81f279d84cbfd7581046af8c54faede0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

81f279d84cbfd7581046af8c54faede0_JaffaCakes118
Size

2.6MB
MD5

81f279d84cbfd7581046af8c54faede0
SHA1

c774d3b090463f3f4d5086177e048869f9ce3776
SHA256

89c477c063a4fb232b2d7cc5c1dcbd398c8b38628fe09ef106564fe4aece101f
SHA512

3e971f37add6ef6acea895931e18ca52d01048607b3d040556b15f0a4166a56aed686d235affe5b3ff2f6225f66f18c78eaabee6235ad8a5283e94128d62f8d6
SSDEEP

49152:aEZ83Y8H2t7aT3em+jcdEPqeA3ZrN7RhHVifv4HcSrAte033oCp:akUWt7ab/acF3NN7RhHVi48S0tZ3Zp

Score

1^/10

Malware Config

Signatures

Files

81f279d84cbfd7581046af8c54faede0_JaffaCakes118
.sys windows:10 windows x86 arch:x86

a02cf62b967fe7f4c7361a92ecd38c93

Code Sign

25:87:f3:f4:de:6e:5a:a9:11:b5:bf:13:5a:27:82:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05/11/2018, 00:00

Not After

04/02/2020, 23:59

Subject

CN=生诚贸易（上海）有限公司,OU=IT,O=生诚贸易（上海）有限公司,L=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:d5:aa:27:7e:89:7c:99:34:8f:fd:ab:3c:4b:ce:0c
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/11/2018, 00:00

Not After

04/02/2020, 23:59

Subject

CN=生诚贸易（上海）有限公司,OU=IT,O=生诚贸易（上海）有限公司,L=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:b2:ee:01:2f:d7:15:08:93:8e:53:29:e9:c3:5d:a8:3c:5e:c8:35:ea:8e:79:41:a8:63:87:45:74:ad:ed:14
Signer

Actual PE Digest

cf:b2:ee:01:2f:d7:15:08:93:8e:53:29:e9:c3:5d:a8:3c:5e:c8:35:ea:8e:79:41:a8:63:87:45:74:ad:ed:14

Digest Algorithm

sha256

PE Digest Matches

true

3d:8e:0f:40:5f:56:0b:03:4e:bc:fd:5b:50:40:19:19:c3:c5:dd:c2
Signer

Actual PE Digest

3d:8e:0f:40:5f:56:0b:03:4e:bc:fd:5b:50:40:19:19:c3:c5:dd:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

fltmgr.sys

FltRegisterFilter

ntoskrnl.exe

KeEnterCriticalRegion
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

ExReleaseFastMutex
KeQueryPerformanceCounter

Sections

.text
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 535KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.b50
Size: 865KB - Virtual size: 865KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.b51
Size: 988KB - Virtual size: 988KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a02cf62b967fe7f4c7361a92ecd38c93

Code Sign

25:87:f3:f4:de:6e:5a:a9:11:b5:bf:13:5a:27:82:1bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

3c:d5:aa:27:7e:89:7c:99:34:8f:fd:ab:3c:4b:ce:0cCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

cf:b2:ee:01:2f:d7:15:08:93:8e:53:29:e9:c3:5d:a8:3c:5e:c8:35:ea:8e:79:41:a8:63:87:45:74:ad:ed:14Signer

3d:8e:0f:40:5f:56:0b:03:4e:bc:fd:5b:50:40:19:19:c3:c5:dd:c2Signer

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

hal

Sections

.text Size: 181KB - Virtual size: 180KB

.rdata Size: 535KB - Virtual size: 535KB

.data Size: 13KB - Virtual size: 30KB

PAGE Size: 7KB - Virtual size: 6KB

INIT Size: 34KB - Virtual size: 33KB

.b50 Size: 865KB - Virtual size: 865KB

.b51 Size: 988KB - Virtual size: 988KB

.reloc Size: 14KB - Virtual size: 14KB

.rsrc Size: 1024B - Virtual size: 760B

25:87:f3:f4:de:6e:5a:a9:11:b5:bf:13:5a:27:82:1b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

3c:d5:aa:27:7e:89:7c:99:34:8f:fd:ab:3c:4b:ce:0c
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

cf:b2:ee:01:2f:d7:15:08:93:8e:53:29:e9:c3:5d:a8:3c:5e:c8:35:ea:8e:79:41:a8:63:87:45:74:ad:ed:14
Signer

3d:8e:0f:40:5f:56:0b:03:4e:bc:fd:5b:50:40:19:19:c3:c5:dd:c2
Signer

.text
Size: 181KB - Virtual size: 180KB

.rdata
Size: 535KB - Virtual size: 535KB

.data
Size: 13KB - Virtual size: 30KB

PAGE
Size: 7KB - Virtual size: 6KB

INIT
Size: 34KB - Virtual size: 33KB

.b50
Size: 865KB - Virtual size: 865KB

.b51
Size: 988KB - Virtual size: 988KB

.reloc
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 760B