77669d11c3248a6553d3c15cd1d8a60e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

77669d11c3248a6553d3c15cd1d8a60e_JaffaCakes118
Size

478KB
MD5

77669d11c3248a6553d3c15cd1d8a60e
SHA1

880947995d46e5528c423153d8b644c41bd0ad6b
SHA256

3f7c3bd8619fcbf81d21b9cc259dcdf857c4570065315934de497b88bca06708
SHA512

d17e22cebb6a0695412ab99624909fd07928bcbbeda13a61fa717afb98553568c30bd195d27d4bf3aab010f26d23f39e18159c3a98498cabf3631312c82449a0
SSDEEP

6144:xDPl2LAAvkKTirsQ41cHreVXIa7VDfb8uAu/I/:CbqsQN4XIa7VDfb8uAu/I/

Score

1^/10

Malware Config

Signatures

Files

77669d11c3248a6553d3c15cd1d8a60e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

271d70dd846925e037912b3afaa6e9ec

Code Sign

01:a5
Certificate

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Not Before

13-08-1998 00:29

Not After

13-08-2018 23:59

Subject

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

01:00:00:00:00:01:1f:71:31:72:c9
Certificate

Issuer

CN=Cybertrust SureServer CA,O=GlobalSign Inc

Not Before

13-02-2009 19:00

Not After

13-02-2011 19:00

Subject

CN=inpack.syniverse.com,OU=Crossroads,O=Syniverse Technologies Inc.,L=Tampa,ST=Florida,C=US,1.2.840.113549.1.9.1=#0c1f62656c696e64612e6a61626c6f6e736b694073796e6976657273652e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

04:00:03:cb
Certificate

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Not Before

16-02-2005 19:14

Not After

16-02-2012 23:59

Subject

CN=Cybertrust SureServer CA,O=GlobalSign Inc

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:9b:ea:5f:8d:1b:ed:1f:bc:09:18:68:a2:40:3a:4d:e9:d0:b5:b2
Signer

Actual PE Digest

74:9b:ea:5f:8d:1b:ed:1f:bc:09:18:68:a2:40:3a:4d:e9:d0:b5:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\KerKey\KerKey(일반)\KerKey\release\KerKey.pdb

Imports

shlwapi

PathFindFileNameA
PathIsUNCA
PathStripToRootA
SHEnumKeyExA

advapi32

OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryValueExA
LookupAccountSidA
RegCreateKeyA
RegOpenKeyExA
RegCloseKey

psapi

GetModuleFileNameExA

setupapi

SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceRegistryPropertyA
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoA

newdev

UpdateDriverForPlugAndPlayDevicesA

kernel32

GetCurrentProcessId
LeaveCriticalSection
TlsGetValue
EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GetModuleHandleA
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
HeapSize
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
GlobalFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetACP
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GlobalAlloc
GlobalLock
CreateFileA
OpenFile
lstrlenA
_lwrite
Process32First
_lclose
GetTickCount
GetWindowsDirectoryA
OpenProcess
WideCharToMultiByte
Sleep
GetFileAttributesA
GetSystemDirectoryA
GetStdHandle
CompareStringW
MultiByteToWideChar
InterlockedExchange
GetLastError
SetLastError
SetFileAttributesA
GetLocalTime
Process32Next
LocalAlloc
DeviceIoControl
GetModuleFileNameA
CreateMutexA
GetCurrentDirectoryA
CreateToolhelp32Snapshot
CompareStringA
GetVersionExA
CloseHandle
GetVersion
LocalFree
DeleteFileA
CreateThread
lstrcpyA
SizeofResource
LockResource
GlobalUnlock
FormatMessageA
GetFileTime
SetFileTime
SystemTimeToFileTime
LoadResource
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetProcAddress
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetThreadLocale
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
LoadLibraryA
FindResourceA

user32

DestroyMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SetWindowTextA
RegisterWindowMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
GetDlgItem
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
GetClassInfoExA
GetClassInfoA
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
ClientToScreen
DrawTextExA
DrawTextA
TabbedTextOutA
UnregisterClassA
RegisterClassA
GetWindowThreadProcessId
LoadCursorA
DispatchMessageA
DefWindowProcA
SetWindowsHookExA
CallNextHookEx
CreateWindowExA
MapVirtualKeyA
GetWindowTextA
GetWindowModuleFileNameA
GetForegroundWindow
TranslateMessage
SendMessageA
FindWindowExA
wsprintfA
CharUpperA
LoadIconA
GetParent
GetKeyState
GetTopWindow
PostQuitMessage
GetMessageA
PeekMessageA
ValidateRect
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnhookWindowsHookEx
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetSystemMetrics
GrayStringA

gdi32

SetBkColor
RestoreDC
SetTextColor
SetMapMode
GetClipBox
DeleteObject
SaveDC
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetDeviceCaps
GetStockObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

oleaut32

VariantInit
VariantClear
VariantChangeType

Sections

.text
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 304KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

271d70dd846925e037912b3afaa6e9ec

Code Sign

01:a5Certificate

01:00:00:00:00:01:1f:71:31:72:c9Certificate

Key Usages

04:00:03:cbCertificate

Key Usages

74:9b:ea:5f:8d:1b:ed:1f:bc:09:18:68:a2:40:3a:4d:e9:d0:b5:b2Signer

Headers

File Characteristics

PDB Paths

Imports

shlwapi

advapi32

psapi

setupapi

newdev

kernel32

user32

gdi32

comdlg32

winspool.drv

oleaut32

Sections

.text Size: 132KB - Virtual size: 129KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 304KB - Virtual size: 1.4MB

.rsrc Size: 4KB - Virtual size: 720B

01:a5
Certificate

01:00:00:00:00:01:1f:71:31:72:c9
Certificate

04:00:03:cb
Certificate

74:9b:ea:5f:8d:1b:ed:1f:bc:09:18:68:a2:40:3a:4d:e9:d0:b5:b2
Signer

.text
Size: 132KB - Virtual size: 129KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 304KB - Virtual size: 1.4MB

.rsrc
Size: 4KB - Virtual size: 720B