4b00f1f18579437d7a6ef610231b63e7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b00f1f18579437d7a6ef610231b63e7_JaffaCakes118
Size

2.1MB
MD5

4b00f1f18579437d7a6ef610231b63e7
SHA1

c6c67c06554c3e25d77e9063f746e6ef2f83a26f
SHA256

7e4f09f5f3721c393a70c4611a5c5b6665c258c3d45f1a3612b85b4b5f154ad7
SHA512

c8ab7970af1317a4c90eb2e82438c4d7dc321fab3eecfed1deacab20818b2cafd8478944917088a9062fb5a2c796c3d8185b84d6dcda767fa3356305e9383b05
SSDEEP

49152:fBGNYofJY48C/UNhkxLnKi7G16y8YtFQUL5aGOJVFFfkGs:fBGNYofO2/ULkx7y8YtFQNVFfE

Score

1^/10

Malware Config

Signatures

Files

4b00f1f18579437d7a6ef610231b63e7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

92b6c59e9e3902e5263f0bc572435076

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:01:58:55:22:e8:fa:61:13:8a:ef:a4:f6:27:ee:a8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

02/03/2010, 00:00

Not After

02/03/2011, 23:59

Subject

CN=Comodo Security Solutions\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Comodo Security Solutions\, Inc.,L=Jersey City,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c1:74:f7:34:6f:97:af:3a:5b:1d:e8:a1:a2:90:3e:08:49:41:f6:57
Signer

Actual PE Digest

c1:74:f7:34:6f:97:af:3a:5b:1d:e8:a1:a2:90:3e:08:49:41:f6:57

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

ShowOwnedPopups

gdi32

Escape

msimg32

TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW

advapi32

RegEnumKeyW

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

StrFormatByteSizeW

ole32

RevokeDragDrop

oleaut32

OleLoadPicturePath

wininet

InternetSetOptionW

msi

ord141

psapi

GetProcessImageFileNameW

version

GetFileVersionInfoW

uxtheme

DrawThemeParentBackground

dbghelp

MiniDumpWriteDump

crypt32

CertGetCertificateContextProperty

wintrust

WTHelperGetProvCertFromChain

gdiplus

GdipDrawImageI

imm32

ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.4MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 553KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

92b6c59e9e3902e5263f0bc572435076

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

2c:01:58:55:22:e8:fa:61:13:8a:ef:a4:f6:27:ee:a8Certificate

Extended Key Usages

Key Usages

c1:74:f7:34:6f:97:af:3a:5b:1d:e8:a1:a2:90:3e:08:49:41:f6:57Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

wininet

msi

psapi

version

uxtheme

dbghelp

crypt32

wintrust

gdiplus

imm32

winmm

Sections

.text Size: 1.4MB - Virtual size: 6.8MB

.rsrc Size: 553KB - Virtual size: 556KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

2c:01:58:55:22:e8:fa:61:13:8a:ef:a4:f6:27:ee:a8
Certificate

c1:74:f7:34:6f:97:af:3a:5b:1d:e8:a1:a2:90:3e:08:49:41:f6:57
Signer

.text
Size: 1.4MB - Virtual size: 6.8MB

.rsrc
Size: 553KB - Virtual size: 556KB