Static task
static1
Behavioral task
behavioral1
Sample
64999cc2d40ee2d759a565e7c9399138_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
64999cc2d40ee2d759a565e7c9399138_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
64999cc2d40ee2d759a565e7c9399138_JaffaCakes118
-
Size
1006KB
-
MD5
64999cc2d40ee2d759a565e7c9399138
-
SHA1
031c8336f2d975f50ca243fa81a2faa78818f9e9
-
SHA256
a34423b039765aae0bfd13bd6023a463bb77e912c9b811c9f61d73a492675f86
-
SHA512
e35e96a567bfcc36cff02dde2e00c3bc863f36a0092d86267f4e3926baf89da23bc51e2c1f55c263ce5691bd2eda87117971c44c54094932374fc82d33911498
-
SSDEEP
24576:nV+Zdes/0FMKKa3JLjxUXfG6bhUBL2eU18EKgQuBk3xN:nV+ZxBKfJjxJEuczWBN
Malware Config
Signatures
Files
-
64999cc2d40ee2d759a565e7c9399138_JaffaCakes118.exe windows:4 windows x86 arch:x86
Code Sign
3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:beCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before29/01/1996, 00:00Not After02/08/2028, 23:59SubjectOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before01/05/2012, 00:00Not After31/12/2012, 23:59SubjectCN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before30/09/2010, 00:00Not After01/01/2014, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
58:c5:8a:6d:06:0c:dd:95:e2:b5:de:e4:c9:0d:1e:75Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before20/08/2012, 00:00Not After20/08/2013, 23:59SubjectCN=DTOPTOOLZ Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=DTOPTOOLZ Co.\,Ltd.,L=Mapo-gu\ ,ST=Seoul,C=KRExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
fc:26:7b:d1:ef:7e:87:e6:b0:64:fe:ae:55:f8:8b:4e:a7:e3:82:a7Signer
Actual PE Digestfc:26:7b:d1:ef:7e:87:e6:b0:64:fe:ae:55:f8:8b:4e:a7:e3:82:a7Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 802KB - Virtual size: 801KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ