016a1a965c6db1d37f8649719ab9253c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

016a1a965c6db1d37f8649719ab9253c_JaffaCakes118
Size

304KB
MD5

016a1a965c6db1d37f8649719ab9253c
SHA1

9141fa6e02501c323c93a47e8b648e434279a770
SHA256

7f5e1aac29aec6f294818d8cf4f9b57c43814a1d38036ff3559bd910ad5b1897
SHA512

0c1dbf0bee4f5a4dceb972cd8e60e2001ff468b786290c7d13d7314d465379b68ac2df2f34f5fbe9172ae4ddbaabb1b0ff0870ee043de386f238625974a1d1b9
SSDEEP

6144:6zWu7Gtugd8xLckmbJfupm2jW+Dda1XFrIrrhJbbzRjv:6y4GtugdoINf8m2Y1IrXbtjv

Score

1^/10

Malware Config

Signatures

Files

016a1a965c6db1d37f8649719ab9253c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f3ab1f3e8b4d106760053c6bcc5d9c74

Code Sign

78:39:5d:13:85:61:23:40:ba:c5:49:c7:be:30:0c:02
Certificate

Issuer

CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk ibCMbd9lL8pIIjCwteEBoyqAvKl8xpE2eadL32vnntmMzbwiE8KqLj9dz27C6 e3xgrJx1qMpA8ph1ECE6vp6a19ycayDxj4kKe9nwq m2uDpzADfn7LJoK4Avv3aC8lAyzF657a dLbz6wKDo fyqpHkhIuoDtnMj63moH1LH kpysc7C1oarnDrcge82u6vEn9C5Cg eBmn4ofHoE9jwDBjs7ppbhte5aBM7vDlga8bqkooAbgC5frmB xpdnCyliI5rk8oEg lbwJhwtf4B9o4nw2EuAj 7KKx4Bdmx4l1I5wqiMCt swEt8ocCBissmsshaxK 798e3zjb4JcljIcMbMj Hv3lBoj9iwD7rqs4xH44FbuIzFJqJ82 GGbwazCEAF BwJtsB1bEeiunL38e3MtiEvG9kyfay1hI3L2nhzuexiLEw8MsLlbteqGexoe8x6fte48b6fngMucGjCg8FtD2pInb499fasdKh66pz 5gpa7769HJAeeCt5HvjfLzAif58yq8qIa9K9Du2v1sa4qe3hM364Kb22DLsp74KtzDkG2hMfLB FLuqmxihH985nmHBE5wwcBFh2bGma1lCvv2tI o7rqsuie9fxiznJJ45ypvK4hoG4nnFl6wJcaL7nzixqrMfj6plc37KwmGtnMjMx82v7FitClt8gkJIki3tlMlusDp6MjGvdDKyze8IbwJsnEsJwkvp DAEmqs2LvAf41ok7KbDxLAKBpk96dnLGl GhFkMesjgDICu 97JEci2qEncz1Le6222pIryI8wM2yICc6LwF1LkrzmbfL l8e3jg4Du2aAtJu694dkCzDp6D5Dcykj8qjbqg4HHIgfsfnouar37LADqssuBa7u3ylaFbavFxB2lxm7H2IhbwBs7tb3ecnHBF34G624Ms Kz1cHHjfIktEw7FI4mlyvI59 BavLBwDegLHzMzwC utElqqABpqrwAckopu1xhF9i4z2yCt1umz7ak8htino6DgGsEBAg5BseulszIvJtCA4vtqIjIurvdxpodor24w622HAMvh1edf5 x L1 qb7t6h47s4t2FI4qCG16eIhroiHBokaahjFrjFetFfM3JzvjFr6rGw1Lsd7h2v2nxiriCBHlhHzu997Awi1hgzyxc25kboql27q8dkqmjtKwj3cB4Clk1r2z1lgjntE cB7v th xwMBxlBi9K2sCezL2inLFmBBlac3wtldMqid83hbEJci5DxCsELernkxGpKLamEFm7BBHyH4xrf DvChDbIBxAvjmb5ejEvDryFEnBKnAlGHfGdrhc1EHHdslGgfCMFEGpnLcb24lbmgsGpHo3gEnGL8iamC6vgKJM91vIlmc3K2xf8p478It7oGMM456D6riCz17EAgHgxMnj8xbCaJamxHeA1977atEtJ4ckkmKsdG94embF9pIwlEw7mD7uh53JJdHsKBJrEm9 KB2ggmKc2J2y8s4vn79FnGzy6af1zKnH4lhrwzM7B6vvzxxMErLdy6r8iynEDruo8dF443JGsx7dnGpk279IK8DKBEAxdzhdcEmtoz7gmjosmKjk1A d8JolIEskxi4kIlv6agjFz7LAzAhJeGv75Kosqv1fM E89gd7bDxm3HDLILsnCy mvMpdgCj7qiaok3plu623gfznbaMbzlcA2LHM4g DcmnCu HvarxJf6pnqHiHvErxkw47rIhGunGE5KaEvqpmCMKMMmhvbkikv6b2n8Lz1mMLv8wse6jx9D7ELwhkMvzfavEb2jkJmHI7 61vhMmv6In6ayy4pAK9yq6q6qx6kvIn54cA387E og68bwKp13Lm1h7mhF2FJqe2zsxhC7npceznpsw2panuHfduGKcrL1nm1tlqKwqdx2nIr6oHDutJGm2uEKHAFJJ9I1LyypuIbxtvA7wvGx1v7 aaaaaaaaaaaaaaaaaaaaaaaaaa

Not Before

14/01/2013, 06:58

Not After

31/12/2039, 23:59

Subject

CN=jhjkkkkkkkkkkkkkkkkkkkkkkkkkkkk ibCMbd9lL8pIIjCwteEBoyqAvKl8xpE2eadL32vnntmMzbwiE8KqLj9dz27C6 e3xgrJx1qMpA8ph1ECE6vp6a19ycayDxj4kKe9nwq m2uDpzADfn7LJoK4Avv3aC8lAyzF657a dLbz6wKDo fyqpHkhIuoDtnMj63moH1LH kpysc7C1oarnDrcge82u6vEn9C5Cg eBmn4ofHoE9jwDBjs7ppbhte5aBM7vDlga8bqkooAbgC5frmB xpdnCyliI5rk8oEg lbwJhwtf4B9o4nw2EuAj 7KKx4Bdmx4l1I5wqiMCt swEt8ocCBissmsshaxK 798e3zjb4JcljIcMbMj Hv3lBoj9iwD7rqs4xH44FbuIzFJqJ82 GGbwazCEAF BwJtsB1bEeiunL38e3MtiEvG9kyfay1hI3L2nhzuexiLEw8MsLlbteqGexoe8x6fte48b6fngMucGjCg8FtD2pInb499fasdKh66pz 5gpa7769HJAeeCt5HvjfLzAif58yq8qIa9K9Du2v1sa4qe3hM364Kb22DLsp74KtzDkG2hMfLB FLuqmxihH985nmHBE5wwcBFh2bGma1lCvv2tI o7rqsuie9fxiznJJ45ypvK4hoG4nnFl6wJcaL7nzixqrMfj6plc37KwmGtnMjMx82v7FitClt8gkJIki3tlMlusDp6MjGvdDKyze8IbwJsnEsJwkvp DAEmqs2LvAf41ok7KbDxLAKBpk96dnLGl GhFkMesjgDICu 97JEci2qEncz1Le6222pIryI8wM2yICc6LwF1LkrzmbfL l8e3jg4Du2aAtJu694dkCzDp6D5Dcykj8qjbqg4HHIgfsfnouar37LADqssuBa7u3ylaFbavFxB2lxm7H2IhbwBs7tb3ecnHBF34G624Ms Kz1cHHjfIktEw7FI4mlyvI59 BavLBwDegLHzMzwC utElqqABpqrwAckopu1xhF9i4z2yCt1umz7ak8htino6DgGsEBAg5BseulszIvJtCA4vtqIjIurvdxpodor24w622HAMvh1edf5 x L1 qb7t6h47s4t2FI4qCG16eIhroiHBokaahjFrjFetFfM3JzvjFr6rGw1Lsd7h2v2nxiriCBHlhHzu997Awi1hgzyxc25kboql27q8dkqmjtKwj3cB4Clk1r2z1lgjntE cB7v th xwMBxlBi9K2sCezL2inLFmBBlac3wtldMqid83hbEJci5DxCsELernkxGpKLamEFm7BBHyH4xrf DvChDbIBxAvjmb5ejEvDryFEnBKnAlGHfGdrhc1EHHdslGgfCMFEGpnLcb24lbmgsGpHo3gEnGL8iamC6vgKJM91vIlmc3K2xf8p478It7oGMM456D6riCz17EAgHgxMnj8xbCaJamxHeA1977atEtJ4ckkmKsdG94embF9pIwlEw7mD7uh53JJdHsKBJrEm9 KB2ggmKc2J2y8s4vn79FnGzy6af1zKnH4lhrwzM7B6vvzxxMErLdy6r8iynEDruo8dF443JGsx7dnGpk279IK8DKBEAxdzhdcEmtoz7gmjosmKjk1A d8JolIEskxi4kIlv6agjFz7LAzAhJeGv75Kosqv1fM E89gd7bDxm3HDLILsnCy mvMpdgCj7qiaok3plu623gfznbaMbzlcA2LHM4g DcmnCu HvarxJf6pnqHiHvErxkw47rIhGunGE5KaEvqpmCMKMMmhvbkikv6b2n8Lz1mMLv8wse6jx9D7ELwhkMvzfavEb2jkJmHI7 61vhMmv6In6ayy4pAK9yq6q6qx6kvIn54cA387E og68bwKp13Lm1h7mhF2FJqe2zsxhC7npceznpsw2panuHfduGKcrL1nm1tlqKwqdx2nIr6oHDutJGm2uEKHAFJJ9I1LyypuIbxtvA7wvGx1v7 aaaaaaaaaaaaaaaaaaaaaaaaaa

Extended Key Usages

ExtKeyUsageCodeSigning

76:e4:1e:67:58:2b:01:d7:25:9b:a2:20:ca:fb:41:3b:e8:74:23:e5
Signer

Actual PE Digest

76:e4:1e:67:58:2b:01:d7:25:9b:a2:20:ca:fb:41:3b:e8:74:23:e5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
ExitProcess

user32

LoadIconA
LoadCursorA
ShowWindow

gdi32

GetStockObject

advapi32

OpenProcessToken
WriteEncryptedFileRaw
StartServiceW
SetSecurityDescriptorDacl
SetFileSecurityW
SetEntriesInAclW
ReportEventW
RegisterEventSourceW
RegUnLoadKeyW
AddAccessAllowedAce
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseEncryptedFileRaw
CloseServiceHandle
ControlService
DecryptFileW
DeleteAce
EncryptFileW
EnumDependentServicesW
EqualSid
FreeSid
GetAce
GetSecurityDescriptorDacl
GetTokenInformation
GetUserNameW
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceStatus
ReadEncryptedFileRaw
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExA
RegQueryValueExW
RegReplaceKeyW
RegRestoreKeyW
RegSaveKeyW
RegSetValueExW

msvcrt

_CxxThrowException
_XcptFilter
__CxxFrameHandler
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_c_exit
_cexit
_controlfp
_errno
_except_handler3
_exit
_fdopen
_filelength
_ftol
_getpid
_initterm
_local_unwind2
_mbscpy
_mbslen
_onexit
_open_osfhandle
_purecall
_putenv
_snwprintf
_tzset
_vsnwprintf
_wcmdln
_wcsdup
_wcsicmp
_wcslwr
_wcsnicmp
_wcsrev
_wcsupr
_wfopen
_wtoi
calloc
clearerr
exit
fclose
fflush
fread
free
fseek
ftell
fwrite
isalpha
isspace
localtime
malloc
memmove
mktime
realloc
swprintf
swscanf
time
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsstr
wcstok
wprintf

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata3
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3ab1f3e8b4d106760053c6bcc5d9c74

Code Sign

78:39:5d:13:85:61:23:40:ba:c5:49:c7:be:30:0c:02Certificate

Extended Key Usages

76:e4:1e:67:58:2b:01:d7:25:9b:a2:20:ca:fb:41:3b:e8:74:23:e5Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 271KB - Virtual size: 270KB

.data Size: 10KB - Virtual size: 10KB

ata3 Size: 512B - Virtual size: 100B

ata2 Size: 512B - Virtual size: 100B

ata Size: 512B - Virtual size: 100B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

78:39:5d:13:85:61:23:40:ba:c5:49:c7:be:30:0c:02
Certificate

76:e4:1e:67:58:2b:01:d7:25:9b:a2:20:ca:fb:41:3b:e8:74:23:e5
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 271KB - Virtual size: 270KB

.data
Size: 10KB - Virtual size: 10KB

ata3
Size: 512B - Virtual size: 100B

ata2
Size: 512B - Virtual size: 100B

ata
Size: 512B - Virtual size: 100B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB