8d005bf5b2bf2324d17c19f10e12f82a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8d005bf5b2bf2324d17c19f10e12f82a_JaffaCakes118
Size

239KB
MD5

8d005bf5b2bf2324d17c19f10e12f82a
SHA1

75c57cff3f142035993b8a6dfa627012eef700d7
SHA256

1380e1f55e4f8aa3d1560978a7e8d370392a078748f91eb91a635c7df25d2130
SHA512

8886e74a9c1906cb570aa95dd491bf0b49577df47fe80a98747068104c09f8e8b04e6b43887a5cae5f7fec3600c940cda8cf7a7b4739391ca53189a125991748
SSDEEP

3072:c+MAtavXirmk4pJvcAEuGq9jQ0uSyQ0+g7S3E5sZLejYeGlONUwAZu27IpuMaZ:YArmk4pzPFNuSyRL7S05MbDlOywl2v

Score

1^/10

Malware Config

Signatures

Files

8d005bf5b2bf2324d17c19f10e12f82a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1ec30343bd6c7ddfa42cdb6c5cf56302

Code Sign

0a:5a:d4:c2:6e:8c:85:4d:be:25:75:f7:a3:47:af:08
Certificate

Issuer

CN=t23 inc

Not Before

14/01/2012, 21:04

Not After

31/12/2039, 23:59

Subject

CN=t23 inc

Extended Key Usages

ExtKeyUsageCodeSigning

15:b9:0b:2b:87:67:de:af:f5:b4:40:59:4b:dd:12:a4:97:f3:62:55
Signer

Actual PE Digest

15:b9:0b:2b:87:67:de:af:f5:b4:40:59:4b:dd:12:a4:97:f3:62:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleOutputAttribute
WritePrivateProfileStructW
WriteProfileSectionW
WriteProfileStringA
VirtualLock
lstrcmpA
lstrcpyA
VerifyVersionInfoW
TransactNamedPipe
TlsGetValue
TlsAlloc
TerminateThread
TerminateJobObject
SizeofResource
SetTimerQueueTimer
SetThreadPriority
SetSystemPowerState
SetNamedPipeHandleState
SetFileAttributesW
SetFileApisToOEM
ResumeThread
ReadFileScatter
ReadConsoleOutputCharacterA
ReadConsoleOutputAttribute
OutputDebugStringA
OpenWaitableTimerW
OpenProcess
OpenFile
MulDiv
MoveFileExW
MapViewOfFileEx
MapUserPhysicalPages
LocalLock
LocalFlags
LoadModule
IsValidLanguageGroup
InterlockedExchangeAdd
InitializeCriticalSection
HeapWalk
HeapSize
HeapLock
HeapFree
GlobalMemoryStatus
GlobalHandle
GlobalFindAtomA
GetVolumeInformationA
GetUserDefaultLCID
GetThreadContext
GetTapeParameters
GetSystemDefaultLCID
GetStartupInfoW
GetStartupInfoA
GetProcessPriorityBoost
GetOEMCP
GetNumberOfConsoleInputEvents
GetNamedPipeInfo
GetModuleFileNameW
GetLogicalDriveStringsA
GetExitCodeProcess
GetDefaultCommConfigA
GetCurrencyFormatW
GetConsoleOutputCP
GetConsoleFontSize
GetConsoleAliasW
GetCalendarInfoA
GetCPInfoExA
GetACP
FreeLibraryAndExitThread
FindVolumeClose
FindNextVolumeA
FindFirstVolumeA
FindFirstChangeNotificationW
ExpandEnvironmentStringsW
EnumDateFormatsA
EnterCriticalSection
DnsHostnameToComputerNameW
CreateFileW
DnsHostnameToComputerNameA
DisableThreadLibraryCalls
DeleteFileW
DeleteFileA
DebugBreak
CreateJobObjectA
CreateEventA
CompareFileTime
CloseHandle
CancelWaitableTimer
CancelIo
BuildCommDCBA
BackupWrite
AreFileApisANSI
GetSystemInfo
GetProcAddress
LoadLibraryA
GetProcessHeap
GetWindowsDirectoryW
lstrcatW
WriteTapemark

user32

EmptyClipboard
DrawIcon
DrawCaption
DispatchMessageW
DestroyIcon
DestroyCaret
DeregisterShellHookWindow
DefMDIChildProcW
DefDlgProcW
DdePostAdvise
DdeGetLastError
DdeFreeDataHandle
DdeDisconnect
DdeCreateStringHandleW
CreateDialogParamW
CreateDialogIndirectParamA
CreateCaret
CloseWindowStation
ChildWindowFromPointEx
CheckMenuItem
CheckDlgButton
CharNextA
CharLowerW
CharLowerBuffW
ChangeMenuW
ChangeMenuA
ChangeDisplaySettingsA
CascadeWindows
CallWindowProcW
CallMsgFilterA
ArrangeIconicWindows
EnableWindow
EndDeferWindowPos
EnumDesktopsW
EnumDisplaySettingsExW
EnumWindows
ExcludeUpdateRgn
GetAltTabInfo
GetAltTabInfoA
GetClassLongW
GetClassNameA
GetClipboardData
GetClipboardSequenceNumber
GetDlgItemTextW
GetGuiResources
GetInputDesktop
GetKeyboardType
GetMenuContextHelpId
GetMenuDefaultItem
GetMenuItemInfoA
GetMessageTime
GetMessageW
GetMouseMovePointsEx
GetNextDlgTabItem
GetPropW
GetScrollInfo
GetScrollPos
GetSubMenu
GetSystemMenu
GetSystemMetrics
GetUserObjectSecurity
GetWindowInfo
GetWindowModuleFileName
GetWindowTextA
GrayStringA
HiliteMenuItem
IMPSetIMEW
ImpersonateDdeClientWindow
InsertMenuItemA
IsChild
IsDlgButtonChecked
IsRectEmpty
LoadMenuA
LockSetForegroundWindow
LookupIconIdFromDirectoryEx
MessageBoxIndirectA
NotifyWinEvent
PaintDesktop
RemovePropW
SetActiveWindow
SetDlgItemTextA
SetMessageExtraInfo
SetScrollInfo
SetScrollRange
SetWinEventHook
TrackMouseEvent
UnregisterClassW
UnregisterHotKey
UpdateWindow
TileWindows
SwitchToThisWindow
SwapMouseButton
ShowScrollBar
ShowCaret
SetWindowRgn
SetWindowLongW

gdi32

EngFreeModule
BitBlt
CLIPOBJ_cEnumStart
CancelDC
CheckColorsInGamut
CloseEnhMetaFile
CopyMetaFileA
CreateColorSpaceA
CreateCompatibleDC
CreateDIBPatternBrushPt
CreateEllipticRgn
CreateEnhMetaFileA
CreatePalette
CreatePolyPolygonRgn
CreateScalableFontResourceW
DeviceCapabilitiesExA
EndFormPage
EngCreateDeviceBitmap
EngCreateDeviceSurface
EngDeleteSurface
EngEraseSurface
EngLineTo
EngStrokePath
EnumEnhMetaFile
EnumObjects
EudcLoadLinkW
ExtCreateRegion
ExtSelectClipRgn
FONTOBJ_pifi
FONTOBJ_pvTrueTypeFontFile
FillPath
GdiComment
GdiConvertBrush
GdiConvertDC
GdiConvertPalette
GdiDllInitialize
GdiEntry6
GdiGetPageHandle
GdiQueryFonts
GdiRealizationInfo
GdiSetBatchLimit
GdiStartPageEMF
GdiTransparentBlt
GetCharABCWidthsFloatA
GetCharWidth32A
GetCharWidth32W
GetClipBox
GetClipRgn
GetDIBColorTable
GetEnhMetaFilePaletteEntries
GetObjectType
GetObjectW
GetPolyFillMode
GetROP2
GetStringBitmapW
GetSystemPaletteEntries
GetTextColor
GetTextExtentExPointI
GetTextExtentPointI
GetViewportOrgEx
HT_Get8BPPMaskPalette
LineDDA
MoveToEx
PatBlt
PlayMetaFileRecord
PolyBezier
Polyline
PolylineTo
PtInRegion
PtVisible
RestoreDC
SetBitmapDimensionEx
SetBoundsRect
SetDIBits
SetICMMode
SetMapMode
SetMapperFlags
SetMetaRgn
SetPaletteEntries
SetPixelFormat
TextOutW
UnrealizeObject
UpdateColors
WidenPath
XFORMOBJ_bApplyXform
XFORMOBJ_iGetXform
bInitSystemAndFontsDirectoriesW
bMakePathNameW
gdiPlaySpoolStream
BRUSHOBJ_pvGetRbrush

shell32

SHGetDiskFreeSpaceExA
Shell_NotifyIconW
Shell_NotifyIconA
ShellExecuteW
ShellExecuteExW
ShellExecuteEx
ShellAboutA
SHQueryRecycleBinW
SHPathPrepareForWriteW
SHPathPrepareForWriteA
SHLoadInProc
SHIsFileAvailableOffline
CheckEscapesW
CommandLineToArgvW
DoEnvironmentSubstA
DoEnvironmentSubstW
DragQueryFileAorW
DragQueryFileW
DragQueryPoint
DuplicateIcon
ExtractAssociatedIconA
ExtractAssociatedIconW
ExtractIconEx
ExtractIconExA
ExtractIconExW
ExtractIconW
FindExecutableA
FindExecutableW
SHAddToRecentDocs
SHAppBarMessage
SHBrowseForFolder
SHCreateDirectoryExW
SHEmptyRecycleBinA
SHFileOperation
SHFileOperationA
SHFormatDrive
SHFreeNameMappings
SHGetDataFromIDListA
SHGetDataFromIDListW
SHInvokePrinterCommandA
SHGetFileInfo
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetFolderPathW
SHGetIconOverlayIndexA
SHGetPathFromIDList
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
WOWShellExecute

ole32

CoIsOle1Class
CoQueryClientBlanket
CoRegisterMallocSpy
CoResumeClassObjects
CoTestCancel
CreateBindCtx
CreateClassMoniker
CreateDataAdviseHolder
CreateGenericComposite
CreatePointerMoniker
DllGetClassObjectWOW
EnableHookObject
FreePropVariantArray
GetHGlobalFromStream
GetRunningObjectTable
HACCEL_UserFree
HACCEL_UserMarshal
HACCEL_UserSize
HBITMAP_UserFree
HBRUSH_UserFree
HDC_UserSize
HENHMETAFILE_UserSize
HGLOBAL_UserUnmarshal
HICON_UserFree
HICON_UserSize
HMENU_UserMarshal
HMETAFILEPICT_UserMarshal
HMETAFILE_UserMarshal
HMETAFILE_UserSize
HPALETTE_UserMarshal
HWND_UserMarshal
HWND_UserUnmarshal
OleCreate
OleCreateFromDataEx
OleCreateFromFile
OleDestroyMenuDescriptor
OleDuplicateData
OleFlushClipboard
OleInitialize
OleMetafilePictFromIconAndLabel
OleQueryCreateFromData
OleRegEnumFormatEtc
OleSetClipboard
ReadClassStg
ReadFmtUserTypeStg
ReadOleStg
ReadStringStream
RegisterDragDrop
SNB_UserMarshal
SNB_UserSize
STGMEDIUM_UserFree
STGMEDIUM_UserSize
STGMEDIUM_UserUnmarshal
StgConvertPropertyToVariant
StgConvertVariantToProperty
StgCreateDocfileOnILockBytes
StgCreateStorageEx
StgGetIFillLockBytesOnFile
StgOpenStorage
StgSetTimes
StringFromCLSID
StringFromGUID2
UtConvertDvtd16toDvtd32
WdtpInterfacePointer_UserFree
WdtpInterfacePointer_UserMarshal
WdtpInterfacePointer_UserSize
WdtpInterfacePointer_UserUnmarshal
WriteClassStm
CoIsHandlerConnected
CoInitializeSecurity
CoImpersonateClient
CoGetObject
CoGetInstanceFromIStorage
CoGetCurrentLogicalThreadId
CoGetApartmentID
CoDisconnectObject
CoCreateInstanceEx
CoCancelCall
BindMoniker
CoFreeUnusedLibraries

shlwapi

StrChrIA
StrChrW
StrCmpNA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrIW
StrStrA
StrStrIA
StrStrIW
StrStrW

Sections

.text
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ec30343bd6c7ddfa42cdb6c5cf56302

Code Sign

0a:5a:d4:c2:6e:8c:85:4d:be:25:75:f7:a3:47:af:08Certificate

Extended Key Usages

15:b9:0b:2b:87:67:de:af:f5:b4:40:59:4b:dd:12:a4:97:f3:62:55Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

shlwapi

Sections

.text Size: 204KB - Virtual size: 204KB

.data Size: 512B - Virtual size: 492B

.rsrc Size: 30KB - Virtual size: 29KB

.reloc Size: 3KB - Virtual size: 2KB

0a:5a:d4:c2:6e:8c:85:4d:be:25:75:f7:a3:47:af:08
Certificate

15:b9:0b:2b:87:67:de:af:f5:b4:40:59:4b:dd:12:a4:97:f3:62:55
Signer

.text
Size: 204KB - Virtual size: 204KB

.data
Size: 512B - Virtual size: 492B

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 3KB - Virtual size: 2KB