstrcpyA
GetModuleFileNameA
CreateEventA
LeaveCriticalSection
EnterCriticalSection
Sleep
SetEvent
WaitForSingleObject
InterlockedIncrement
lstrlenW
GetLastError
OutputDebugStringA
LocalFree
LocalAlloc
InterlockedDecrement
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcess
FlushInstructionCache
VirtualProtect
SetLastError
WideCharToMultiByte

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegCreateKeyA
RegOpenKeyA
RegDeleteKeyA
RegQueryValueExA

shell32

StrStrIA

oleaut32

SysStringLen
LoadRegTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VariantChangeType
VariantClear

atl

ord21
ord15
ord23
ord31
ord18
ord57
ord32
ord58
ord30
ord16

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1_Winit@std@@QAE@XZ

netapi32

Netbios

wininet

InternetCloseHandle
InternetSetFilePointer
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile

ws2_32

recv
WSAStartup
send
WSAGetLastError
closesocket
connect
setsockopt
inet_addr
htons
socket
inet_ntoa
gethostbyname
WSACleanup

Exports

Exports

?MD5Default@@YAXPBDIPAE@Z
?MD5Segment@@YAXPBDIPAEI@Z
?MD5String@@YAXPBDPAEI@Z
?construct@nsISecCompress@@YAPAVISecCompress@@XZ
?destruct@nsISecCompress@@YAXAAPAVISecCompress@@@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e0d500202eb1dde5226a9177a1cdf11d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

5e:4c:af:a8:85:be:9f:2e:d9:48:57:59:df:05:fe:9bCertificate

Extended Key Usages

Key Usages

c3:95:6b:d4:90:53:a8:1f:f8:31:39:4c:5b:33:d8:db:fb:3e:7d:47Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

advapi32

shell32

oleaut32

atl

msvcp60

netapi32

wininet

ws2_32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

5e:4c:af:a8:85:be:9f:2e:d9:48:57:59:df:05:fe:9b
Certificate

c3:95:6b:d4:90:53:a8:1f:f8:31:39:4c:5b:33:d8:db:fb:3e:7d:47
Signer

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 4KB