5b11c7a51cbb0450d9aadd95580c266a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5b11c7a51cbb0450d9aadd95580c266a_JaffaCakes118
Size

1.6MB
MD5

5b11c7a51cbb0450d9aadd95580c266a
SHA1

c7090b594cf97c37ece0f01a9142837ac55400da
SHA256

ef0a7a6524bb9c86e122e429fb51e9be4460d6058b1c8828fd89bb9fbbc6e8a5
SHA512

85d63470848cddccf2913ad583e9bff3930e1625db4ce9e37f27eab2b7a10571a6a25b6c19954c0c7ed2a202089070ecb4557a3249564ac4601f0bca67f75170
SSDEEP

24576:RSGMzA6nlKJzZ6VKOjj2MSFXq6LCQ8oqqiaM6NWHBC2rQp:RFMzKzjOV9oTx2s

Score

1^/10

Malware Config

Signatures

Files

5b11c7a51cbb0450d9aadd95580c266a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

65f71e417139edb814bac109bb1b0009

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:00:0b:3c
Certificate

Issuer

CN=AOL Member CA,O=America Online Inc.,L=Dulles,ST=Virginia,C=US

Not Before

19/12/2008, 16:59

Not After

19/12/2010, 16:59

Subject

CN=Winamp,OU=Nullsoft,O=Nullsoft Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=America Online Root Certification Authority 1,O=America Online Inc.,C=US

Not Before

04/06/2004, 17:26

Not After

04/06/2029, 17:26

Subject

CN=AOL Member CA,O=America Online Inc.,L=Dulles,ST=Virginia,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:01:e9:26:ac:d7:d3:49:22:c0:25:c8:4c:d1:45:25:be:31:11:d1
Signer

Actual PE Digest

73:01:e9:26:ac:d7:d3:49:22:c0:25:c8:4c:d1:45:25:be:31:11:d1

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathUnquoteSpacesW
PathIsDirectoryW
PathIsRootW
PathRemoveFileSpecW
UrlGetPartW
PathFindFileNameA
PathRemoveFileSpecA
PathAppendA
PathIsNetworkPathW
StrCmpIW
StrCmpNW
PathRemoveExtensionW
PathAddExtensionW
PathFindExtensionW
StrCmpNIW
StrToIntW
PathStripPathW
PathCanonicalizeW
PathFileExistsA
StrToIntExW
PathCommonPrefixW
PathAddBackslashW
PathIsUNCW
PathIsSameRootW
PathIsFileSpecW
PathIsRelativeW
StrToIntA
PathQuoteSpacesA
StrChrW
PathFileExistsW
PathQuoteSpacesW
PathCombineW
PathCombineA
PathIsFileSpecA
PathIsRelativeA
PathRemoveBlanksW
PathRemoveBackslashW
PathRemoveBlanksA
PathRemoveBackslashA
PathFindFileNameW
PathIsURLW
PathAppendW
UrlIsW

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidToStringW
UuidCreate

kernel32

SetEnvironmentVariableW
GetVersionExA
GetTempFileNameW
GetTempPathW
GetTempPathA
CreateDirectoryA
CreateDirectoryW
lstrcmpiA
GetModuleFileNameA
FindClose
FindNextFileW
FindFirstFileW
lstrcpyW
GetShortPathNameW
lstrcmpW
FreeLibrary
LoadLibraryW
GetProcAddress
CreateFileW
SetThreadPriority
WriteFile
CreateFileA
LoadLibraryA
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThreadId
CompareStringW
CreateProcessW
RemoveDirectoryW
MoveFileExW
GetVersionExW
DeleteFileA
GlobalUnlock
WritePrivateProfileStringA
SetCurrentDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableA
SetPriorityClass
GetCurrentProcess
RemoveDirectoryA
FindNextFileA
FindFirstFileA
SetEvent
CreateEventA
GetVersion
MulDiv
SystemTimeToFileTime
GetSystemTime
GetStringTypeExA
GetStringTypeExW
GetModuleHandleA
LocalFree
LocalAlloc
lstrcmpiW
ReadFile
SetEndOfFile
SetFilePointer
MoveFileA
WaitForMultipleObjects
GetCurrentThread
ResetEvent
lstrcmpA
LoadLibraryExW
MoveFileW
ReleaseSemaphore
CreateSemaphoreA
ReadProcessMemory
CreateEventW
CreateProcessA
DuplicateHandle
GetExitCodeThread
GetCommandLineW
GetDriveTypeW
GetLogicalDrives
SetCurrentDirectoryA
GetShortPathNameA
TlsGetValue
TlsSetValue
TlsAlloc
GetLocaleInfoW
QueueUserAPC
CompareStringA
WritePrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileIntW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
GetACP
LockResource
SizeofResource
LoadResource
FindResourceW
FindResourceA
FreeResource
HeapFree
HeapAlloc
GetProcessHeap
OutputDebugStringA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetPrivateProfileStringA
GetPrivateProfileIntA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetLastError
GetLastError
DeleteFileW
OpenProcess
TerminateProcess
ExitProcess
OpenEventW
GetStartupInfoA
RaiseException
InterlockedExchange
QueryPerformanceFrequency
FindResourceExW
GetTimeFormatW
GetLocalTime
lstrlenW
GetFullPathNameW
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
WaitForSingleObject
CloseHandle
CreateThread
GetTickCount
Sleep
lstrlenA
lstrcpynA
lstrcpynW
GetModuleFileNameW
GlobalAlloc
GlobalFree
GlobalLock

user32

GetMenu
RemovePropA
PostMessageW
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
LoadAcceleratorsA
LoadMenuW
LoadMenuA
DialogBoxParamW
DialogBoxParamA
CreateDialogParamW
LoadStringW
SystemParametersInfoW
AttachThreadInput
MapDialogRect
AdjustWindowRectEx
GetWindowTextLengthW
InflateRect
GetDesktopWindow
SendMessageCallbackA
ReplyMessage
CreateIconIndirect
TranslateAcceleratorW
IsDialogMessageW
RegisterClassA
SetClassLongA
GetKeyboardState
GetMenuItemInfoW
RegisterWindowMessageW
LoadIconA
SetMenuItemInfoW
SendMessageTimeoutA
LoadStringA
DrawIconEx
IsDlgButtonChecked
GetDlgItemInt
CheckDlgButton
SetDlgItemInt
DeleteMenu
LoadAcceleratorsW
GetAncestor
MonitorFromWindow
GetMonitorInfoA
ShowWindowAsync
GetClassInfoA
GetClassLongA
IsDialogMessageA
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
GetSystemMenu
EnumDisplaySettingsA
GetWindowRgn
DrawTextA
GetKeyState
IsIconic
FlashWindowEx
MessageBeep
BringWindowToTop
DestroyIcon
CharPrevA
IsWindowUnicode
MsgWaitForMultipleObjectsEx
CallMsgFilterA
TranslateMessage
DispatchMessageW
PeekMessageW
PostQuitMessage
ShowCursor
SetCursorPos
GetActiveWindow
OffsetRect
SetWindowLongW
DestroyCursor
LoadImageW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetWindowRgn
SendNotifyMessageA
CharPrevW
SendDlgItemMessageW
WindowFromPoint
ChildWindowFromPoint
RegisterClipboardFormatA
SetDlgItemTextA
DestroyWindow
CallWindowProcA
SendMessageA
IsWindowEnabled
GetDlgItem
GetParent
GetAsyncKeyState
EnableWindow
SetWindowLongA
SetActiveWindow
ShowWindow
RegisterWindowMessageA
IsCharAlphaA
ModifyMenuW
SetMenuItemInfoA
CheckMenuItem
RemoveMenu
InsertMenuItemA
EnableMenuItem
GetMenuItemRect
SystemParametersInfoA
InsertMenuW
InsertMenuA
DestroyMenu
GetMenuItemInfoA
GetMenuItemCount
AppendMenuA
GetMenuStringW
GetSubMenu
GetMenuState
GetMenuItemID
AppendMenuW
CreatePopupMenu
InsertMenuItemW
PeekMessageA
GetSystemMetrics
GetForegroundWindow
GetMessageA
DispatchMessageA
GetClassInfoW
RegisterClassW
DefWindowProcA
CharUpperW
FindWindowW
IsChild
GetWindowLongW
GetNextDlgTabItem
GetClassNameW
GetMessagePos
ChildWindowFromPointEx
ValidateRect
GetUpdateRect
GetUpdateRgn
RedrawWindow
ReleaseCapture
ClientToScreen
CreateWindowExW
MapWindowPoints
SetPropW
RemovePropW
FindWindowExA
GetPropW
GetCursorPos
TrackPopupMenu
EnumThreadWindows
IsWindowVisible
UpdateWindow
FindWindowA
GetClassInfoExW
RegisterClassExW
SetCursor
PtInRect
GetFocus
SetFocus
GetCapture
SetCapture
TrackMouseEvent
BeginPaint
EndPaint
LoadCursorA
SetRect
DefWindowProcW
GetDlgCtrlID
SendMessageW
FillRect
CopyRect
DrawFocusRect
GetDCEx
SetRectEmpty
GetSysColor
GetWindowThreadProcessId
FindWindowExW
CharNextW
PostThreadMessageA
KillTimer
MessageBoxW
SetTimer
GetWindowTextW
SetWindowTextW
GetWindow
SetScrollInfo
GetScrollInfo
SetScrollPos
SetDlgItemTextW
SetForegroundWindow
GetDlgItemTextW
DrawTextW
GetWindowTextA
SetWindowTextA
CreateDialogParamA
PostMessageA
ScreenToClient
SetParent
SetWindowPos
GetWindowLongA
InvalidateRect
GetWindowRect
EndDialog
GetClientRect
GetWindowDC
ReleaseDC
LoadImageA
GetDC
SendDlgItemMessageA
GetWindowTextLengthA
GetDlgItemTextA
CharUpperBuffA
MessageBoxA
CharNextA
IsWindow
GetSysColorBrush
LoadBitmapW
DialogBoxIndirectParamW
GetMessageW
CreateDialogIndirectParamA
CallWindowProcW

gdi32

GetTextExtentPoint32W
GetTextMetricsW
ExtTextOutW
SetTextAlign
GetTextMetricsA
ExtTextOutA
CombineRgn
OffsetRgn
CreateRectRgn
GetTextExtentPoint32A
CreateFontIndirectA
CreatePolyPolygonRgn
CreatePen
Rectangle
RoundRect
SetBkColor
GetBkColor
GetTextColor
CreateFontA
CreateSolidBrush
GetObjectA
FillRgn
GetStockObject
CreateRectRgnIndirect
StretchBlt
GetPixel
SetPixel
CreateBrushIndirect
SetDIBits
GetNearestColor
SetStretchBltMode
RestoreDC
MoveToEx
LineTo
SetTextColor
SetBkMode
UpdateColors
GetDeviceCaps
CreateCompatibleDC
SelectObject
GetDIBits
BitBlt
RealizePalette
SelectPalette
CreateDIBSection
CreatePalette
DeleteObject
DeleteDC
CreateCompatibleBitmap
RectVisible
GetCurrentObject
SetBrushOrgEx
CreatePatternBrush
GetObjectW
CreateFontIndirectW
GetFontLanguageInfo
IntersectClipRect
ExtSelectClipRgn
EnumFontsA
CreateFontW
SaveDC
GetDIBColorTable

advapi32

RegQueryValueExA
RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegCreateKeyW
RegDeleteValueW
RegSetValueExA
RegCreateKeyExW
RegCreateKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegCloseKey

shell32

SHGetFolderPathW
ShellExecuteW
SHBrowseForFolderA
SHBrowseForFolderW
DragQueryPoint
Shell_NotifyIconW
SHGetSpecialFolderPathA
SHGetPathFromIDListA
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetPathFromIDListW
SHChangeNotify
SHFileOperationW

ole32

OleRun
CoTaskMemAlloc
CoCreateGuid
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CoUninitialize
RevokeDragDrop
CoRevokeClassObject
OleUninitialize
OleInitialize
RegisterDragDrop
CoRegisterClassObject
StringFromGUID2
CoGetObject
CoInitialize

oleaut32

SysAllocString
SysFreeString
SafeArrayCopy
SysAllocStringLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit

nscrt

_onexit
__dllonexit
vsprintf
_i64tow
wcsrchr
_wchmod
fputs
swscanf
fgetws
_CIpow
abs
log
tan
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_except_handler3
floor
fabs
labs
fseek
ftell
fwrite
_wcsdup
wcschr
sscanf
strtol
memmove
_waccess
fopen
fgets
atoi
fprintf
fputc
toupper
wcsncmp
wcslen
cos
strchr
strcmp
_purecall
wcsstr
wcscmp
memcmp
_wtoi
strrchr
_itow
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
_vsnwprintf
realloc
strlen
memset
sqrt
sin
pow
malloc
free
strncmp
_wfopen
fread
fclose
strstr
memcpy
_vsnprintf
_CxxThrowException
_strnicmp
_stricmp
_wcsnicmp
_wcsicmp
_strdup
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
??1type_info@@UAE@XZ
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
?terminate@@YAXXZ

Sections

.text
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 768KB - Virtual size: 767KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

65f71e417139edb814bac109bb1b0009

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

70:00:0b:3cCertificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

73:01:e9:26:ac:d7:d3:49:22:c0:25:c8:4c:d1:45:25:be:31:11:d1Signer

Headers

File Characteristics

Imports

shlwapi

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

nscrt

Sections

.text Size: 530KB - Virtual size: 529KB

.rdata Size: 83KB - Virtual size: 82KB

.data Size: 7KB - Virtual size: 89KB

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 768KB - Virtual size: 767KB

.reloc Size: 51KB - Virtual size: 51KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

70:00:0b:3c
Certificate

07
Certificate

73:01:e9:26:ac:d7:d3:49:22:c0:25:c8:4c:d1:45:25:be:31:11:d1
Signer

.text
Size: 530KB - Virtual size: 529KB

.rdata
Size: 83KB - Virtual size: 82KB

.data
Size: 7KB - Virtual size: 89KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 768KB - Virtual size: 767KB

.reloc
Size: 51KB - Virtual size: 51KB