5fd4b01a5c9e1ca461a67b3eb041cf9a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5fd4b01a5c9e1ca461a67b3eb041cf9a_JaffaCakes118
Size

332KB
MD5

5fd4b01a5c9e1ca461a67b3eb041cf9a
SHA1

efd6a0b97d5c3d4a4b999e4cd3033ff8c488380c
SHA256

9820e30f9c12ad82b0eb59d69e9871406e6696efa77e4775084fa63effad79d0
SHA512

716ded33132b8ab856f5acbf3584aff237a2d1a6c37b60c100319f3cb3c3332fc69de4d443a53630963ab1ba941a59e6eaff741962df7583b55fe6c32fe1e473
SSDEEP

6144:QdWKj59bp+6SpivKY/jKa7C8PCYzlPHys0n:Qsq/+6S2hx9Zvys0

Score

1^/10

Malware Config

Signatures

Files

5fd4b01a5c9e1ca461a67b3eb041cf9a_JaffaCakes118
.dll windows:4 windows x86 arch:x86

b8b19a5dfd81de497930452a5ab232cd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7f:c8:08:71:a6:6f:e6:b0:7d:8c:fc:a5:af:93:01:4d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

18/02/2008, 00:00

Not After

17/02/2009, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=R&D,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e0:94:06:42:54:c8:bc:5e:22:47:0c:0c:f2:d0:e7:67:75:b2:a2:73
Signer

Actual PE Digest

e0:94:06:42:54:c8:bc:5e:22:47:0c:0c:f2:d0:e7:67:75:b2:a2:73

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueA

gdi32

StretchBlt

ole32

CoTaskMemFree

wsock32

WSACleanup

wininet

InternetReadFile

shell32

ExtractIconA

avicap32

capCreateCaptureWindowA

winmm

waveOutWrite

msacm32

acmStreamUnprepareHeader

comdlg32

GetSaveFileNameA

Exports

Exports

ServiceMain
ServiceMainManual

Sections

CODE
Size: - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 13KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 98B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8b19a5dfd81de497930452a5ab232cd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7f:c8:08:71:a6:6f:e6:b0:7d:8c:fc:a5:af:93:01:4dCertificate

Extended Key Usages

Key Usages

e0:94:06:42:54:c8:bc:5e:22:47:0c:0c:f2:d0:e7:67:75:b2:a2:73Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

ole32

wsock32

wininet

shell32

avicap32

winmm

msacm32

comdlg32

Exports

Exports

Sections

CODE Size: - Virtual size: 261KB

DATA Size: - Virtual size: 34KB

BSS Size: - Virtual size: 13KB

.idata Size: - Virtual size: 7KB

.edata Size: - Virtual size: 98B

.vmp0 Size: - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 11KB

.vmp1 Size: - Virtual size: 46KB

.vmp2 Size: 254KB - Virtual size: 253KB

.reloc Size: 512B - Virtual size: 48B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7f:c8:08:71:a6:6f:e6:b0:7d:8c:fc:a5:af:93:01:4d
Certificate

e0:94:06:42:54:c8:bc:5e:22:47:0c:0c:f2:d0:e7:67:75:b2:a2:73
Signer

CODE
Size: - Virtual size: 261KB

DATA
Size: - Virtual size: 34KB

BSS
Size: - Virtual size: 13KB

.idata
Size: - Virtual size: 7KB

.edata
Size: - Virtual size: 98B

.vmp0
Size: - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 11KB

.vmp1
Size: - Virtual size: 46KB

.vmp2
Size: 254KB - Virtual size: 253KB

.reloc
Size: 512B - Virtual size: 48B