8acc6b8bec67d0f81f3e38059a437f04_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8acc6b8bec67d0f81f3e38059a437f04_JaffaCakes118
Size

65KB
MD5

8acc6b8bec67d0f81f3e38059a437f04
SHA1

29731a4c9c97f8cfcaf49bca734ea5f11cf578af
SHA256

1fe4a61f796acdcde82daf8be0fc060f9f62aaf10a7ba3c4106ab04087c8b408
SHA512

567565f1e4ac0518bf3ce5b7bacca32be313f87f09114b1c43a2417edb0ff5fdab12d987ddcb6125dbba424c80a53ead179be08a9f4100795a99afdaddf3b16d
SSDEEP

1536:R681JNMFQec2zvDP6tb7G3REB27y+40niujTDpob:fDMF97DDP6tb7G6qnd3DpS

Score

1^/10

Malware Config

Signatures

Files

8acc6b8bec67d0f81f3e38059a437f04_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b289fc3d98e7f42d81d69f29f0221bd5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenSemaphoreA
SleepEx
InterlockedExchange
CreateFiber
GetProfileStringA
Heap32First
_lread
GetSystemTimeAdjustment
VirtualAlloc
GetDriveTypeA
WaitCommEvent
ClearCommBreak
IsValidCodePage
WaitForMultipleObjects
LocalFree
GetUserDefaultLangID
ReleaseSemaphore
CloseHandle
LocalUnlock
EraseTape
MapViewOfFile
LoadLibraryA
WriteProcessMemory
SetTimeZoneInformation
RequestDeviceWakeup
GetProcessVersion
DeleteFileA
DuplicateHandle
VirtualProtectEx
GetSystemPowerStatus
SetCommBreak
InterlockedCompareExchange
DisconnectNamedPipe
GetPrivateProfileStructA
DebugActiveProcess
SetConsoleCursorPosition
GetCurrentDirectoryA
LocalFileTimeToFileTime
HeapUnlock
BackupSeek
SetLocalTime
GetLongPathNameA
OpenProcess
OpenFileMappingA
CompareStringA
LoadModule
ContinueDebugEvent
LocalLock
AddAtomA
MoveFileA
DeleteAtom
WriteFile
FindResourceA
GetProcessHeaps
PurgeComm
GlobalFindAtomA
lstrcmp
BuildCommDCBA
WaitForSingleObject
Module32First
GetNumberOfConsoleMouseButtons
SetEnvironmentVariableA

shlwapi

PathSearchAndQualifyA
SHRegWriteUSValueA
AssocQueryStringA
SHIsLowMemoryMachine
StrRChrIA
StrSpnA
PathCommonPrefixA
PathMakePrettyA
HashData
PathStripToRootA
SHRegCreateUSKeyA
StrToIntExA
StrIsIntlEqualA
StrCSpnA
SHDeleteValueA
ColorHLSToRGB
PathQuoteSpacesA
UrlGetLocationA
PathIsFileSpecA
PathGetDriveNumberA
SHCreateStreamWrapper
SHAutoComplete
SHRegEnumUSKeyA
StrFormatByteSize64A
UrlCombineA
StrChrIA
PathIsRelativeA
PathAppendA

advapi32

CryptGenKey

Sections

.ipsnw
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ozw
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.udof
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.faz
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b289fc3d98e7f42d81d69f29f0221bd5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.ipsnw Size: 22KB - Virtual size: 45KB

.ozw Size: 5KB - Virtual size: 10KB

.udof Size: 1KB - Virtual size: 2KB

.faz Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.ipsnw
Size: 22KB - Virtual size: 45KB

.ozw
Size: 5KB - Virtual size: 10KB

.udof
Size: 1KB - Virtual size: 2KB

.faz
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB