404158470c4d4af782678f0df290477e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

404158470c4d4af782678f0df290477e_JaffaCakes118
Size

267KB
MD5

404158470c4d4af782678f0df290477e
SHA1

6bc076c7e16eb6cba309918a30f72eec3ef12525
SHA256

9835c4a0a788ccea7ae12c55c5cf6d7d1bb1f47f8280594993345ac853b26585
SHA512

9c7ce8dab547903271a936492ab10f28707e263b675efd5f0a53b919caaa5c0511c0aaf4b6d7274bd68139a0384056e3da38899946d6fec74ac99e1baf9624dd
SSDEEP

6144:rdt/FvrZtJdQMSd+2JY7RAVHMQTgc9kG2rRuIUE+0WcjfLdXTJEs2:rr/tfQ+a+RAVsQEg2NvUEpWc/Ro

Score

1^/10

Malware Config

Signatures

Files

404158470c4d4af782678f0df290477e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4aa22a8839c2deb28afde193cf5ad4ee

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7e:1b:96:85:8d:71:ee:78:11:69:12:bc:31:80:70:2c
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/09/2009, 00:00

Not After

20/10/2011, 23:59

Subject

CN=CJSC Computing Forces,OU=IT,O=CJSC Computing Forces,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToSystemTime
IsBadStringPtrW
GetCurrentDirectoryW
lstrcatA
FatalAppExitA
GetTempFileNameW
GetLongPathNameW
GetFileAttributesW
GetSystemDefaultLCID
GetStartupInfoW
lstrcat
TlsAlloc
GetExitCodeProcess
LoadLibraryW
GetMailslotInfo
QueryPerformanceCounter
AddAtomA
EnumCalendarInfoW
GetWindowsDirectoryW
GetTempPathW
GetLastError
GetTimeFormatW
MultiByteToWideChar
GlobalGetAtomNameA
OpenWaitableTimerW
GetFileAttributesA
EnumTimeFormatsA
GetTickCount
WaitForSingleObject
GetLocalTime
CreateNamedPipeW
GetHandleInformation
ExitProcess
lstrcmp
Beep
GetLongPathNameA
FileTimeToLocalFileTime
GetStartupInfoA
GetVersionExA
SetUnhandledExceptionFilter
GetProcAddress
GetVolumeInformationA
ExpandEnvironmentStringsA
MoveFileA
BeginUpdateResourceW
CreateDirectoryW
GetUserDefaultLangID
GetThreadPriority
CreateMutexW
IsValidCodePage
RaiseException
ExpandEnvironmentStringsW
GetSystemInfo
GlobalAlloc
GlobalGetAtomNameW
IsValidLocale
GetDiskFreeSpaceA
GetCalendarInfoW
GetAtomNameW
SetCalendarInfoW
SystemTimeToFileTime
GetTimeFormatA
SetCurrentDirectoryW
GetSystemDirectoryW
OpenEventA
MulDiv
GetEnvironmentVariableW
GetModuleFileNameA
OpenSemaphoreA
CreateMutexA
GetSystemDirectoryA
lstrcmpiW
GetExpandedNameW
FreeLibrary
LocalFree
DosDateTimeToFileTime
ConnectNamedPipe
GetComputerNameA
GetModuleHandleW
IsBadReadPtr
LoadResource
LoadLibraryA
GetModuleFileNameW

user32

CreateDialogIndirectParamA
CreateDesktopW
DefWindowProcW
SetWindowTextW
SetActiveWindow
CreateWindowExA
GetAsyncKeyState
GetWindowRgn
RegisterWindowMessageA
SetTimer
EndDialog
InvalidateRgn
WinHelpA
CreateDialogIndirectParamW
DialogBoxIndirectParamW
GetCapture
SetCursor
GetActiveWindow
SendDlgItemMessageW
SetWindowPos
GetMenuStringW
RegisterClassA
MessageBoxIndirectW
SetCursorPos
LoadBitmapA
MessageBoxA
CreateDesktopA
CharPrevW
GetDlgItemInt
MoveWindow
GetIconInfo
LoadMenuA
SetForegroundWindow
GetMenuItemInfoW
keybd_event
CreateMenu
CharLowerA
CharPrevA
PostMessageW
GetClassInfoW
PostMessageA
wvsprintfA
EndMenu
GetDCEx
SetCapture
UnregisterClassA
GetMenuItemID
GetMenu
LoadIconA
LoadImageW
SetDlgItemTextA
WaitMessage
mouse_event
GetMenuState
RegisterClassExW
DestroyMenu
CreateWindowExW
GetMessageA
CheckMenuItem
InsertMenuA
GetMessageW
EnumClipboardFormats
InsertMenuItemW
CopyRect
EnableMenuItem
wvsprintfW
OpenClipboard
CreateDialogParamW
SetWindowTextA
RemoveMenu
RegisterClassExA
IsChild
CreateDialogParamA
MessageBoxIndirectA
MonitorFromWindow
GetSystemMetrics
GetFocus
GetSysColorBrush
SetWindowLongW
LoadBitmapW
ActivateKeyboardLayout
LoadMenuW
WaitForInputIdle
SendDlgItemMessageA
GetMenuItemInfoA
GetMenuStringA
GetScrollPos
IsWindow
IsIconic
SetDlgItemTextW
CreateAcceleratorTableW
GetClassInfoExW
SendMessageW
CreateAcceleratorTableA
LoadIconW
CreatePopupMenu
GetClassInfoExA
CharNextA
CopyIcon
EmptyClipboard
LoadMenuIndirectW

gdi32

GetEnhMetaFileA
GetTextExtentPointA
CreateBrushIndirect
AddFontResourceA
GetRasterizerCaps
GetEnhMetaFileW
CreateScalableFontResourceW
CreateCompatibleDC
CreateScalableFontResourceA
CreateRectRgn
SetWinMetaFileBits
CreateBitmap
CreateFontW
GetEnhMetaFilePixelFormat
SelectBrushLocal
CreateSolidBrush

advapi32

SystemFunction008
ImpersonateAnonymousToken
BackupEventLogA
TraceEvent
CryptVerifySignatureW

shell32

SHGetDiskFreeSpaceExA
SHGetDataFromIDListA
SHBrowseForFolderW
StrCmpNIW

comdlg32

GetFileTitleW
LoadAlterBitmap
FindTextW
GetSaveFileNameW
PageSetupDlgA
PrintDlgW
FindTextA

setupapi

SetupDiDrawMiniIcon
CM_Get_Device_ID_ExW
SetupPromptForDiskW
CM_Delete_Class_Key
CM_Add_Res_Des
SetupGetInfInformationW

ws2_32

listen
WSAEnumNetworkEvents
ioctlsocket
setsockopt
WSAEnumProtocolsW
gethostname

rasmontr

RutlFree
RutlDwordDup

wsock32

GetAcceptExSockaddrs
gethostbyaddr
connect
getnetbyname
GetNameByTypeW
dn_expand
sethostname
SetServiceW
WSAAsyncGetHostByName
WSASetBlockingHook
WSAAsyncGetProtoByNumber
ntohs
WSACancelAsyncRequest

crypt32

CertAddEncodedCRLToStore
I_CryptUninstallOssGlobal
CryptMsgControl
CertEnumCRLContextProperties

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 3KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4aa22a8839c2deb28afde193cf5ad4ee

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

7e:1b:96:85:8d:71:ee:78:11:69:12:bc:31:80:70:2cCertificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

comdlg32

setupapi

ws2_32

rasmontr

wsock32

crypt32

Sections

.text Size: 12KB - Virtual size: 12KB

.edata Size: 3KB - Virtual size: 37KB

.edata Size: 108KB - Virtual size: 107KB

.rdata Size: 7KB - Virtual size: 15KB

.data Size: 11KB - Virtual size: 152KB

.edata Size: 109KB - Virtual size: 108KB

.rsrc Size: 7KB - Virtual size: 7KB

.reloc Size: 1KB - Virtual size: 4KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

7e:1b:96:85:8d:71:ee:78:11:69:12:bc:31:80:70:2c
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

.text
Size: 12KB - Virtual size: 12KB

.edata
Size: 3KB - Virtual size: 37KB

.edata
Size: 108KB - Virtual size: 107KB

.rdata
Size: 7KB - Virtual size: 15KB

.data
Size: 11KB - Virtual size: 152KB

.edata
Size: 109KB - Virtual size: 108KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 1KB - Virtual size: 4KB