5aec14c4d7955197ddd88bf1e5157240_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5aec14c4d7955197ddd88bf1e5157240_JaffaCakes118
Size

461KB
MD5

5aec14c4d7955197ddd88bf1e5157240
SHA1

0cc7a8ffe04e7c4fee6e330165d5352ab581f0a6
SHA256

45878b993e0f189ee1fefa8385841b833337f0f85ce72b5956218bb8ac50c570
SHA512

21d767f5785ec8985653d58d12fd3daa5c21cf1f5da77957a94beda13458c255402729a8479a32927eeae70545064ea892452436c3bb4658434f7fe3240ff71d
SSDEEP

3072:2+ep7rQFG1W/hf5y6eGNa3JxlvSCjZqMNFsjODop6ablIJaMKZyaC5uNesbjGd/p:leRYoIBTE3l5vQODop6abluaM2y48

Score

1^/10

Malware Config

Signatures

Files

5aec14c4d7955197ddd88bf1e5157240_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

6d8d8664efeab28b4bc5a718fc5929b9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0f:3d:aa:c8:15:f6:78:99:99:22:3a:80:83:b4:4b:f5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

25/05/2009, 00:00

Not After

14/07/2012, 23:59

Subject

CN=Sun Microsystems\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Sun Microsystems,O=Sun Microsystems\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:ae:b6:82:86:63:fe:d9:75:55:f8:fe:24:f3:3b:1a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority - G2+OU=(c) 1998 VeriSign\, Inc. - For authorized use only+OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US

Not Before

01/04/2009, 00:00

Not After

31/03/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\BUILD_~1\jdk6_26\control\build\WINDOW~1\tmp\deploy\plugin\deployJava1\obj\deployJava1.pdb

Imports

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
RegQueryValueA
RegEnumKeyA

urlmon

IsValidURL

wininet

InternetCrackUrlA
InternetCloseHandle
InternetReadFile
InternetTimeToSystemTime
HttpQueryInfoA
InternetErrorDlg
HttpSendRequestA
HttpAddRequestHeadersA
InternetTimeFromSystemTime
HttpOpenRequestA
InternetConnectA
InternetOpenA

shlwapi

PathIsURLA
PathFileExistsA

comctl32

ord17

wintrust

WinVerifyTrust

wsock32

gethostbyaddr
ioctlsocket
gethostbyname
inet_addr

crypt32

CryptMsgGetParam
CertOpenSystemStoreA
CertGetNameStringW
CertCloseStore
CryptMsgClose
CertFindCertificateInStore
CryptQueryObject
CertGetEnhancedKeyUsage

shell32

SHGetFileInfoA
ShellExecuteExA

kernel32

QueryPerformanceCounter
UnhandledExceptionFilter
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
lstrlenA
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetLastError
lstrcmpiA
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
lstrcpynA
IsDBCSLeadByte
MulDiv
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetLongPathNameA
WaitForSingleObject
GlobalAlloc
lstrcmpA
GetDiskFreeSpaceA
GetProcAddress
LockResource
GlobalUnlock
GlobalLock
GetTempPathA
GetTickCount
GetExitCodeProcess
CreateProcessA
SetLastError
GlobalFree
GlobalHandle
GetTempFileNameA
lstrcatA
WriteFile
SetEndOfFile
SetFilePointer
CompareFileTime
SystemTimeToFileTime
Sleep
FileTimeToSystemTime
GetFileTime
GetFileSize
CreateFileA
lstrcpyA
SetEvent
CreateThread
CreateEventA
GlobalMemoryStatus
GetShortPathNameA
LoadLibraryA
GetSystemDirectoryA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
ReadFile
GetCPInfo
GetOEMCP
LCMapStringW
LCMapStringA
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
TerminateProcess
IsBadWritePtr
HeapCreate
HeapDestroy
ExitProcess
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
GetCurrentProcessId
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
FindClose
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
GetFullPathNameA
GetCurrentDirectoryA
CloseHandle

user32

GetCursorPos
UnregisterClassA
CharNextA
DestroyWindow
SetCursor
PtInRect
UnionRect
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
ReleaseDC
GetDC
SetWindowLongA
GetWindowLongA
MapDialogRect
SetWindowContextHelpId
GetDlgCtrlID
LoadBitmapA
PostMessageA
EnableWindow
KillTimer
SetTimer
MessageBoxA
DialogBoxIndirectParamA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
DefWindowProcA
CreateAcceleratorTableA
GetActiveWindow
GetClassNameA
RedrawWindow
GetDlgItem
SendMessageA
DestroyAcceleratorTable
GetDesktopWindow
InvalidateRgn
FillRect
SetCapture
ReleaseCapture
DialogBoxParamA
GetSysColor
SendDlgItemMessageA
GetWindow
GetWindowRect
SystemParametersInfoA
MapWindowPoints
EndDialog
LoadStringA
MsgWaitForMultipleObjects
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
PeekMessageA
RegisterClassExA
GetClassInfoExA
LoadCursorA
wsprintfA
CreateWindowExA
GetParent
SetFocus
ShowWindow
GetFocus
IsChild
BeginPaint
GetClientRect
EndPaint
GetKeyState
InvalidateRect
IsWindow
CallWindowProcA
IsWindowUnicode

ole32

CoCreateInstance
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
OleRegGetMiscStatus
OleLoadFromStream
WriteClassStm
OleSaveToStream
CLSIDFromString
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoGetClassObject
CLSIDFromProgID
OleInitialize
OleUninitialize
StringFromCLSID

oleaut32

SysAllocStringLen
VariantCopy
OleCreatePropertyFrame
LoadRegTypeLi
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
VariantClear
VarUI4FromStr
LoadTypeLi
SysStringLen
VariantInit
SysAllocString
SysFreeString
OleCreateFontIndirect

gdi32

CreateCompatibleBitmap
SelectObject
BitBlt
GetObjectA
GetStockObject
CreateSolidBrush
CreateFontIndirectA
DeleteObject
CreateDCA
DPtoLP
ModifyWorldTransform
SetGraphicsMode
StretchBlt
SetBkMode
SetTextColor
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateCompatibleDC
CreateRectRgnIndirect

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d8d8664efeab28b4bc5a718fc5929b9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0f:3d:aa:c8:15:f6:78:99:99:22:3a:80:83:b4:4b:f5Certificate

Extended Key Usages

Key Usages

2e:ae:b6:82:86:63:fe:d9:75:55:f8:fe:24:f3:3b:1aCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

advapi32

urlmon

wininet

shlwapi

comctl32

wintrust

wsock32

crypt32

shell32

kernel32

user32

ole32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 139KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 8KB - Virtual size: 24KB

.rsrc Size: 256KB - Virtual size: 255KB

.reloc Size: 16KB - Virtual size: 13KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0f:3d:aa:c8:15:f6:78:99:99:22:3a:80:83:b4:4b:f5
Certificate

2e:ae:b6:82:86:63:fe:d9:75:55:f8:fe:24:f3:3b:1a
Certificate

.text
Size: 140KB - Virtual size: 139KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 8KB - Virtual size: 24KB

.rsrc
Size: 256KB - Virtual size: 255KB

.reloc
Size: 16KB - Virtual size: 13KB