6499a85919e067bc7596de1cc1ca9d26_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6499a85919e067bc7596de1cc1ca9d26_JaffaCakes118
Size

1.3MB
MD5

6499a85919e067bc7596de1cc1ca9d26
SHA1

f6f147085b4563622bfc32ca7f8061f758cc5231
SHA256

76e74471f1958d404ad50d9336bb96f9a6e07c10bcfd124a02ba05c7eec209f6
SHA512

ca3b2028f8bdbed4ec05cdba6965422152985eaa670fddeaa04b0a4069f0fdbb775513cf322bcc5af3b53c64ff83defe9838d19079058585d655619d4e4682cf
SSDEEP

24576:Vb/sMPL71yJMeo9wRN4LG1pEmbC76MmSKen3W0QjpMQLoJn1iUMTKQ9WTL:l/VPF+o9wfJpveB+prcyHTKPTL

Score

1^/10

Malware Config

Signatures

Files

6499a85919e067bc7596de1cc1ca9d26_JaffaCakes118
.exe windows:5 windows x86 arch:x86

43a684f95fe6a1dc4c695734cfba80dd

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

27/11/2009, 00:00

Not After

27/11/2011, 23:59

Subject

CN=YNK JAPAN Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=YNK JAPAN Inc,L=\ Nihonbashi Kodenmachou10-6,ST=Chuo-ku,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
SetThreadPriority
GetCurrentThread
SetPriorityClass
ResumeThread
GetEnvironmentVariableA
GetShortPathNameA
GetStartupInfoA
GetTempPathA
FindResourceA
LoadResource
GetModuleHandleA
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
GetModuleFileNameA
SetFilePointer
ReadFile
CloseHandle
DeleteFileA
MoveFileExA
Sleep
GetSystemDirectoryA
SetFileAttributesA
GetTickCount
lstrcatA
GetCurrentProcess

user32

wsprintfA

advapi32

CloseServiceHandle
ControlService
DeleteService
StartServiceA
OpenSCManagerA
CreateServiceA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
OpenServiceA

msvcrt

__setusermatherr
_except_handler3
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_itoa
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

iphlpapi

GetAdaptersInfo

psapi

GetMappedFileNameW

Sections

yejotz
Size: 1.3MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ejouz
Size: 32B - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ejpuzek
Size: 32B - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pu
Size: 32B - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

zfkpuafk
Size: 32B - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

pvafkq
Size: 64B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

43a684f95fe6a1dc4c695734cfba80dd

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4dCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

iphlpapi

psapi

Sections

yejotz Size: 1.3MB - Virtual size: 1.5MB

ejouz Size: 32B - Virtual size: 204KB

ejpuzek Size: 32B - Virtual size: 52KB

pu Size: 32B - Virtual size: 252KB

zfkpuafk Size: 32B - Virtual size: 264KB

pvafkq Size: 64B - Virtual size: 28KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

yejotz
Size: 1.3MB - Virtual size: 1.5MB

ejouz
Size: 32B - Virtual size: 204KB

ejpuzek
Size: 32B - Virtual size: 52KB

pu
Size: 32B - Virtual size: 252KB

zfkpuafk
Size: 32B - Virtual size: 264KB

pvafkq
Size: 64B - Virtual size: 28KB