781ca71a56517d8c7c2411bd06195636_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

781ca71a56517d8c7c2411bd06195636_JaffaCakes118
Size

876KB
MD5

781ca71a56517d8c7c2411bd06195636
SHA1

cfdc94ff416f57dd5acbd7a82d49da7cde49b017
SHA256

1a5d865c2b10ada10e8e7dd7c007cd852b6d41160222fb7a7956881eb8447d6f
SHA512

c6c770b3ac17d41688d06c31250b8b4eeadf2f62c68ee4e8d4078c60c0d1f11c7a99abc5bf71ad970268e730d4482db4290f4177571fceb2b677b792fe85a574
SSDEEP

24576:gF/SghqYJNFtIKmB3Fj1/CEaqI7Y3hC6h3:gQnK+1j1aRqI8RC6h

Score

1^/10

Malware Config

Signatures

Files

781ca71a56517d8c7c2411bd06195636_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eb3b6c0730529869bd4a537c11937afc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01-02-2008 00:00

Not After

31-01-2009 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetComputerNameA
Heap32ListNext
GetOverlappedResult
ReadConsoleA
SetupComm
GetWindowsDirectoryA
CreateProcessA
FreeConsole
OpenSemaphoreA
GlobalFlags
GetProcessVersion
SetDefaultCommConfigA
WaitCommEvent
TerminateThread
CreateMailslotA
PrepareTape
InitializeCriticalSection
SizeofResource
GetCurrentProcessId
GetUserDefaultLangID
SetSystemTime
lstrcmp
ExitProcess
GetNumberFormatA
AreFileApisANSI
GetStringTypeExA
Beep
BuildCommDCBA
WriteProfileStringA
GetConsoleCursorInfo
GetCommState
GetAtomNameA
IsDBCSLeadByteEx
SetProcessShutdownParameters
DisconnectNamedPipe
GlobalFindAtomA
GetDriveTypeA
EnumDateFormatsA
WriteFile
FindCloseChangeNotification
PurgeComm
FillConsoleOutputAttribute
lstrcpyn
LocalAlloc
GetFullPathNameA
GlobalCompact
GetLocalTime
_lclose
VirtualAlloc
lstrlen
MulDiv
DebugActiveProcess
LocalUnlock
IsBadWritePtr
MapViewOfFile
GlobalReAlloc
ReadConsoleOutputA
GetPrivateProfileIntA
SetFileApisToOEM
RequestDeviceWakeup

shlwapi

SHRegCreateUSKeyA
SHCreateStreamWrapper
AssocQueryStringA
PathFileExistsA
StrFormatByteSize64A
UrlCombineA
PathIsUNCA
ColorHLSToRGB
PathCommonPrefixA
PathFindOnPathA
UrlIsOpaqueA
SHAutoComplete
PathMakePrettyA
StrToIntExA
SHRegWriteUSValueA
PathAppendA
PathQuoteSpacesA
PathSearchAndQualifyA
PathStripToRootA
SHDeleteValueA
StrRChrIA
SHRegEnumUSKeyA
StrCSpnA
StrIsIntlEqualA
SHIsLowMemoryMachine
HashData
UrlGetLocationA
PathRemoveBlanksA
SHRegOpenUSKeyA

user32

InsertMenuItemA

Sections

.dgpm
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gnyfo
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ajoj
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wxc
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mtk
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lanc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dqrk
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jsj
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.puv
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb3b6c0730529869bd4a537c11937afc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

user32

Sections

.dgpm Size: 638KB - Virtual size: 1.3MB

.gnyfo Size: 6KB - Virtual size: 8KB

.ajoj Size: 19KB - Virtual size: 27KB

.wxc Size: 512B - Virtual size: 21KB

.mtk Size: 6KB - Virtual size: 15KB

.lanc Size: 512B - Virtual size: 56B

.dqrk Size: 512B - Virtual size: 24B

.jsj Size: 48KB - Virtual size: 77KB

.puv Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.dgpm
Size: 638KB - Virtual size: 1.3MB

.gnyfo
Size: 6KB - Virtual size: 8KB

.ajoj
Size: 19KB - Virtual size: 27KB

.wxc
Size: 512B - Virtual size: 21KB

.mtk
Size: 6KB - Virtual size: 15KB

.lanc
Size: 512B - Virtual size: 56B

.dqrk
Size: 512B - Virtual size: 24B

.jsj
Size: 48KB - Virtual size: 77KB

.puv
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB