613629055da54ceaa2c11ce1ac25305c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

613629055da54ceaa2c11ce1ac25305c_JaffaCakes118
Size

875KB
MD5

613629055da54ceaa2c11ce1ac25305c
SHA1

6017077e3547c0bbb326d6b64b1794c444fbb768
SHA256

546864041ac79aec4417821e6101f15c0406aaeca7b11896a8cf4d1d4e4a3dae
SHA512

459940cbe878e502117daf4685a4ba68b1e212b6be1cd7d8f500f3f1be2d168ce82cbf6bf7cac82d79f163723f2a1306d85205dc74b110e233d3a87e69f9adf4
SSDEEP

12288:LaqNGT/eobzmSBvoYk8Rk/cev1z4x+7gi0MA6URidKEnf+vluQpRpiJjZqMUrkmW:mlT/NzmQvRHbusxhXvRc3f+Rux/Pc

Score

1^/10

Malware Config

Signatures

Files

613629055da54ceaa2c11ce1ac25305c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

85b50a8156e1778d527e1d21b15b8316

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CommConfigDialogA
GetCommState
VirtualFree
SetStdHandle
OpenFileMappingA
GetVersionExA
GetProcessHeaps
TlsFree
GetWindowsDirectoryA
OutputDebugStringA
GetPrivateProfileStructA
SetEvent
GetProfileStringA
WaitNamedPipeA
LoadLibraryA
OpenSemaphoreA
GetProcessAffinityMask
GetModuleFileNameA
SetFileApisToOEM
ReadConsoleA
AddAtomA
QueryPerformanceCounter
FindNextChangeNotification
FillConsoleOutputAttribute
GetLocalTime
CallNamedPipeA
lstrcmpi
ExitProcess
LocalFree
DebugActiveProcess
EnumSystemLocalesA
SetConsoleActiveScreenBuffer
LocalLock
GetExitCodeThread
RequestDeviceWakeup
Module32First
WriteConsoleOutputAttribute
SearchPathA
PeekNamedPipe
GetProcessShutdownParameters
_hread
FlushConsoleInputBuffer
lstrcat
IsValidCodePage
GetTempPathA
MoveFileA
GlobalLock
CreateThread
GlobalCompact
SetTapeParameters
SetCommBreak
GlobalUnlock
lstrcpy
BackupSeek
GlobalFindAtomA
IsBadWritePtr
GetOverlappedResult
MapViewOfFile
GetCPInfoExA
LocalAlloc

shlwapi

StrRChrIA
PathIsRelativeA
PathQuoteSpacesA
SHRegWriteUSValueA
StrCSpnA
SHCreateStreamWrapper
HashData
PathIsUNCA
ColorHLSToRGB
UrlGetLocationA
PathGetDriveNumberA
PathCommonPrefixA
StrSpnA
SHAutoComplete
PathStripToRootA
StrChrIA
AssocQueryStringA
PathRemoveBlanksA
PathIsFileSpecA
StrFormatByteSize64A
PathMakePrettyA
SHDeleteValueA
StrToIntExA
SHRegEnumUSKeyA
SHRegOpenUSKeyA
UrlCombineA
PathFindOnPathA
SHRegCreateUSKeyA
PathAppendA
StrIsIntlEqualA

Sections

.bklc
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qds
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.nuh
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ilmzo
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ktg
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pora
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pox
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shcnu
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zoraf
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85b50a8156e1778d527e1d21b15b8316

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

Sections

.bklc Size: 638KB - Virtual size: 1.3MB

.qds Size: 6KB - Virtual size: 8KB

.nuh Size: 19KB - Virtual size: 27KB

.ilmzo Size: 512B - Virtual size: 21KB

.ktg Size: 6KB - Virtual size: 15KB

.pora Size: 512B - Virtual size: 56B

.pox Size: 512B - Virtual size: 24B

.shcnu Size: 48KB - Virtual size: 77KB

.zoraf Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.bklc
Size: 638KB - Virtual size: 1.3MB

.qds
Size: 6KB - Virtual size: 8KB

.nuh
Size: 19KB - Virtual size: 27KB

.ilmzo
Size: 512B - Virtual size: 21KB

.ktg
Size: 6KB - Virtual size: 15KB

.pora
Size: 512B - Virtual size: 56B

.pox
Size: 512B - Virtual size: 24B

.shcnu
Size: 48KB - Virtual size: 77KB

.zoraf
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB