4b6a9f00de7cf1367817c1648663f723_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4b6a9f00de7cf1367817c1648663f723_JaffaCakes118
Size

206KB
MD5

4b6a9f00de7cf1367817c1648663f723
SHA1

37804bca1597a7d97c69adb31bea20ae48b073c2
SHA256

ab5ce42bd8db3a2fb214023a72b3cfd993542ebfcb7c1d75834aefe05c74bbe5
SHA512

45f5fb7f2a47400618d8345e9729e252ea1af0a5613fead01ff0ddef5423fb5bc7cce5bd5519a930642fc54b2468e6891281c693b3209e09cb7fc8e4830fb6ca
SSDEEP

6144:vZBgfElM2+JM5zMV1uTgmmb8Nmes8hL8c+u2v:vZ1D+JMhMSgmmOmeHl837v

Score

1^/10

Malware Config

Signatures

Files

4b6a9f00de7cf1367817c1648663f723_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc4952d659b35d4f14a898fe80883067

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:ef:4f:72:14:93:67:bc:c7:77:5d:00:00:90:9c:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/01/2010, 00:00

Not After

30/01/2012, 23:59

Subject

CN=VIRUSBLOKADA LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=VIRUSBLOKADA LTD.,L=Minsk,ST=none,C=BY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:e4:76:79:f5:4d:e1:39:c0:f0:4f:be:3f:28:f3:37:4c:54:bc:fd
Signer

Actual PE Digest

d6:e4:76:79:f5:4d:e1:39:c0:f0:4f:be:3f:28:f3:37:4c:54:bc:fd

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCPInfo
ExitProcess
ReplaceFileW
GetTempFileNameW
CreateFileA
QueryPerformanceFrequency
lstrlenW
GetProcAddress
GetFileTime
FatalAppExitA
GetModuleHandleA

user32

DrawIcon
GetActiveWindow
LoadMenuA
GetMessageW
SetWindowRgn
GetMenuInfo
DefDlgProcW
GetSysColorBrush
TrackPopupMenuEx
SetWindowPos
IsIconic
AdjustWindowRect
WinHelpA
EnumWindows
GetClassNameW
AnimateWindow
GetClassInfoExA
MonitorFromRect
GetMenuItemID
CreateMenu
LoadIconW
InsertMenuA
GetClassInfoExW
DestroyMenu
InvalidateRgn
ActivateKeyboardLayout
CopyIcon
GetDC
GetMenuStringA
MessageBoxIndirectW
IsMenu
MoveWindow
LoadCursorW
GetClassInfoA
GetDlgItemInt
ClientToScreen
GetDC
IsChild
RegisterClassW

gdi32

ExtSelectClipRgn
MoveToEx
SetDIBColorTable
CreateICA
Chord
SetICMProfileA
SetBoundsRect

advapi32

RegCreateKeyW
RegFlushKey
RegSaveKeyW

shell32

ExtractIconExW
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

comctl32

CreateStatusWindowW
ImageList_Remove
CreateToolbar

ole32

CoGetMalloc
CLSIDFromProgID
CoCreateInstanceEx

ws2_32

gethostname
accept

inetcomm

MimeOleCreateByteStream
DllCanUnloadNow
MimeEditIsSafeToRun
CreatePOP3Transport
MimeOleGetCharsetInfo

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.z
Size: 1024B - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oGI
Size: 512B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Y
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Q
Size: 1KB - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.j
Size: 2KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cM
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hpfVwz
Size: 1024B - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc4952d659b35d4f14a898fe80883067

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2b:ef:4f:72:14:93:67:bc:c7:77:5d:00:00:90:9c:1dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

d6:e4:76:79:f5:4d:e1:39:c0:f0:4f:be:3f:28:f3:37:4c:54:bc:fdSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

ws2_32

inetcomm

Sections

.text Size: 11KB - Virtual size: 11KB

.z Size: 1024B - Virtual size: 44KB

.oGI Size: 512B - Virtual size: 7KB

.Y Size: 2KB - Virtual size: 24KB

.Q Size: 1KB - Virtual size: 902B

.data Size: 13KB - Virtual size: 12KB

.j Size: 2KB - Virtual size: 43KB

.cM Size: 2KB - Virtual size: 28KB

.hpfVwz Size: 1024B - Virtual size: 231KB

.rsrc Size: 165KB - Virtual size: 165KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2b:ef:4f:72:14:93:67:bc:c7:77:5d:00:00:90:9c:1d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

d6:e4:76:79:f5:4d:e1:39:c0:f0:4f:be:3f:28:f3:37:4c:54:bc:fd
Signer

.text
Size: 11KB - Virtual size: 11KB

.z
Size: 1024B - Virtual size: 44KB

.oGI
Size: 512B - Virtual size: 7KB

.Y
Size: 2KB - Virtual size: 24KB

.Q
Size: 1KB - Virtual size: 902B

.data
Size: 13KB - Virtual size: 12KB

.j
Size: 2KB - Virtual size: 43KB

.cM
Size: 2KB - Virtual size: 28KB

.hpfVwz
Size: 1024B - Virtual size: 231KB

.rsrc
Size: 165KB - Virtual size: 165KB