5bc0b082c0e069532cb31bd08bd4a2d4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5bc0b082c0e069532cb31bd08bd4a2d4_JaffaCakes118
Size

4.2MB
MD5

5bc0b082c0e069532cb31bd08bd4a2d4
SHA1

e48d322c3b1126ed4d51a0e50914d20fdc94c633
SHA256

3849944c5db10f13305f76c92c1a8c80bc37f6a0514c19ea4a2bbeae62438113
SHA512

2405d05220812ae9977213e3fd4f5474e2ac9be92f8da1c0a7bc9ebe541fbe77f1b006bb8b56b4b72e2b3bf681cbb7119da3c72190be22886a5503ea524ce210
SSDEEP

6144:JYmFNuwc2x+lVPYQg9/AoLZlc0WbO9lOuo+PpDM7xACEL/Ubde4:JNIwHxaVPYfXuNACm/Ub/

Score

1^/10

Malware Config

Signatures

Files

5bc0b082c0e069532cb31bd08bd4a2d4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f576f1eca16447cafa837204b2177422

Code Sign

e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

04-09-2020 00:00

Not After

04-09-2021 23:59

Subject

CN=VESNA\, OOO,O=VESNA\, OOO,POSTALCODE=195027,STREET=d. 51 litera E ofis 103B\, ul. Magnitogorskaya,L=Saint Petersburg,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01-01-2004 00:00

Not After

31-12-2028 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-03-2019 00:00

Not After

31-12-2028 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:f2:60:0b:69:04:87:82:bb:ab:fe:d6:bf:f7:30:98:64:c6:a7:79
Signer

Actual PE Digest

00:f2:60:0b:69:04:87:82:bb:ab:fe:d6:bf:f7:30:98:64:c6:a7:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
Sleep
VirtualAlloc
GetLastError
GetModuleHandleW
BackupRead
QueryInformationJobObject
GetCommandLineW
SetComputerNameW
OpenJobObjectW
FoldStringW
GetCommandLineA
GetTempPathA
GetQueuedCompletionStatus
TransactNamedPipe
CommConfigDialogW
EnumTimeFormatsW
GetCPInfoExW
DeleteVolumeMountPointA
SetTimeZoneInformation
EnumDateFormatsA
GetDateFormatW
HeapUnlock
SetThreadPriorityBoost
InterlockedExchange
RaiseException
SetCommState
LocalAlloc
GetVolumeNameForVolumeMountPointA
GetNumberOfConsoleMouseButtons
FileTimeToSystemTime
GetDiskFreeSpaceA
EnumSystemCodePagesA
IsBadReadPtr
CreateMutexA
GetThreadPriorityBoost
GetTimeZoneInformation
GetTempPathW
ContinueDebugEvent
IsValidLanguageGroup
FindCloseChangeNotification
OpenProcess
GetTickCount
GetProcessTimes
DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetEnvironmentVariableW
SetLastError
LoadLibraryW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToDosDateTime
FindClose
GetLogicalDriveStringsW
GetDriveTypeW
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
WinExec
GetWindowsDirectoryW
GetVersion
GetComputerNameW
SetPriorityClass
TerminateProcess
lstrcpynW
Process32NextW
Process32FirstW
WaitForSingleObject
CloseHandle
CreateMutexW
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
FindResourceW
LoadResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetLongPathNameW
GetSystemDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetModuleFileNameW

user32

CharToOemBuffA
DdeClientTransaction
BringWindowToTop
CharLowerBuffA
DefMDIChildProcA
UnhookWinEvent
SetWindowsHookExA
TabbedTextOutW
DrawTextW
CopyIcon
GetMessagePos
MessageBeep
DestroyCursor
RegisterWindowMessageW
ClientToScreen
DrawFocusRect
DrawEdge
DrawStateW
GetWindowDC
GetWindowLongW
ExitWindowsEx
SetWindowPos
UpdateWindow
EnumWindows
GetWindowTextW
GetWindowThreadProcessId
LoadIconW
SetForegroundWindow
ShowWindow
IsIconic
FindWindowW
TrackMouseEvent
GetClientRect
GetIconInfo
DestroyIcon
AppendMenuW
CreatePopupMenu
IsWindow
SetTimer
KillTimer
IsWindowVisible
PtInRect
LoadCursorW
SetCursor
ScreenToClient
GetCursorPos
RedrawWindow
InflateRect
SetWindowLongW
GetMenuItemInfoW
UnionRect
GetMenuBarInfo
LoadMenuW
GetSubMenu
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetMenuState
GetMenuItemID
GetMenuItemCount
FillRect
DrawIcon
InvalidateRect
GetWindowRect
GetParent
GetSystemMetrics
OffsetRect
ReleaseDC
GetDC
FrameRect
CopyRect
GetSysColor
LoadImageW
wsprintfW
LoadBitmapW
EnableWindow
SendMessageW
MessageBoxW
GrayStringW
DrawTextExW

gdi32

GetEnhMetaFileW
StrokePath
EngMultiByteToWideChar
GetColorAdjustment
GetTextExtentPointA
EnumFontFamiliesA
EngLineTo
GetBkColor
EndPath
GetLayout
CLIPOBJ_bEnum
SetMapperFlags
GetTextAlign
GdiEntry14
EnumFontsA
OffsetClipRgn
SelectClipRgn
STROBJ_vEnumStart
RestoreDC
SetICMProfileA
GdiGetLocalFont
GetKerningPairs
EngMultiByteToUnicodeN
RemoveFontResourceExW
GdiCreateLocalMetaFilePict
EnumObjects
SetBkMode
GetCharacterPlacementW
GetPixel
FONTOBJ_vGetInfo
GetViewportOrgEx
GdiQueryTable
GdiConvertMetaFilePict
MoveToEx
GdiPlayDCScript
CreateRoundRectRgn
CreatePatternBrush
SetBrushOrgEx
FillRgn
FrameRgn
BeginPath
GetBkMode
GetTextExtentPoint32W
GetCurrentObject
GetObjectW
SetDIBColorTable
GetDIBColorTable
CreatePen
CreateDIBSection
GetStockObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
BitBlt
DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
StretchBlt
CreateSolidBrush
CreateFontW
FillPath
CreateFontIndirectW
DPtoLP
GetMapMode
LPtoDP

advapi32

GetUserNameA
RegOpenKeyW
RegQueryValueExW
RegCloseKey
OpenProcessToken
RegQueryValueW
GetUserNameW
StartServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegSetValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW

shell32

ExtractAssociatedIconExW
DuplicateIcon
SHGetFolderPathW
SHInvokePrinterCommandA
SHBindToParent
FindExecutableW
SHLoadNonloadedIconOverlayIdentifiers
SHGetDiskFreeSpaceExW
SHBrowseForFolderA
SHBrowseForFolderW
DragQueryFileW
ShellExecuteEx
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderLocation
Shell_NotifyIconW
SHGetDesktopFolder

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CreateStreamOnHGlobal

shlwapi

StrStrIA
StrCmpNIW
PathFindExtensionW
PathStripToRootW
PathFileExistsW

comctl32

_TrackMouseEvent
InitCommonControlsEx

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text6
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text5
Size: 512B - Virtual size: 130B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f576f1eca16447cafa837204b2177422

Code Sign

e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1eCertificate

Extended Key Usages

Key Usages

01Certificate

Key Usages

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95Certificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

00:f2:60:0b:69:04:87:82:bb:ab:fe:d6:bf:f7:30:98:64:c6:a7:79Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 4.1MB - Virtual size: 4.1MB

.text6 Size: 512B - Virtual size: 130B

.text5 Size: 512B - Virtual size: 130B

.rsrc Size: 76KB - Virtual size: 75KB

e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e
Certificate

01
Certificate

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

00:f2:60:0b:69:04:87:82:bb:ab:fe:d6:bf:f7:30:98:64:c6:a7:79
Signer

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 4.1MB - Virtual size: 4.1MB

.text6
Size: 512B - Virtual size: 130B

.text5
Size: 512B - Virtual size: 130B

.rsrc
Size: 76KB - Virtual size: 75KB