76679567adbdd3622a41da16c0ce0b0e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76679567adbdd3622a41da16c0ce0b0e_JaffaCakes118
Size

876KB
MD5

76679567adbdd3622a41da16c0ce0b0e
SHA1

8a1bf20080209964d7981c58b046d4fa5a4ad1c7
SHA256

1e3ef5c789893109a8d5f0f37e140db9e7ac3d977512ca78bc3cce9c3bf4d352
SHA512

a1bb32f86ebc9447527329c4c4c78aca21dc9c979538a9eae2f41343bab17ed7f45c73b1bd486182030c339b5e75e0c49e89a283eb03a30cdcc81660fbd99985
SSDEEP

12288:dKWeLrscHLB+rXw/MxE5g/u8ncbu8haAFXBEUCMGI3jZ485zEe4cSNtY9IxWkt15:dKtLLB/M2gWgcbV0AFRE3Odt554t1

Score

1^/10

Malware Config

Signatures

Files

76679567adbdd3622a41da16c0ce0b0e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aaa60a4b3a8a19ca9a4be939229ddb0d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugActiveProcess
GetSystemDirectoryA
SetCommBreak
SetConsoleTextAttribute
ClearCommBreak
UTRegister
GetStringTypeExA
GetCommConfig
FreeConsole
SetConsoleCtrlHandler
CreateProcessA
InterlockedIncrement
MulDiv
Beep
GetConsoleTitleA
GetLogicalDriveStringsA
GetCurrentProcessId
WriteProcessMemory
ResumeThread
lstrcmpi
EnumSystemLocalesA
WriteFile
TlsSetValue
CreateThread
FlushConsoleInputBuffer
IsBadWritePtr
WaitForMultipleObjects
GetFileAttributesExA
SetProcessAffinityMask
ReadConsoleOutputA
GetOverlappedResult
ResetEvent
SetEnvironmentVariableA
DuplicateHandle
IsBadReadPtr
TlsFree
SetStdHandle
WaitNamedPipeA
lstrcpyn
Thread32Next
GetLongPathNameA
WritePrivateProfileStringA
GetSystemPowerStatus
CommConfigDialogA
SetConsoleActiveScreenBuffer
ReadFileEx
QueueUserAPC
IsDBCSLeadByteEx
GetExitCodeThread
GetNumberFormatA
VirtualQueryEx
GetPrivateProfileStructA
SleepEx
LoadModule
_hread
InitializeCriticalSection
VirtualFree
InterlockedCompareExchange
Heap32ListNext
CompareStringA
SizeofResource

shlwapi

StrChrIA
StrCSpnA
StrIsIntlEqualA
PathIsFileSpecA
UrlCombineA
SHAutoComplete
PathStripToRootA
StrFormatByteSize64A
StrSpnA
SHRegOpenUSKeyA
SHRegWriteUSValueA
UrlGetLocationA
PathGetDriveNumberA
PathIsUNCA
SHCreateStreamWrapper
PathFindOnPathA
PathAppendA
PathQuoteSpacesA
SHDeleteValueA
StrToIntExA
PathRemoveBlanksA
SHRegCreateUSKeyA
SHRegEnumUSKeyA
PathSearchAndQualifyA
PathMakePrettyA
PathFileExistsA
UrlIsOpaqueA
SHIsLowMemoryMachine
AssocQueryStringA

advapi32

CopySid

Sections

.stcfm
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cdc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adyb
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ejsr
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cbq
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bujun
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ajyns
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xcxu
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fob
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aaa60a4b3a8a19ca9a4be939229ddb0d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.stcfm Size: 638KB - Virtual size: 1.3MB

.cdc Size: 6KB - Virtual size: 8KB

.adyb Size: 19KB - Virtual size: 27KB

.ejsr Size: 512B - Virtual size: 21KB

.cbq Size: 6KB - Virtual size: 15KB

.bujun Size: 512B - Virtual size: 56B

.ajyns Size: 512B - Virtual size: 24B

.xcxu Size: 48KB - Virtual size: 77KB

.fob Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.stcfm
Size: 638KB - Virtual size: 1.3MB

.cdc
Size: 6KB - Virtual size: 8KB

.adyb
Size: 19KB - Virtual size: 27KB

.ejsr
Size: 512B - Virtual size: 21KB

.cbq
Size: 6KB - Virtual size: 15KB

.bujun
Size: 512B - Virtual size: 56B

.ajyns
Size: 512B - Virtual size: 24B

.xcxu
Size: 48KB - Virtual size: 77KB

.fob
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB