6fb68eb728c04a13e0e4cce6b0e81bfd_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

6fb68eb728c04a13e0e4cce6b0e81bfd_JaffaCakes118
Size

389KB
MD5

6fb68eb728c04a13e0e4cce6b0e81bfd
SHA1

0d38d2b067327d811c4f4fa3f2301020ffdbde80
SHA256

5ab80287913a68916c32472c7f15a9e5deeae718b13bbabc44624f91f4f9c1a0
SHA512

d932b4cc46990b2bec13a55246919830457df92d5dce413894d3b1a60ef60196ef30eea8d6c40e416837417661e6416212861da87d43178b0a9ebeba3e334f17
SSDEEP

6144:B21/J/pD0Ze1LIm58inKPPYNIeT1TRPYBPLQj3XQzatIBCzxexDUNKfqOC:B2x09m58mNI2tPYNQj3XQ+ySuV

Score

1^/10

Malware Config

Signatures

Files

6fb68eb728c04a13e0e4cce6b0e81bfd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

883a70c4d920bcc464705d155ef2cc7a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:1b:ec:9b:d8:31:dc:e6:e3:8e:b5:16:72:70:49:10
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

11-04-2011 00:00

Not After

26-04-2012 23:59

Subject

CN=Netenrich Inc,OU=Engineering,O=Netenrich Inc,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:fd:e4:1c:59:52:81:3e:4c:21:9b:3e:6e:aa:71:a3:20:f1:08:a6
Signer

Actual PE Digest

21:fd:e4:1c:59:52:81:3e:4c:21:9b:3e:6e:aa:71:a3:20:f1:08:a6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

gethostname
ioctlsocket
__WSAFDIsSet
getservbyport
gethostbyaddr
getservbyname
htonl
inet_ntoa
gethostbyname
WSASetLastError
setsockopt
getpeername
getsockopt
bind
ntohs
getsockname
WSAStartup
socket
WSACleanup
inet_addr
htons
connect
closesocket
recv
send
select
WSAGetLastError

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
HeapSize
IsDebuggerPresent
HeapFree
HeapDestroy
GetThreadLocale
GetACP
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetCurrentProcessId
HeapReAlloc
QueryPerformanceCounter
ExpandEnvironmentStringsA
GetTickCount
GetSystemDirectoryA
SleepEx
FreeLibrary
GetVersionExA
LoadLibraryA
GetProcAddress
DeleteCriticalSection
LeaveCriticalSection
GetLocalTime
EnterCriticalSection
InitializeCriticalSection
GetModuleFileNameA
MultiByteToWideChar
CloseHandle
GetFileSize
WriteFile
WriteConsoleW
GetStdHandle
FormatMessageA
SetLastError
GetLastError
SetEndOfFile
SetFilePointer
CreateFileA
MoveFileExA
AllocConsole
WideCharToMultiByte
Sleep
WaitForSingleObject
SetThreadPriority
ResumeThread
CreateThread
SetEvent
ResetEvent
TerminateThread
CreateEventA
OpenEventA
WaitForMultipleObjects
ExitProcess
HeapAlloc
GetProcessHeap
CreateEventW
GetLocaleInfoA
GetSystemTimeAsFileTime

advapi32

RegQueryValueExW
RegOpenKeyW
RegCloseKey

msvcr80

_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_acmdln
exit
_crt_debugger_hook
_except_handler4_common
_controlfp_s
_initterm
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
memcpy_s
memchr
memmove_s
memset
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
__CxxFrameHandler3
fclose
fputs
fflush
sprintf
ftell
fopen
_time64
wcsstr
??_V@YAXPAX@Z
_vsnprintf
free
_fdopen
_dup2
_open_osfhandle
__iob_func
fprintf
remove
??0exception@std@@QAE@XZ
_endthreadex
printf
strchr
memcpy
strrchr
atoi
sscanf
_purecall
strncpy
strncmp
fputc
fwrite
fseek
tolower
calloc
realloc
malloc
strerror
__sys_nerr
_errno
fread
strtoul
strstr
memmove
strtol
isxdigit
_strtoi64
fgets
qsort
isdigit
strcpy_s
strncpy_s
sprintf_s
strcat_s
_beginthreadex
isspace
getenv
_gmtime64
isalnum
isalpha
_stricmp
_localtime64
_stat64
ferror
_snprintf
_invoke_watson
_strdup
_itoa
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead

Sections

.text
Size: 300KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

883a70c4d920bcc464705d155ef2cc7a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:1b:ec:9b:d8:31:dc:e6:e3:8e:b5:16:72:70:49:10Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

21:fd:e4:1c:59:52:81:3e:4c:21:9b:3e:6e:aa:71:a3:20:f1:08:a6Signer

Headers

File Characteristics

Imports

ws2_32

kernel32

advapi32

msvcr80

Sections

.text Size: 300KB - Virtual size: 298KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 8KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:1b:ec:9b:d8:31:dc:e6:e3:8e:b5:16:72:70:49:10
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

21:fd:e4:1c:59:52:81:3e:4c:21:9b:3e:6e:aa:71:a3:20:f1:08:a6
Signer

.text
Size: 300KB - Virtual size: 298KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 8KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 1KB