4061ae55a44e93baa0602bfdf2d1673d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4061ae55a44e93baa0602bfdf2d1673d_JaffaCakes118
Size

706KB
MD5

4061ae55a44e93baa0602bfdf2d1673d
SHA1

02edcf6e98710843aa0400940a0b2bb00a36196a
SHA256

07ca005d8c0316763c557bd61e40dfd9fd087f8a87e90863a624eae90b41a875
SHA512

9df249ee67f8b34306ec07b96451916a028108baeb9381876c55f67d9dcff7b249ad3d765a94e1b10ef6d3187ae11849decbd9b477090c9df7974496873f55e3
SSDEEP

3072:/z71wwEbS2bWkhJUZZDqQq8x3bQOJPmU0qq+BbbMCb:2bSYBJex3bQOxmUnqAMCb

Score

1^/10

Malware Config

Signatures

Files

4061ae55a44e93baa0602bfdf2d1673d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f849ba5e77c1aebdaebe4432106f7e9f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:eb:fb:cf:c7:97:0c:88:7c:b0:51:0a:a4:23:a6:04
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

17/02/2010, 00:00

Not After

05/03/2012, 23:59

Subject

CN=AVG Technologies,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AVG Technologies,L=Brno,ST=Jihomoravsky kraj,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:8c:15:ef:91:d2:65:56:b7:df:4b:cb:2e:eb:13:1b:20:1c:8c:f1
Signer

Actual PE Digest

0b:8c:15:ef:91:d2:65:56:b7:df:4b:cb:2e:eb:13:1b:20:1c:8c:f1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\nightly\sandbox_avg9_vc8_avg90_sp3\source\avg8\Release_Unicode_vs80\Win32\avgcsrvx.pdb

Imports

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
swprintf_s
_set_invalid_parameter_handler
_invoke_watson
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
sqrt
srand
rand
_vsnwprintf_s
towupper
iswspace
_wcsupr_s
iswalnum
wcslen
towlower
_wcslwr_s
iswcntrl
iswprint
iswalpha
iswlower
iswdigit
iswpunct
_vsnprintf_s
iswupper
_errno
malloc
free
wcsncmp
_wputenv_s
_wgetenv_s
_beginthreadex
memcmp
strlen
isspace
wcsftime
strncmp
isdigit
??2@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler3
??3@YAXPAX@Z
_purecall
memset
fputs
__iob_func
memmove
memcpy
strerror
strchr
strncpy
realloc
memchr
abort
vfprintf
strcmp
qsort
getenv
_time64
isalnum
strtol
_lrotl
fprintf
isxdigit
_CxxThrowException
_except_handler3

kernel32

GetModuleHandleA
GetSystemInfo
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
DuplicateHandle
CreateProcessW
SetUnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
LockFileEx
CancelIo
GetOverlappedResult
SetFilePointer
SetEndOfFile
WideCharToMultiByte
GetSystemDefaultLCID
MultiByteToWideChar
GetACP
CompareStringW
MoveFileW
GetLongPathNameW
GetCurrentDirectoryW
CreateDirectoryW
GetTempPathW
MoveFileExW
GetFileTime
FindNextFileW
GetFileAttributesW
FindFirstFileW
CopyFileW
RemoveDirectoryW
SetCurrentDirectoryW
FindClose
SetFileAttributesW
GetComputerNameExW
GetThreadPriority
GetSystemDirectoryW
OpenProcess
GetPriorityClass
SetPriorityClass
SetProcessWorkingSetSize
GetCurrentProcessId
GlobalMemoryStatusEx
GetModuleFileNameW
GetWindowsDirectoryW
ProcessIdToSessionId
GetCommandLineW
OpenThread
GetComputerNameW
GetCurrentThreadId
GetVersionExW
FlushFileBuffers
DisconnectNamedPipe
ReadFile
SetNamedPipeHandleState
WriteFile
WaitNamedPipeW
CreateNamedPipeW
ConnectNamedPipe
CreateEventW
ResetEvent
WaitForMultipleObjects
GetLastError
SetLastError
WaitForSingleObject
CloseHandle
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
FreeLibrary
LoadLibraryW
GetProcAddress
ReleaseMutex
CreateMutexW
LocalAlloc
LocalFree
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
Sleep
SystemTimeToFileTime
FileTimeToSystemTime
GetCurrentProcess
LoadLibraryA
CreateFileW
DeleteFileW
SetEvent
GetModuleHandleW
LoadLibraryExW
ResumeThread
TerminateThread
SetThreadPriority
GetExitCodeThread
OpenMutexW

advapi32

RevertToSelf
ImpersonateNamedPipeClient

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 546KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f849ba5e77c1aebdaebe4432106f7e9f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

20:eb:fb:cf:c7:97:0c:88:7c:b0:51:0a:a4:23:a6:04Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

0b:8c:15:ef:91:d2:65:56:b7:df:4b:cb:2e:eb:13:1b:20:1c:8c:f1Signer

Headers

File Characteristics

PDB Paths

Imports

msvcr80

kernel32

advapi32

Exports

Exports

Sections

.text Size: 546KB - Virtual size: 546KB

.rdata Size: 115KB - Virtual size: 114KB

.data Size: 36KB - Virtual size: 45KB

.rsrc Size: 2KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

20:eb:fb:cf:c7:97:0c:88:7c:b0:51:0a:a4:23:a6:04
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

0b:8c:15:ef:91:d2:65:56:b7:df:4b:cb:2e:eb:13:1b:20:1c:8c:f1
Signer

.text
Size: 546KB - Virtual size: 546KB

.rdata
Size: 115KB - Virtual size: 114KB

.data
Size: 36KB - Virtual size: 45KB

.rsrc
Size: 2KB - Virtual size: 1KB