21f55d7dfe9c8034421bd57771e16dd7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

21f55d7dfe9c8034421bd57771e16dd7_JaffaCakes118
Size

394KB
MD5

21f55d7dfe9c8034421bd57771e16dd7
SHA1

b5ee060ce2d02ee527b27e3252b6c0865524a5bb
SHA256

7b86d02140dd6e4b537d1ca6a7a7ec8df70caaece6db092b13da58633f055f9d
SHA512

d798cab09ce5f62f0bedfa8d816cf828becb5910ac5e2f92477e2c5f9857d286586da67d60ad863a5a820146c52b25ea8060d15efff21bece0687dcb3815bbc8
SSDEEP

6144:CmagLVRo82R4PU+ZLNbqSOzeoKcV9JR994ymUAV4gSrf8/Ud3dybsuDZMzsfm:rlVGzwBbqNV7XN84g+iUGguDZUse

Score

1^/10

Malware Config

Signatures

Files

21f55d7dfe9c8034421bd57771e16dd7_JaffaCakes118
.exe windows:5 windows x64 arch:x64

fadbe685a60700cee18fde3c7eb3128e

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17-09-2020 00:00

Not After

07-07-2021 12:00

Subject

SERIALNUMBER=0000783996,CN=NEEDCODE SP Z O O,O=NEEDCODE SP Z O O,L=KRAKÓW,C=PL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302504c

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:0f:31:93:81:ef:0e:54:d5:13:c7:94:d4:f1:db:5b:01:4f:06:f0
Signer

Actual PE Digest

1b:0f:31:93:81:ef:0e:54:d5:13:c7:94:d4:f1:db:5b:01:4f:06:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Izidu\Desktop\2019\thumbcacheviewer-master\thumbcacheviewer-master\thumbcache_viewer\x64\Release\thumbcache_viewer.pdb

Imports

kernel32

WaitForSingleObject
CreateSemaphoreW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
GetLastError
CreateDirectoryW
GetFileAttributesW
GetCurrentDirectoryW
GetCurrentProcessId
CreateThread
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
Sleep
InitializeCriticalSection
GetCommandLineW
GetFullPathNameW
LocalFree
DeleteCriticalSection
VirtualAlloc
FindResourceA
LoadResource
SizeofResource
ReleaseSemaphore
SetFilePointer
MultiByteToWideChar
ReadFile
WideCharToMultiByte
FileTimeToSystemTime
EnterCriticalSection
GetVolumeNameForVolumeMountPointW
LeaveCriticalSection
FindFirstFileExW
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
FreeLibrary
CloseHandle
FileTimeToDosDateTime
DosDateTimeToFileTime
VerSetConditionMask
VerifyVersionInfoW
SetErrorMode
LoadLibraryW
GetProcAddress
GetCurrentThreadId
GetSystemTimeAsFileTime

user32

InvalidateRect
SendNotifyMessageA
SendMessageW
SendMessageA
DrawTextW
SetWindowTextA
KillTimer
OffsetRect
GetCursorPos
GetKeyState
DefWindowProcW
GetWindowRect
EndPaint
DrawTextA
SetTimer
FillRect
GetSysColor
GetClientRect
BeginPaint
SetWindowPos
GetSysColorBrush
TrackPopupMenu
SetForegroundWindow
SetMenu
GetWindowLongPtrW
SetWindowLongPtrW
SetCursor
DestroyWindow
DestroyMenu
PostQuitMessage
IsWindowVisible
SetWindowTextW
IsIconic
MoveWindow
CallWindowProcW
CreateWindowExA
DrawEdge
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
CreatePopupMenu
CreateMenu
EnableMenuItem
MessageBoxA
DestroyIcon
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
ShowWindow
CheckMenuItem
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
GetSystemMetrics
ReleaseDC
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
EnableWindow
SetFocus
SystemParametersInfoW
GetDC
InsertMenuItemA

gdi32

SetBkMode
CreateCompatibleDC
CreateSolidBrush
SetBkColor
SetTextColor
BitBlt
DeleteDC
CreateFontIndirectW
SelectObject
GetTextMetricsW
CreateCompatibleBitmap
DeleteObject

comdlg32

GetSaveFileNameW
GetOpenFileNameW

shell32

DragAcceptFiles
SHGetFileInfoA
DragFinish
DragQueryFileW
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW

ole32

CreateStreamOnHGlobal
OleUninitialize
CoTaskMemFree
OleInitialize
CLSIDFromString

msvcr90

_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_amsg_exit
??3@YAXPEAX@Z
_wcslwr_s
wcsncpy_s
_wcsicmp
realloc
_wcstoui64
wcschr
atoi
wcsnlen
_wcsnicmp
_beginthreadex
wcstombs_s
wcscpy_s
_scwprintf
strchr
_endthreadex
swprintf_s
towlower
_wcsdup
sprintf_s
memset
memcpy_s
wcsstr
malloc
free

gdiplus

GdipCloneImage
GdipDisposeImage
GdipLoadImageFromStream
GdipAlloc
GdipFree
GdipDrawImageI
GdipDrawImage
GdipScaleWorldTransform
GdipSetInterpolationMode
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown

esent

JetSetSystemParameter
JetCreateInstance
JetInit
JetBeginSession
JetOpenTable
JetOpenDatabase
JetGetSystemParameter
JetCloseTable
JetCloseDatabase
JetGetTableColumnInfo
JetAttachDatabase
JetMove
JetRetrieveColumns
JetTerm
JetEndSession
JetDetachDatabase

Exports

Exports

hgDRWDASQWHAFtuCCADQSf

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fadbe685a60700cee18fde3c7eb3128e

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77Certificate

Key Usages

0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

1b:0f:31:93:81:ef:0e:54:d5:13:c7:94:d4:f1:db:5b:01:4f:06:f0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

shell32

ole32

msvcr90

gdiplus

esent

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 2KB - Virtual size: 12KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 261KB - Virtual size: 260KB

.reloc Size: 512B - Virtual size: 192B

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

1b:0f:31:93:81:ef:0e:54:d5:13:c7:94:d4:f1:db:5b:01:4f:06:f0
Signer

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 2KB - Virtual size: 12KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 261KB - Virtual size: 260KB

.reloc
Size: 512B - Virtual size: 192B