76f348919deef9dfa0b2ae733881d3eb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

76f348919deef9dfa0b2ae733881d3eb_JaffaCakes118
Size

1.9MB
MD5

76f348919deef9dfa0b2ae733881d3eb
SHA1

9363555bff822c7ea71d4d7ce9848777612e00be
SHA256

77b8fac3e8b49cbd8e0716ddc7de3dc8b509b725e78fd31a2d4ae25cb7d6ba99
SHA512

b954312ad63aa8e2672c207cc2240a58060c951b0d4d98a1c33c9751e65b5cf04a26658a962ddeb28eb23dccd5a0f27e77f2f0415150566126977bc08542fab5
SSDEEP

24576:5TrHQsupA3tXZHMRcDAcMj/gJYIagtiArmgSOiP0YnzPPDPVChqY:5T7Qs13XHMRdgLaAbDiPH7PDPVChqY

Score

1^/10

Malware Config

Signatures

Files

76f348919deef9dfa0b2ae733881d3eb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e29afbfb52dc8426384a65d4695b86ec

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

62:fa:a7:3a:27:ec:4c:ea:15:25:f1:0f:9f:61:8a:6f:36:d4:fe:a8
Signer

Actual PE Digest

62:fa:a7:3a:27:ec:4c:ea:15:25:f1:0f:9f:61:8a:6f:36:d4:fe:a8

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\pptview\x86\ship\0\pptview.pdb

Imports

msvcr80

_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_fpreset
rand
wcsstr
wcstod
_wcsnicmp
iswspace
wcschr
memmove
_wtoi
_configthreadlocale
_CIasin
_CIacos
_CIsinh
_CIcosh
_CItanh
floor
_CIexp
_CIlog
_CIsqrt
_CIatan
_CItan
_finite
_CIpow
_CIcos
_CIsin
_wcsicmp
strncmp
ceil
wcsncmp
_set_purecall_handler
_CxxThrowException
memset
memcpy
__setusermatherr
_CIfmod
vswprintf_s
_vscwprintf
_fpclass
_CIatan2
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_crt_debugger_hook
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
_adjust_fdiv

kernel32

FindFirstFileW
GetTempPathW
WriteFile
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
ResetEvent
WaitForMultipleObjects
SetEvent
GetCurrentThread
SetThreadPriority
CreateEventW
ResumeThread
CreateThread
GetPrivateProfileStringA
Sleep
GetUserDefaultLCID
lstrcmpW
LocalFree
GetLocalTime
GetFullPathNameW
FindResourceExA
EnumCalendarInfoA
GetUserDefaultLangID
GetLocaleInfoW
GetLocaleInfoA
EnumTimeFormatsA
EnumDateFormatsA
EnumTimeFormatsW
EnumDateFormatsW
GetSystemDefaultLCID
IsValidCodePage
GetOEMCP
VirtualProtect
FindClose
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
lstrlenW
DeleteFileW
SetErrorMode
GetStartupInfoW
CreateProcessW
GetTempFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
WaitForSingleObject
GetTickCount
CreateEventA
GetCurrentThreadId
GetCommandLineW
CreateFileW
GetFileSize
ReadFile
SetFilePointer
GetCurrentDirectoryW
GetLongPathNameW
SetCurrentDirectoryW
CloseHandle
GetVersionExA
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
LoadLibraryA
GetACP
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiA
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetVersion
FindResourceW
SizeofResource
LoadResource
LockResource
GetStringTypeExW
GetSystemDefaultLangID
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MulDiv
GlobalAlloc
GlobalSize
RaiseException
GlobalUnlock
GlobalLock
GlobalFree
GlobalMemoryStatus
IsValidLocale
TlsAlloc
FormatMessageW
TlsSetValue
TlsGetValue
TlsFree
FoldStringW
GetStringTypeW
CompareStringW
HeapSize
HeapFree
HeapAlloc
LocalAlloc
QueryPerformanceCounter

gdi32

LPtoDP
CreateBitmap
CreateCompatibleBitmap
GetTextAlign
DeleteMetaFile
DeleteEnhMetaFile
CopyMetaFileA
GetMetaFileW
CopyEnhMetaFileA
SetStretchBltMode
StretchDIBits
CreateFontA
EnumFontFamiliesExA
GetBitmapBits
TextOutW
GetGlyphOutlineW
GetCharABCWidthsA
GetKerningPairsA
Escape
GetViewportExtEx
GetWindowExtEx
CreatePen
IntersectClipRect
RestoreDC
GetEnhMetaFileW
GetTextFaceA
GetFontData
CreateFontIndirectW
CreateHalftonePalette
EndPage
StartPage
EndDoc
StartDocW
GetCharWidthA
GetCharWidthW
GetTextCharset
ExtTextOutW
StretchBlt
OffsetViewportOrgEx
CreateDIBSection
CreateCompatibleDC
GetClipBox
MoveToEx
LineTo
GetCurrentObject
AnimatePalette
Pie
GdiFlush
Rectangle
Polygon
Ellipse
GetViewportOrgEx
SetTextAlign
SetBkMode
SetTextColor
EnumMetaFile
EnumEnhMetaFile
PlayMetaFileRecord
PlayEnhMetaFileRecord
CreateSolidBrush
BitBlt
CreateDCW
SetMapMode
SetWindowOrgEx
DeleteDC
GetRasterizerCaps
GetObjectW
CreatePalette
GetSystemPaletteUse
GetSystemPaletteEntries
GetPaletteEntries
UpdateColors
GetRgnBox
SelectPalette
RealizePalette
GetTextColor
SelectClipRgn
GetStockObject
SetBkColor
ExtTextOutA
CreateRectRgn
OffsetRgn
CreateRectRgnIndirect
CombineRgn
SetViewportOrgEx
GetTextMetricsA
GetDeviceCaps
SelectObject
CreateFontIndirectA
GetObjectA
DeleteObject
EnumFontFamiliesExW
GetOutlineTextMetricsW
GetTextMetricsW
GetTextFaceW
GetTextCharsetInfo
SaveDC

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
CryptGenRandom
RegQueryValueExW

ole32

CoCreateInstance
OleLockRunning
StgOpenStorageOnILockBytes
GetHGlobalFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
GetHGlobalFromILockBytes
CreateStreamOnHGlobal
StgOpenStorage
CoInitialize
CoUninitialize
StringFromGUID2

oleaut32

SysFreeString
VariantInit
SysAllocString
SysStringLen
VariantCopy
SysAllocStringLen
GetErrorInfo
VarR8FromStr
VariantChangeTypeEx
VariantClear

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

mpr

WNetGetConnectionW

Exports

Exports

_MsoDeletePx@12
_MsoEmptyPx@4
_MsoFCompactPx@8
_MsoFGrowPx@8
_MsoFInitPx@12
_MsoFInsertPx@12
_MsoFIsDefault@8
_MsoFIsNinch@8
_MsoFIsValidOpid@4
_MsoFIsValidValue@8
_MsoFLookupPx@16
_MsoFRemovePx@12
_MsoFResizePx@12
_MsoGetPropSetDefault@8
_MsoIAppendPx@8
_MsoPopinfoGet@4
_MsoPopsinfoGet@4

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e29afbfb52dc8426384a65d4695b86ec

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

62:fa:a7:3a:27:ec:4c:ea:15:25:f1:0f:9f:61:8a:6f:36:d4:fe:a8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

kernel32

gdi32

advapi32

ole32

oleaut32

version

urlmon

mpr

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.data Size: 39KB - Virtual size: 319KB

.tls Size: 512B - Virtual size: 21B

.rsrc Size: 131KB - Virtual size: 130KB

.reloc Size: 87KB - Virtual size: 87KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

62:fa:a7:3a:27:ec:4c:ea:15:25:f1:0f:9f:61:8a:6f:36:d4:fe:a8
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 39KB - Virtual size: 319KB

.tls
Size: 512B - Virtual size: 21B

.rsrc
Size: 131KB - Virtual size: 130KB

.reloc
Size: 87KB - Virtual size: 87KB