423e1daa059ed67b369c4f43f2164237_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

423e1daa059ed67b369c4f43f2164237_JaffaCakes118
Size

182KB
MD5

423e1daa059ed67b369c4f43f2164237
SHA1

b6f6f997646609bd791cf549226fca6f7db3d834
SHA256

c34f34c35c8bff201d8feb63450bcbf5706dfc35e26ab15b938b7e88a723c98b
SHA512

1cb2ee42153eebab29a64059e3baa5c0292f49397725626faf848558796fe12c7e5774e4bdd2d1c2433a89563b2d8f29ee94edc66aa5aa607df6f3d32b3700af
SSDEEP

3072:30pKIa76hv6Sv3Aqz4p3LEkKRtaQ72DhZVSo/yb:GKIa76hvLPAe4BLA772DhZVSo/yb

Score

1^/10

Malware Config

Signatures

Files

423e1daa059ed67b369c4f43f2164237_JaffaCakes118
.exe windows:4 windows x86 arch:x86

deb608f8f8deca2f45e3455f92849a9b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:16:55:db:73:1b:cd:9c:d5:db:c7:9c:ba:ac:3f:ec
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

14/01/2008, 00:00

Not After

23/01/2009, 23:59

Subject

CN=Even Balance\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Even Balance\, Inc.,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8e:72:77:85:87:ed:ec:3c:81:32:1e:d0:65:5b:64:48:8e:17:38:5c
Signer

Actual PE Digest

8e:72:77:85:87:ed:ec:3c:81:32:1e:d0:65:5b:64:48:8e:17:38:5c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToLocalFileTime
SystemTimeToFileTime
GetFileAttributesA
SetFileAttributesA
lstrcmpA
lstrcpyW
FileTimeToSystemTime
MultiByteToWideChar
FormatMessageA
lstrlenA
LocalAlloc
LocalFree
LoadLibraryA
GetProcAddress
DeviceIoControl
GetPriorityClass
GetCurrentThread
GetThreadPriority
CloseHandle
CreateFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
HeapSize
SetEndOfFile
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
InitializeCriticalSection
VirtualProtect
GetOEMCP
GetACP
GetTickCount
GetSystemDirectoryA
CopyFileA
Sleep
GetVersionExA
GetSystemInfo
GetCurrentProcess
GetLastError
FreeLibrary
GetCurrentProcessId
ExitProcess
HeapAlloc
HeapFree
RtlUnwind
DeleteFileA
GetSystemTimeAsFileTime
WideCharToMultiByte
GetModuleHandleA
GetCommandLineA
TlsAlloc
SetLastError
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
QueryPerformanceCounter
GetModuleFileNameA
LCMapStringA
LCMapStringW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
InterlockedExchange
VirtualQuery
WriteFile
FlushFileBuffers
GetTimeZoneInformation
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
GetCPInfo
GetLocaleInfoA
CreateDirectoryA

user32

wsprintfA

advapi32

OpenServiceA
RegQueryValueExA
RegOpenKeyExA
DeleteService
ControlService
CloseServiceHandle
OpenSCManagerA
StartServiceA
CreateServiceA
SetServiceStatus
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

SHGetFolderPathA

wsock32

inet_ntoa
recvfrom
inet_addr
closesocket
ioctlsocket
htons
sendto
socket
WSAStartup
bind
setsockopt
ntohs

wintrust

WinVerifyTrust

crypt32

CryptDecodeObject
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CertVerifyTimeValidity
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertGetNameStringA

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

XOR
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

deb608f8f8deca2f45e3455f92849a9b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

2e:16:55:db:73:1b:cd:9c:d5:db:c7:9c:ba:ac:3f:ecCertificate

Extended Key Usages

Key Usages

8e:72:77:85:87:ed:ec:3c:81:32:1e:d0:65:5b:64:48:8e:17:38:5cSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wsock32

wintrust

crypt32

Sections

.text Size: 84KB - Virtual size: 83KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 73KB - Virtual size: 73KB

XOR Size: 2KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

2e:16:55:db:73:1b:cd:9c:d5:db:c7:9c:ba:ac:3f:ec
Certificate

8e:72:77:85:87:ed:ec:3c:81:32:1e:d0:65:5b:64:48:8e:17:38:5c
Signer

.text
Size: 84KB - Virtual size: 83KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 73KB - Virtual size: 73KB

XOR
Size: 2KB - Virtual size: 2KB