42926e2018af2a1066d289179109c006_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

42926e2018af2a1066d289179109c006_JaffaCakes118
Size

125KB
MD5

42926e2018af2a1066d289179109c006
SHA1

eaac5ca6573806492fd374136790e78e4bc846e7
SHA256

e24996014b457393164191b27764594cf591baa0f27efd5f14e4f2388611586d
SHA512

4b3c4601240fb8cf1ba6d1423264cb38204264c3dd1b3cf933e332489767d47ffe393d42e84097c9d82140e5916298e0fadbb2ebb823ec2dc30c6bd6198e86cf
SSDEEP

3072:PdkoJpLPSpf/L/haWm2yI7v0LFVqGINuOVF2zYxSxWwPV8UiGP6Y+:r7bQx7v0LXqrYOVNwxW2Ja

Score

1^/10

Malware Config

Signatures

Files

42926e2018af2a1066d289179109c006_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

fec1bb6d197b4fe7cef9e1f3bcf38c07

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

Issuer

CN=Application Compatibility UI

Not Before

31/12/2008, 16:00

Not After

31/12/2014, 16:00

Subject

CN=Application Compatibility UI

Extended Key Usages

ExtKeyUsageCodeSigning

c3:74:fe:3e:fc:3b:63:35:0b:3d:b2:1f:da:c8:cc:76:d6:8d:15:5b
Signer

Actual PE Digest

c3:74:fe:3e:fc:3b:63:35:0b:3d:b2:1f:da:c8:cc:76:d6:8d:15:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

GetPixel

wsock32

WSACleanup

wininet

InternetReadFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JSOff
JSOn

Sections

9
Size: - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

)
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

6
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

,
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

=
Size: - Virtual size: 193B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

$
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

+
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

5
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

(
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

?
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fec1bb6d197b4fe7cef9e1f3bcf38c07

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2Certificate

Extended Key Usages

c3:74:fe:3e:fc:3b:63:35:0b:3d:b2:1f:da:c8:cc:76:d6:8d:15:5bSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

wsock32

wininet

Exports

Exports

Sections

9 Size: - Virtual size: 125KB

) Size: - Virtual size: 2KB

6 Size: - Virtual size: 5KB

, Size: - Virtual size: 3KB

= Size: - Virtual size: 193B

$ Size: - Virtual size: 8KB

+ Size: 512B - Virtual size: 4KB

5 Size: - Virtual size: 22KB

( Size: 122KB - Virtual size: 121KB

? Size: 512B - Virtual size: 136B

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

c3:74:fe:3e:fc:3b:63:35:0b:3d:b2:1f:da:c8:cc:76:d6:8d:15:5b
Signer

9
Size: - Virtual size: 125KB

)
Size: - Virtual size: 2KB

6
Size: - Virtual size: 5KB

,
Size: - Virtual size: 3KB

=
Size: - Virtual size: 193B

$
Size: - Virtual size: 8KB

+
Size: 512B - Virtual size: 4KB

5
Size: - Virtual size: 22KB

(
Size: 122KB - Virtual size: 121KB

?
Size: 512B - Virtual size: 136B