946ed920ed4742daf02adf9b221146b6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

946ed920ed4742daf02adf9b221146b6_JaffaCakes118
Size

876KB
MD5

946ed920ed4742daf02adf9b221146b6
SHA1

0b302d169c147b4b80082214ae749eac109469f3
SHA256

b476ca249855b31da9affd9a8cf153ccb4d19250c6340f6294e9da67d208278e
SHA512

0e3c539a1e4c1d604f0cba6173788b47120eca9406b729a38981e12c1912c48b61312626e19f6a880736c7a4ac74e1afaa86e41b4173a094c9857312190229ae
SSDEEP

24576:GVbJ96RIltyqrJ3arIORDS4tlNhifGSgEv:GVl9YIiuJ3sFtln6

Score

1^/10

Malware Config

Signatures

Files

946ed920ed4742daf02adf9b221146b6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

00d1b26254430fd0ac58229c1bb34c81

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01-02-2008 00:00

Not After

31-01-2009 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

InitializeAcl
EnumDependentServicesA
CryptSetKeyParam
GetSecurityDescriptorControl
DeregisterEventSource
GetServiceDisplayNameA
CryptEncrypt
GetAclInformation
GetMultipleTrusteeA
GetNumberOfEventLogRecords
OpenEventLogA
GetExplicitEntriesFromAclA
RegConnectRegistryA
RegDeleteValueA
RegFlushKey
GetSidSubAuthority
CryptSignHashA
RegUnLoadKeyA
CryptHashSessionKey
FindFirstFreeAce
CryptContextAddRef
ChangeServiceConfigA
GetSecurityDescriptorOwner
ObjectDeleteAuditAlarmA
CopySid
RevertToSelf
RegOpenKeyA
BackupEventLogA
CryptGenKey
AddAce
AllocateAndInitializeSid
ControlService
RegSaveKeyA

user32

ShowCursor
OemToCharA
CharToOemBuffA
EnumPropsExA
CreateDialogParamA
GetKeyboardLayoutList
BringWindowToTop
DestroyAcceleratorTable
DdeQueryStringA
ScrollDC
UnhookWinEvent
MsgWaitForMultipleObjects
GetMenuState
SendIMEMessageExA
RegisterWindowMessageA
ChildWindowFromPointEx
LoadAcceleratorsA
CreateWindowExA
TileWindows
DdeCreateDataHandle
DispatchMessageA
IsDialogMessage
SetWindowRgn
GetProcessDefaultLayout
GetClassWord
GetClipboardFormatNameA
DrawCaption
TranslateAccelerator
GetLastActivePopup
GetMenuCheckMarkDimensions
SetCaretBlinkTime
VkKeyScanA
DlgDirSelectExA
GetAsyncKeyState
LookupIconIdFromDirectory
IsMenu
GetWindowWord
IsCharLowerA
CheckMenuItem
GetDC
RedrawWindow
LoadIconA
EnableScrollBar
IsWindowUnicode
GetDlgCtrlID
WinHelpA
SendMessageTimeoutA
MapVirtualKeyExA
SetMessageExtraInfo
DestroyMenu
GetUserObjectSecurity
GetComboBoxInfo
DdeEnableCallback
CreateAcceleratorTableA
RemovePropA
FindWindowExA
SetClipboardData

kernel32

lstrlen

Sections

.wpil
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dmtm
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ize
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tcd
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shw
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.naxg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fyd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ejeba
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.kvipy
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00d1b26254430fd0ac58229c1bb34c81

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

advapi32

user32

kernel32

Sections

.wpil Size: 638KB - Virtual size: 1.3MB

.dmtm Size: 6KB - Virtual size: 8KB

.ize Size: 19KB - Virtual size: 27KB

.tcd Size: 512B - Virtual size: 21KB

.shw Size: 6KB - Virtual size: 15KB

.naxg Size: 512B - Virtual size: 56B

.fyd Size: 512B - Virtual size: 24B

.ejeba Size: 48KB - Virtual size: 77KB

.kvipy Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.wpil
Size: 638KB - Virtual size: 1.3MB

.dmtm
Size: 6KB - Virtual size: 8KB

.ize
Size: 19KB - Virtual size: 27KB

.tcd
Size: 512B - Virtual size: 21KB

.shw
Size: 6KB - Virtual size: 15KB

.naxg
Size: 512B - Virtual size: 56B

.fyd
Size: 512B - Virtual size: 24B

.ejeba
Size: 48KB - Virtual size: 77KB

.kvipy
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB