94e4663cd44d7899894b4ba4498354a7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

94e4663cd44d7899894b4ba4498354a7_JaffaCakes118
Size

84KB
MD5

94e4663cd44d7899894b4ba4498354a7
SHA1

f8786ac2c0f4ccdcdb9b7c3c5c79e19061318891
SHA256

c636ffb19732f4ce3c06e9779b8c36e4b4451ada9270a4de3c32aa18613717d8
SHA512

39b906740346ece425be34cc7660b9541dd266c61337c2caedb0e6f73d63f956ff6449e8d0df436c3b31e431583a54997c7168747551553d4320f58f4accfcc8
SSDEEP

1536:9MjQCF/SQoEM7hXNDUKcS1ttBAtbxYsjSf0ji93:9GQC1JoEihXNFV1tubxYsq6iB

Score

1^/10

Malware Config

Signatures

Files

94e4663cd44d7899894b4ba4498354a7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

93b90a249242e81cef9eea7bb5149ea5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:fe
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6a:21:17:71:97:e8:54:ad:7d:33:0f:ff:3c:3f:ea:0c
Certificate

Issuer

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/06/2011, 00:00

Not After

27/06/2014, 23:59

Subject

CN=LastPass,O=LastPass,POSTALCODE=22180,STREET=226 Maple Ave W STE 301,L=Vienna,ST=VA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

34:f7:5b:e3:07:99:07:97:6e:64:7b:49:74:10:4f:85:9c:6c:28:4a
Signer

Actual PE Digest

34:f7:5b:e3:07:99:07:97:6e:64:7b:49:74:10:4f:85:9c:6c:28:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\cygwin\home\joe\sso\winbio\WinBioStandalone\Release\WinBioStandalone.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

crypt32

CryptUnprotectData

user32

DestroyAcceleratorTable

gdi32

GetDeviceCaps

advapi32

GetLengthSid

shell32

SHGetFolderPathW

ole32

CLSIDFromProgID

oleaut32

SysAllocStringLen

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

msvcr90

memcpy

Sections

.text
Size: 46KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

93b90a249242e81cef9eea7bb5149ea5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:feCertificate

Key Usages

6a:21:17:71:97:e8:54:ad:7d:33:0f:ff:3c:3f:ea:0cCertificate

Extended Key Usages

Key Usages

34:f7:5b:e3:07:99:07:97:6e:64:7b:49:74:10:4f:85:9c:6c:28:4aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

crypt32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp90

msvcr90

Sections

.text Size: 46KB - Virtual size: 668KB

.rsrc Size: 29KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 512B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:fe
Certificate

6a:21:17:71:97:e8:54:ad:7d:33:0f:ff:3c:3f:ea:0c
Certificate

34:f7:5b:e3:07:99:07:97:6e:64:7b:49:74:10:4f:85:9c:6c:28:4a
Signer

.text
Size: 46KB - Virtual size: 668KB

.rsrc
Size: 29KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 512B