5f46b847511ab2a8996bdf64e509be7b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5f46b847511ab2a8996bdf64e509be7b_JaffaCakes118
Size

52KB
MD5

5f46b847511ab2a8996bdf64e509be7b
SHA1

7951aee6b96e7814f7dba591e3c9bab133c26708
SHA256

891b8166ac078a45d3f8db6327271b907ff02c15c6d9e4617977238b954fe247
SHA512

4c156e7cb127448ab2113d3d526d643edbd16bc57c86d5f4ce9b8567d4da24086f22aa9ba524fdd7efeecc43884c7a3535ccd7a9ce8cbc56b2918539c890041d
SSDEEP

768:r3wRWw/Jx0L7KRbd2FPoC1cl04zEncPefhXigymLbbC6AF:7QtWPJWlFzgX9FbCDF

Score

1^/10

Malware Config

Signatures

Files

5f46b847511ab2a8996bdf64e509be7b_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9715f757f693bd83a4e606f2bb61958c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:b6:59:f0:73:8f:56:ae:0f:33:7d:82:40:38:86:7d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

29/01/2010, 00:00

Not After

21/03/2013, 23:59

Subject

CN=TRC CONSULTANTS\, L.C.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TRC CONSULTANTS\, L.C.,L=Boerne,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e5:81:e6:c8:94:c6:c6:a8:7c:7d:e7:04:71:d4:0d:aa:b7:17:38:6c
Signer

Actual PE Digest

e5:81:e6:c8:94:c6:c6:a8:7c:7d:e7:04:71:d4:0d:aa:b7:17:38:6c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

c55runx

Cla$CLEAR
Cla$clearstr
Cla$CLOSEwindow
Cla$code
Cla$COMMAND
Cla$comparestr
Cla$DPopLong
Cla$EndEventLoop
Cla$ERRCODE
Cla$EVENT
Cla$FILE_CLOSE
Cla$FILE_DELETE
Cla$FILE_NEXT
Cla$FILE_OPEN
Cla$FILE_RECORDSf
Cla$FILE_SETkk
Cla$freestr
Cla$freewindow
Cla$init
Cla$LONGPATH
Cla$MessageBox
Cla$OPENwindow
Cla$PopCString
Cla$PopString
Cla$PopTemp
Cla$POST
Cla$PushCString
Cla$PushLong
Cla$PushPictLong
Cla$PushString
Cla$pwopen
Cla$SetPropS
Cla$Stack2DStack
Cla$StackCLIP
Cla$StackCompareNEQ
Cla$StackCompareR
Cla$StackConcat
Cla$StackConcatR
Cla$StackHeap
Cla$StackSUB
Cla$StartEventLoop
Cla$storecstr
Cla$storestr
Cla$TODAY
Wsl$CloseDown
_exit
_fnsplit
_free
_malloc
__checkversion
__sysinit

c55tpsx

TOPSPEED

kernel32

GetVersionExA

phdexted

CreateEMail
GetPHDRegistryValue

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9715f757f693bd83a4e606f2bb61958c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4e:b6:59:f0:73:8f:56:ae:0f:33:7d:82:40:38:86:7dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

e5:81:e6:c8:94:c6:c6:a8:7c:7d:e7:04:71:d4:0d:aa:b7:17:38:6cSigner

Headers

File Characteristics

Imports

c55runx

c55tpsx

kernel32

phdexted

Sections

.text Size: 7KB - Virtual size: 6KB

.data Size: 28KB - Virtual size: 58KB

.idata Size: 2KB - Virtual size: 1KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4e:b6:59:f0:73:8f:56:ae:0f:33:7d:82:40:38:86:7d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

e5:81:e6:c8:94:c6:c6:a8:7c:7d:e7:04:71:d4:0d:aa:b7:17:38:6c
Signer

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 28KB - Virtual size: 58KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB