42834e94990f22f8d6f57d1b8ae6ec6b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

42834e94990f22f8d6f57d1b8ae6ec6b_JaffaCakes118
Size

508KB
MD5

42834e94990f22f8d6f57d1b8ae6ec6b
SHA1

5c52f7dd578e7bd922e345785b51dd54d814ebec
SHA256

2f9ac98c8a67580425366026afd955d1cb0a9abcc570ae24938339a806976283
SHA512

5c38c4c99337d748a0233e96bb7d6f35886bc2466db6cdc67e0c43198e37872fd493bee05f0137fb487747f08dcc21d1cdd8bbb62d5f65f06ef5a8af2ee60005
SSDEEP

12288:2iRiUjOxgg+M9krMYAmIwzTffnRE4FV1A:Dib+pmGTHRE4FV1A

Score

1^/10

Malware Config

Signatures

Files

42834e94990f22f8d6f57d1b8ae6ec6b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0ba35477b2f272b7988edfb084c55fa

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:c0:ef:6b:ed:03:1e:e3:34:c6:09:ae:d6:dd:60:82
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/02/2009, 00:00

Not After

11/02/2011, 23:59

Subject

CN=FAVORIT NETWORK S.L.,OU=Secure Application Development,O=FAVORIT NETWORK S.L.,L=BARCELONA,ST=BARCELONA,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

da:6c:d4:b4:4d:97:30:a9:2c:8c:e3:e9:c8:57:f9:58:5c:86:88:d7
Signer

Actual PE Digest

da:6c:d4:b4:4d:97:30:a9:2c:8c:e3:e9:c8:57:f9:58:5c:86:88:d7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetReadFile
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
InternetConnectA
InternetSetStatusCallback
InternetOpenA
HttpQueryInfoA
HttpOpenRequestA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

SetEvent
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTempPathA
OpenFileMappingA
SetCurrentDirectoryA
FindClose
FindFirstFileA
CopyFileA
CopyFileW
CreateFileW
DeleteFileW
MoveFileA
MoveFileW
FindFirstFileW
lstrcatW
GetTempPathW
LoadLibraryExA
lstrcpynA
SetThreadAffinityMask
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
SetFilePointer
GetStartupInfoA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
lstrlenA
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
DeleteFileA
GetLastError
GetTickCount
GlobalFree
GetWindowsDirectoryA
CloseHandle
ReadFile
GlobalAlloc
GetFileSize
CreateFileA
LocalFree
GlobalUnlock
GlobalLock
MulDiv
WriteFile
CreateThread
GetModuleHandleA
lstrcmpA
WaitForSingleObject
ResumeThread
SystemTimeToTzSpecificLocalTime
GetModuleFileNameA
GetUserDefaultLangID
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
WideCharToMultiByte
GetFileAttributesExA

mfc42

ord4710
ord860
ord823
ord537
ord861
ord941
ord4202
ord2818
ord6449
ord3571
ord640
ord323
ord1641
ord2414
ord3626
ord3663
ord1146
ord1640
ord5785
ord2859
ord2864
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord6172
ord5873
ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord5787
ord858
ord926
ord1228
ord2614
ord665
ord2393
ord6385
ord1979
ord5186
ord354
ord6055
ord1776
ord4424
ord3610
ord656
ord2089
ord4275
ord5290
ord2452
ord283
ord3573
ord2379
ord5953
ord567
ord5572
ord2915
ord924
ord535
ord4400
ord3630
ord682
ord755
ord2381
ord5875
ord5788
ord472
ord470
ord3693
ord2580
ord2582
ord4402
ord3640
ord686
ord693
ord384
ord6242
ord2100
ord4243
ord3754
ord6197
ord6215
ord3753
ord3797
ord3138
ord5148
ord4234
ord3996
ord3370
ord2096
ord1168
ord2862
ord1642
ord3293
ord5981
ord3742
ord818
ord6453
ord6379
ord3874
ord4287
ord1270
ord1232
ord3619
ord3721
ord795
ord2116
ord4133
ord4297
ord2152
ord4129
ord5683
ord5710
ord1949
ord501
ord773
ord1083
ord5607
ord2762
ord5442
ord5600
ord2919
ord4277
ord939
ord922
ord539
ord2135
ord4034
ord433
ord4033
ord4160
ord4278
ord6283
ord4204
ord5856
ord940
ord609
ord2302
ord6199
ord2575
ord4396
ord3574
ord4226
ord1948
ord825
ord3346
ord5300
ord5303
ord2726
ord4079
ord4699
ord5307
ord5289
ord5715
ord4622
ord817
ord565
ord1233
ord1768
ord5791
ord3318
ord3692
ord3706
ord4673
ord4274
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord5302
ord2725
ord4698
ord5714
ord3738
ord561
ord815
ord2621
ord1134
ord2645
ord1200
ord1106
ord6378
ord6380
ord3286
ord798
ord1997
ord5465
ord5194
ord533
ord4284
ord5575
ord6007
ord3998
ord4299
ord2688
ord2438
ord6270
ord4220
ord2584
ord3654
ord1644
ord1105
ord1795
ord2078
ord2860
ord324
ord540
ord641
ord800
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord2514
ord4998
ord4853
ord4376
ord5265
ord4694
ord1576
ord3402
ord2396

msvcrt

__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_purecall
strtoul
wcscat
_mbsinc
_ismbcspace
memmove
_mbsstr
malloc
strchr
strtok
strncpy
abs
free
realloc
_CxxThrowException
_ftol
strcmp
strlen
strcpy
strcat
fopen
fwrite
fclose
memcpy
strstr
memset
wcslen
_mbscmp
_mbsicmp
atof
atol
atoi
__CxxFrameHandler
_itoa
_stricmp
_iob
fprintf
_setmbcp
_initterm

user32

GetClassInfoA
DefWindowProcA
GetScrollBarInfo
FillRect
LoadIconA
GetFocus
SetWindowRgn
GetSystemMetrics
LoadCursorA
SetCapture
GetClientRect
ReleaseCapture
PtInRect
GetParent
InvalidateRect
GetWindowDC
SendMessageA
FrameRect
OffsetRect
PostMessageA
IsWindow
MessageBoxA
GrayStringA
DrawTextA
TabbedTextOutA
IsWindowVisible
ChildWindowFromPoint
GetDC
ReleaseDC
EnableWindow
ScreenToClient
GetIconInfo
CreateIconIndirect
DestroyIcon
CopyIcon
GetSysColor
DestroyCursor
LoadImageA
SetCursor
AttachThreadInput
PostThreadMessageA
KillTimer
SetTimer
DrawIcon
IsIconic
ShowCursor
ShowWindow
SetForegroundWindow
GetCursorPos
CreatePopupMenu
AppendMenuA
GetWindowRect

gdi32

TextOutA
RectVisible
PtVisible
BitBlt
GetDeviceCaps
GetObjectA
GetStockObject
RealizePalette
CreateCompatibleDC
CreateDIBSection
ExtTextOutA
CreateFontA
RemoveFontResourceA
AddFontResourceA
ExtCreateRegion
CreateHalftonePalette
CreatePalette
GetDIBColorTable
SetTextJustification
GetTextExtentPoint32A
CreateFontIndirectA
SetBkMode
SetBkColor
GetTextMetricsA
CreatePen
MoveToEx
LineTo
SetTextColor
CreateBitmap
StretchBlt
SelectObject
CreateCompatibleBitmap
DeleteObject
CreateRectRgn
Polygon
CreateSolidBrush
Escape
DeleteDC

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

Shell_NotifyIconA
ShellExecuteW
ShellExecuteA

comctl32

ImageList_ReplaceIcon
ImageList_AddMasked
_TrackMouseEvent
ImageList_GetImageCount
ImageList_Create
ImageList_GetIcon
ord17

ole32

CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx

olepro32

ord251

oleaut32

SysStringByteLen
SysAllocString
VariantClear
GetErrorInfo
SysAllocStringByteLen
SysFreeString
SysStringLen

iphlpapi

GetAdaptersInfo
GetIfEntry

sqlite3

sqlite3_get_table
sqlite3_close
sqlite3_exec
sqlite3_open
sqlite3_free_table

Exports

Exports

?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B

Sections

.text
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ba35477b2f272b7988edfb084c55fa

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

23:c0:ef:6b:ed:03:1e:e3:34:c6:09:ae:d6:dd:60:82Certificate

Extended Key Usages

da:6c:d4:b4:4d:97:30:a9:2c:8c:e3:e9:c8:57:f9:58:5c:86:88:d7Signer

Headers

File Characteristics

Imports

wininet

version

kernel32

mfc42

msvcrt

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

iphlpapi

sqlite3

Exports

Exports

Sections

.text Size: 200KB - Virtual size: 199KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 20KB - Virtual size: 18KB

.rsrc Size: 232KB - Virtual size: 231KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

23:c0:ef:6b:ed:03:1e:e3:34:c6:09:ae:d6:dd:60:82
Certificate

da:6c:d4:b4:4d:97:30:a9:2c:8c:e3:e9:c8:57:f9:58:5c:86:88:d7
Signer

.text
Size: 200KB - Virtual size: 199KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 20KB - Virtual size: 18KB

.rsrc
Size: 232KB - Virtual size: 231KB