488f2f82019b4ab34c64d53b4804aabe_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

488f2f82019b4ab34c64d53b4804aabe_JaffaCakes118
Size

81KB
MD5

488f2f82019b4ab34c64d53b4804aabe
SHA1

9873b35988e0f626ce29021afc22d4282a1f5f2d
SHA256

52517078a678d4f006b166896f1dd0306ca94d4223f6572b3f6abeb34fc507cf
SHA512

96ef76417aebea076f605bd6917edff419d21222643fb4f26e26652bebd699bfb0745a15f93aea95e2edd8e430b8756bce6a3a48588b90ee4a0d8fa9b56b6636
SSDEEP

1536:1jqL+pooboZkvhbmDnKSHj0Jy++8KZyrQ/bUM0KoC8:dC+7vtSuBraUM0KH8

Score

1^/10

Malware Config

Signatures

Files

488f2f82019b4ab34c64d53b4804aabe_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f38abdff0976f8c49b41e60a3a05b1c4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:51:7c:eb:ac:82:0c:8c:10:3e:fd:17:22:7e:5b:59
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/03/2012, 00:00

Not After

05/06/2014, 23:59

Subject

CN=Beijing Compass Technology Development Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=VTN Support,O=Beijing Compass Technology Development Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:e4:79:2c:0a:a3:13:0c:2d:85:36:d2:85:b3:02:15:4b:98:2f:09
Signer

Actual PE Digest

79:e4:79:2c:0a:a3:13:0c:2d:85:36:d2:85:b3:02:15:4b:98:2f:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord6383
ord5450
ord6394
ord2841
ord2107
ord1083
ord773
ord5621
ord5440
ord1567
ord268
ord654
ord5600
ord5858
ord6140
ord341
ord5856
ord4204
ord803
ord825
ord543
ord3663
ord3584
ord1871
ord860
ord2763
ord939
ord5710
ord1980
ord356
ord2770
ord2781
ord3178
ord858
ord5683
ord4129
ord6569
ord668
ord540
ord2818
ord924
ord1154
ord6467
ord4202
ord2764
ord535
ord941
ord800
ord537
ord1182
ord342
ord1253
ord1168
ord823
ord501

msvcrt

_adjust_fdiv
malloc
_initterm
free
??1type_info@@UAE@XZ
_onexit
__dllonexit
qsort
_CxxThrowException
_ftol
_snprintf
sprintf
fopen
fprintf
fclose
strrchr
_except_handler3
memmove
__CxxFrameHandler
_mbscmp
_purecall

kernel32

GetTickCount
CreateSemaphoreA
LeaveCriticalSection
CreateFileMappingA
EnterCriticalSection
GetFileSize
SetFilePointer
SetEndOfFile
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
CloseHandle
DeleteFileA
InterlockedDecrement
GetLastError
FormatMessageA
LocalFree
CreateDirectoryA
ReleaseSemaphore
InterlockedExchange
GetSystemInfo
lstrcatA
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
Sleep
GetCurrentThreadId
GetExitCodeThread
WaitForSingleObject
lstrlenA
WaitForMultipleObjects
VirtualAlloc
MapViewOfFile
UnmapViewOfFile
VirtualFree
MoveFileExA
GetDiskFreeSpaceExA
IsBadReadPtr
IsBadWritePtr
MoveFileA
InterlockedIncrement

user32

RegisterWindowMessageA

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

Exports

Exports

DataStoreExit
DataStoreInit
GetBucketList
GetPluginObject
GetPluginObjectEx

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f38abdff0976f8c49b41e60a3a05b1c4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2b:51:7c:eb:ac:82:0c:8c:10:3e:fd:17:22:7e:5b:59Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

79:e4:79:2c:0a:a3:13:0c:2d:85:36:d2:85:b3:02:15:4b:98:2f:09Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2b:51:7c:eb:ac:82:0c:8c:10:3e:fd:17:22:7e:5b:59
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

79:e4:79:2c:0a:a3:13:0c:2d:85:36:d2:85:b3:02:15:4b:98:2f:09
Signer

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 4KB - Virtual size: 3KB