69c0fb07dbde19f8fa04308a395cc836_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

69c0fb07dbde19f8fa04308a395cc836_JaffaCakes118
Size

304KB
MD5

69c0fb07dbde19f8fa04308a395cc836
SHA1

fdfe93b6d66745c2b398aa1dcea66e1f6621414c
SHA256

c9d3b6d8b5813aa58a4f8449bfad6e88b96894f827f81469520a72829f60e7dc
SHA512

e82ca6c2261b130d9440a857b61d06f180c61223c9d90c834cde220b6cee051a8b538f5b6e79b0489b8ce7e5a818c7d0589737f226fc595baa35d9ce9c45b0a6
SSDEEP

6144:vsQU+xdNzh0z2m6waiXlSIYSqdOYeQm19xOqXsPeED:PU+G2eF1SHddOGM9x/hy

Score

1^/10

Malware Config

Signatures

Files

69c0fb07dbde19f8fa04308a395cc836_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d27ab98e108d8d2321141c8c69d20cee

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

Issuer

CN=55666123h

Not Before

14/02/2012, 20:22

Not After

31/12/2039, 23:59

Subject

CN=55666123h

Extended Key Usages

ExtKeyUsageCodeSigning

d3:7b:d2:93:eb:57:b1:ff:c3:2d:cc:cd:64:04:0f:a7:ee:38:5e:a5
Signer

Actual PE Digest

d3:7b:d2:93:eb:57:b1:ff:c3:2d:cc:cd:64:04:0f:a7:ee:38:5e:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
lstrlenW
lstrcpyW
CreateFileW
VirtualAlloc
LockResource
GetLogicalDriveStringsW
QueueUserWorkItem
SetFileAttributesW
GetTempPathW
GetWindowsDirectoryA
UnregisterWait
ChangeTimerQueueTimer
_hwrite
CreateEventW
OpenWaitableTimerW
VirtualFreeEx
FlushConsoleInputBuffer
CloseHandle
CreateFileMappingW
SetConsoleActiveScreenBuffer
GetProcessAffinityMask
GetSystemDirectoryA
FindAtomA
GetConsoleCursorInfo
TransmitCommChar
GetCurrencyFormatW
GetCurrentThread
GetFileAttributesA
Module32NextW
MapViewOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetConsoleAliasW
ReadFile
OpenEventA
LocalShrink
SetStdHandle
ClearCommBreak
UnlockFile
GetTickCount
WinExec
FindResourceExW
VerifyVersionInfoW
GetMailslotInfo
GetComputerNameA
GetSystemInfo
CreateDirectoryExA
CreateJobObjectA
GetSystemWindowsDirectoryA
SetMailslotInfo
FindAtomW
GetDriveTypeW
SetPriorityClass
SetHandleCount
OpenMutexW
WriteProfileSectionA
ReplaceFileA
CopyFileExA
SetConsoleScreenBufferSize
_llseek
EnumSystemCodePagesA
ExpandEnvironmentStringsW
CopyFileA
GetCalendarInfoW
ContinueDebugEvent
ReadConsoleInputW
TlsFree
CreateRemoteThread
GetBinaryTypeA
ReadConsoleOutputA
SetTapePosition
Process32NextW
Module32FirstW
LocalLock
LocalAlloc
GetStringTypeW
HeapCreate
GetStdHandle
AddAtomA
ReleaseMutex
PrepareTape
FindCloseChangeNotification
PulseEvent
SetSystemTimeAdjustment
SetFilePointer
HeapUnlock
EnumResourceTypesW
GlobalUnlock
VerifyVersionInfoA
PeekNamedPipe
FindNextFileW
FlushViewOfFile
AddAtomW
GetTempFileNameA
InitializeCriticalSectionAndSpinCount
SetErrorMode
WritePrivateProfileSectionW
GetSystemDefaultUILanguage
CreateTimerQueueTimer
UpdateResourceW
DisconnectNamedPipe
OutputDebugStringA
HeapCompact
ExitProcess
Module32Next
GetCurrentThreadId
GetConsoleWindow
WriteFileEx
EnumSystemLanguageGroupsW
LoadLibraryW
FindFirstVolumeA
HeapSize
ReleaseSemaphore
lstrcpyn
FindFirstVolumeW
CancelTimerQueueTimer
MoveFileWithProgressW
FindFirstChangeNotificationA
DefineDosDeviceW
SetThreadLocale
FindVolumeClose
lstrlenA
GetModuleFileNameW
EnumCalendarInfoExA
SetConsoleCursorInfo
GetConsoleAliasExesLengthA
EnumDateFormatsExW
GetComputerNameExW
lstrcatA
DeleteFiber
CancelDeviceWakeupRequest
InterlockedDecrement
SetCommBreak
GetDiskFreeSpaceA
CreateMutexW
EnumSystemLocalesA
GetSystemDefaultLangID
FillConsoleOutputAttribute
GetCommTimeouts

advapi32

RegOpenKeyExW

ole32

OleSetAutoConvert
MonikerCommonPrefixWith
StgConvertVariantToProperty
CoBuildVersion
CoUnmarshalHresult
OleGetAutoConvert
CoGetCallContext
UtConvertDvtd32toDvtd16
CreateDataCache
HGLOBAL_UserUnmarshal
CoRegisterMessageFilter
HMETAFILEPICT_UserFree
CoCreateInstanceEx
CLIPFORMAT_UserFree
StgOpenPropStg
CreateOleAdviseHolder
CreatePointerMoniker
HMETAFILE_UserFree
CoResumeClassObjects
WriteOleStg
OleCreateMenuDescriptor
StgIsStorageFile
WriteClassStg
CLSIDFromString
SNB_UserFree
STGMEDIUM_UserUnmarshal
StgCreatePropStg
GetHookInterface
StgCreateStorageEx
FmtIdToPropStgName
DcomChannelSetHResult
OleCreateFromFile
UtGetDvtd16Info
CoQueryReleaseObject
StgOpenAsyncDocfileOnIFillLockBytes
CoAddRefServerProcess
OleRegEnumFormatEtc
HWND_UserSize
HICON_UserMarshal
OleSaveToStream
HBRUSH_UserSize
OleCreateLinkFromDataEx
CoSetProxyBlanket
HPALETTE_UserSize
OleInitialize
OleConvertIStorageToOLESTREAMEx
CoGetObjectContext
HBITMAP_UserSize
MonikerRelativePathTo
CreateStdProgressIndicator
OleCreateFromData
OleGetClipboard
OleQueryCreateFromData
OleDestroyMenuDescriptor
StgCreateDocfileOnILockBytes
CoCreateFreeThreadedMarshaler
CoRevertToSelf
CoDisconnectObject
DoDragDrop
FreePropVariantArray
HkOleRegisterObject
CoRegisterPSClsid
HMETAFILE_UserSize
OleFlushClipboard
CoGetApartmentID
CoUnloadingWOW
GetRunningObjectTable
OleUninitialize
StringFromGUID2
STGMEDIUM_UserSize
CoMarshalHresult
PropVariantClear
OleCreateStaticFromData
SNB_UserUnmarshal
PropStgNameToFmtId
HMETAFILEPICT_UserSize
CoCreateInstance
HENHMETAFILE_UserFree
HENHMETAFILE_UserUnmarshal
HMETAFILEPICT_UserUnmarshal
HMENU_UserUnmarshal
CreateGenericComposite
SetDocumentBitStg
OleConvertOLESTREAMToIStorageEx
DllDebugObjectRPCHook
WdtpInterfacePointer_UserMarshal
OleBuildVersion
StgSetTimes
CoGetCallerTID
CoTestCancel
HMENU_UserMarshal
CoSuspendClassObjects
HACCEL_UserMarshal
CoGetCurrentProcess
CoGetStdMarshalEx
HWND_UserMarshal
HGLOBAL_UserFree
CLIPFORMAT_UserUnmarshal
OleDoAutoConvert
HPALETTE_UserUnmarshal
OleCreateDefaultHandler
OleRegEnumVerbs
OleSetMenuDescriptor
CoGetInstanceFromFile
ReadClassStg
StringFromIID
CoRevokeMallocSpy
OleCreateLink
CoDeactivateObject
CoImpersonateClient
HBRUSH_UserFree
CoCancelCall
OleCreate
CoGetCurrentLogicalThreadId
HMENU_UserFree
CreateILockBytesOnHGlobal

comctl32

ImageList_LoadImage
InitializeFlatSB
CreatePropertySheetPageW
ImageList_Read
ImageList_DrawEx
ImageList_GetDragImage
ord2
PropertySheetA
DrawStatusText
ImageList_GetBkColor
InitMUILanguage
ord13
DestroyPropertySheetPage
FlatSB_GetScrollProp
ImageList_AddMasked
ImageList_SetDragCursorImage
ImageList_DragEnter
ImageList_GetImageCount
ImageList_SetFilter
InitCommonControlsEx
ImageList_GetImageRect
ImageList_Remove
GetMUILanguage
PropertySheet
FlatSB_GetScrollRange
CreatePropertySheetPage
ImageList_SetImageCount
CreateStatusWindow
FlatSB_EnableScrollBar
FlatSB_SetScrollProp
DrawStatusTextW
ImageList_LoadImageA
ImageList_GetImageInfo
FlatSB_SetScrollRange
ImageList_Draw
FlatSB_SetScrollPos
ImageList_DragShowNolock
ord6
ImageList_GetIconSize
ord16
ImageList_Merge
ord4
ImageList_EndDrag
ord14
ImageList_Replace
CreateToolbarEx
ImageList_BeginDrag
ord17
ord5
ImageList_Destroy
ImageList_Copy
ImageList_Write
ImageList_Duplicate
ord3
ImageList_Add
ord15
FlatSB_SetScrollInfo
FlatSB_GetScrollInfo
CreatePropertySheetPageA
FlatSB_ShowScrollBar
ImageList_AddIcon
ImageList_LoadImageW
ImageList_DrawIndirect
PropertySheetW
ImageList_ReplaceIcon
_TrackMouseEvent
CreateStatusWindowW
UninitializeFlatSB
ImageList_Create
ImageList_DragLeave
ImageList_GetIcon
ord7
ImageList_SetIconSize

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV2
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textF4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV3
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV4
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV1
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d27ab98e108d8d2321141c8c69d20cee

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86Certificate

Extended Key Usages

d3:7b:d2:93:eb:57:b1:ff:c3:2d:cc:cd:64:04:0f:a7:ee:38:5e:a5Signer

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

comctl32

Sections

.text Size: 4KB - Virtual size: 4KB

.textV2 Size: 278KB - Virtual size: 278KB

.textF4 Size: 2KB - Virtual size: 2KB

.textV3 Size: 512B - Virtual size: 500B

.textV4 Size: 512B - Virtual size: 500B

.textV1 Size: 512B - Virtual size: 500B

.data Size: 9KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 1KB

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

d3:7b:d2:93:eb:57:b1:ff:c3:2d:cc:cd:64:04:0f:a7:ee:38:5e:a5
Signer

.text
Size: 4KB - Virtual size: 4KB

.textV2
Size: 278KB - Virtual size: 278KB

.textF4
Size: 2KB - Virtual size: 2KB

.textV3
Size: 512B - Virtual size: 500B

.textV4
Size: 512B - Virtual size: 500B

.textV1
Size: 512B - Virtual size: 500B

.data
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 1KB