7413ed76cf129754941ebb1591f1efcf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7413ed76cf129754941ebb1591f1efcf_JaffaCakes118
Size

96KB
MD5

7413ed76cf129754941ebb1591f1efcf
SHA1

bace147fc8b7752c5cc496b0be330e8d5ef8d254
SHA256

96bcadea90a7eb22dc29028f08a3debf31b7ab4f9fc3cad7d15d6935654fade6
SHA512

5ae257606cff4937e62f4085efd419327daaffabbd10697578beee0e4c6e74d00eee0a019a698e110d6aa53ce20a6eee8cff291de31676c00513c17ada690c34
SSDEEP

1536:X0+7hW39Tu9qenT/Yh4irDYN+r/p9EAPitA6HL:k+C0naDYkrB9EA6tA6r

Score

1^/10

Malware Config

Signatures

Files

7413ed76cf129754941ebb1591f1efcf_JaffaCakes118
.exe windows:6 windows x86 arch:x86

55264a4a097a993a07bb501b9d751ad0

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:9e:69:da:6c:26:93:e3:29:7b:6f:e4:5d:78:eb:e1
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

23/06/2009, 00:00

Not After

03/08/2011, 23:59

Subject

CN=Lexmark International\, Inc.,OU=PS&SD BUSINESS SOFTWARE & SOLUTIONS,O=Lexmark International\, Inc.,L=Lexington,ST=Kentucky,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

8d:8d:6d:bc:5a:d7:fb:c6:17:a4:c1:d5:38:20:36:19:94:c1:d0:23
Signer

Actual PE Digest

8d:8d:6d:bc:5a:d7:fb:c6:17:a4:c1:d5:38:20:36:19:94:c1:d0:23

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileIntA
GetModuleFileNameA
SetLastError
Sleep
GetTickCount
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerA
CreateProcessA
FindFirstFileA
DeleteFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
SetCurrentDirectoryA
CreateNamedPipeA
DisconnectNamedPipe
FlushFileBuffers
CreateThread
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
GetSystemTime
CreateFileA
GetLastError
CloseHandle
ReadFile
WriteFile
ExpandEnvironmentStringsA
GetVersionExA
LoadLibraryA
lstrcpynA
GetProcAddress
HeapFree
HeapAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
ExitProcess
GetStdHandle
SetHandleCount
GetFileType
RtlUnwind
HeapSize
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection
GetConsoleCP
GetConsoleMode

wininet

InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetGetConnectedState

user32

PostMessageA
RegisterWindowMessageA

advapi32

SetSecurityDescriptorDacl
ControlService
DeleteService
StartServiceCtrlDispatcherA
CreateServiceA
QueryServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
SetServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor

Sections

.text
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55264a4a097a993a07bb501b9d751ad0

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

37:9e:69:da:6c:26:93:e3:29:7b:6f:e4:5d:78:eb:e1Certificate

Extended Key Usages

8d:8d:6d:bc:5a:d7:fb:c6:17:a4:c1:d5:38:20:36:19:94:c1:d0:23Signer

Headers

File Characteristics

Imports

kernel32

wininet

user32

advapi32

Sections

.text Size: 60KB - Virtual size: 57KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 2KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

37:9e:69:da:6c:26:93:e3:29:7b:6f:e4:5d:78:eb:e1
Certificate

8d:8d:6d:bc:5a:d7:fb:c6:17:a4:c1:d5:38:20:36:19:94:c1:d0:23
Signer

.text
Size: 60KB - Virtual size: 57KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 2KB