89297b6e34fe933ff51bb801838d4c5d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

89297b6e34fe933ff51bb801838d4c5d_JaffaCakes118
Size

137KB
MD5

89297b6e34fe933ff51bb801838d4c5d
SHA1

8d814106459349395cdd3c91df24aae9af06926f
SHA256

96170d268adcccb30de10281c54d5334e4ba800da4bb6d55b7c988abc87f0b6c
SHA512

bf4b75f1a228ab4ea56b6d4f731dfa0ed241ae7c013ada8e83d674087a4b2538b473a6beb33e0127dde593bb82de337af55025c48c60afcda9884565655f0b9b
SSDEEP

1536:16IkvVa9xfVZm2QsU3pPZ3Qh74Lja+TXSoZTXRVjQcdsf3/UvH:pkNWfVE75PU4Ll+AhVjRdsfvUf

Score

1^/10

Malware Config

Signatures

Files

89297b6e34fe933ff51bb801838d4c5d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b2ef459fb975eee7c66068354377e505

Code Sign

91:82:4a:f1:9b:73:57:60
Certificate

Issuer

CN=I hold the world but as the world Gratiano

Not Before

13/02/2011, 09:16

Not After

09/11/2013, 09:16

Subject

CN=I hold the world but as the world Gratiano

1c:f4:33:32:29:63:c3:27:ae:7a:f8:ff:92:3b:7d:e2:f4:2a:3f:10
Signer

Actual PE Digest

1c:f4:33:32:29:63:c3:27:ae:7a:f8:ff:92:3b:7d:e2:f4:2a:3f:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyW
lstrcpyA
OutputDebugStringA
WinExec
GetProcessWorkingSetSize
CreateEventA
CloseHandle
CancelIo
AreFileApisANSI
GetSystemInfo
CopyFileW
FlushFileBuffers
LoadLibraryA
GetCurrentThreadId
GetVersionExW
CreateJobObjectA
GetLongPathNameA
GetFileAttributesA
CreateMutexA
SetFileAttributesW
GetCurrentProcessId
WaitForSingleObject
GetProcAddress
IsBadReadPtr
VirtualProtect
VirtualProtectEx
VirtualFree
VirtualAlloc
WaitForMultipleObjects
GetCurrentProcess
DisableThreadLibraryCalls

user32

GetForegroundWindow
GetParent
GetCursor
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
MessageBoxA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
GetDesktopWindow

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

Sections

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2ef459fb975eee7c66068354377e505

Code Sign

91:82:4a:f1:9b:73:57:60Certificate

1c:f4:33:32:29:63:c3:27:ae:7a:f8:ff:92:3b:7d:e2:f4:2a:3f:10Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1.0MB

.text Size: 129KB - Virtual size: 129KB

.rsrc Size: 3KB - Virtual size: 3KB

91:82:4a:f1:9b:73:57:60
Certificate

1c:f4:33:32:29:63:c3:27:ae:7a:f8:ff:92:3b:7d:e2:f4:2a:3f:10
Signer

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1.0MB

.text
Size: 129KB - Virtual size: 129KB

.rsrc
Size: 3KB - Virtual size: 3KB