95ca1cd1426a35a53d476b286e5a6641_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

95ca1cd1426a35a53d476b286e5a6641_JaffaCakes118
Size

164KB
MD5

95ca1cd1426a35a53d476b286e5a6641
SHA1

ae4cbf1e60e22a006d22954d133295efab3cf5e7
SHA256

97d2f25d803ef9d2bbf220e39997997433bf016ed751fc4b28a29d1c55d4edd0
SHA512

63a3eb09092287da05960a701cd792ab3b6991a756cb7e72fca82ec98801adfea4238b948114010c6b853b084e468cd42e1f8e9701f286c442d25e96421e7660
SSDEEP

3072:9lNE6qc3AF6JXB6aaQTWwR8Qw4kMEpPJWHlim0MdfJMnd:hvKgdd8EkMaUVzfC

Score

1^/10

Malware Config

Signatures

Files

95ca1cd1426a35a53d476b286e5a6641_JaffaCakes118
.exe windows:4 windows x86 arch:x86

36566342c5459972762d11acf0ceb258

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:e7:89:ef:da:84:1b:09:84:1f:fd:f0:45:95:e4:ea
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

19/05/2008, 00:00

Not After

19/05/2010, 23:59

Subject

CN=Cassava Enterprises (Gibraltar) Limited,OU=Cassava,O=Cassava Enterprises (Gibraltar) Limited,L=Gibraltar,ST=Gibraltar,C=GI

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

c5:2e:06:c5:76:2e:29:07:b3:d6:5a:40:ff:83:d4:68:36:74:6d:f8
Signer

Actual PE Digest

c5:2e:06:c5:76:2e:29:07:b3:d6:5a:40:ff:83:d4:68:36:74:6d:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

setsockopt
send
htons
socket
connect
recv
WSAGetLastError
WSAStartup
ioctlsocket
inet_addr
gethostname
select
closesocket
WSACleanup
shutdown
gethostbyname

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

GetModuleFileNameA
GetPrivateProfileIntA
CreateThread
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
ReleaseMutex
GetTempPathA
GetModuleHandleA
GetCurrentDirectoryA
lstrlenA
GetLastError
SetFilePointer
GetFileSize
CreateFileA
ReadFile
WriteFile
CopyFileA
GetUserDefaultLangID
GlobalFree
GlobalSize
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
LocalAlloc
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TerminateThread
HeapSize
GetCurrentProcess
TerminateProcess
HeapReAlloc
GetOEMCP
GetACP
GetCPInfo
RemoveDirectoryA
CreateDirectoryA
ExitProcess
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
DeleteCriticalSection
DeleteFileA
InitializeCriticalSection
GetVersion
GetVersionExA
GlobalMemoryStatus
CloseHandle
CreateEventA
CreateMutexA
GetTickCount
GetPrivateProfileStringA
WinExec
SetEvent
MulDiv
WaitForSingleObject
GetStringTypeW
LoadLibraryA
SetConsoleCtrlHandler
SetStdHandle
FlushFileBuffers
CompareStringA
CompareStringW
GetProcAddress
SetEnvironmentVariableA

user32

IsWindow
IntersectRect
SendDlgItemMessageA
DrawTextA
IsRectEmpty
PtInRect
UnionRect
InvalidateRect
UpdateWindow
SetDlgItemTextA
KillTimer
SetTimer
EnumDisplaySettingsA
ChangeDisplaySettingsA
SendMessageA
PostMessageA
EndDialog
DestroyWindow
MessageBoxIndirectA
GetDlgItem
EnableWindow
PostQuitMessage
DefWindowProcA
ShowWindow
SetWindowTextA
GetWindowRect
ScreenToClient
CreateWindowExA
GetDC
ReleaseDC
GetClientRect
FillRect
EndPaint
SetFocus
FindWindowA
MessageBoxA
SetForegroundWindow
GetClassInfoExA
DialogBoxParamA
LoadIconA
LoadCursorA
RegisterClassExA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetSystemMetrics

gdi32

GetObjectA
GetDeviceCaps
CreateFontIndirectA
SelectObject
CreateCompatibleDC
SetBkColor
BitBlt
CreateSolidBrush
DeleteObject
CreateBitmap
SetMapMode
SetTextColor
SetBkMode
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
DeleteDC

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA
ShellExecuteExA

ole32

CoCreateGuid

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

36566342c5459972762d11acf0ceb258

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

48:e7:89:ef:da:84:1b:09:84:1f:fd:f0:45:95:e4:eaCertificate

Extended Key Usages

c5:2e:06:c5:76:2e:29:07:b3:d6:5a:40:ff:83:d4:68:36:74:6d:f8Signer

Headers

File Characteristics

Imports

wsock32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 116KB - Virtual size: 113KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 20KB - Virtual size: 203KB

.rsrc Size: 4KB - Virtual size: 3KB

01
Certificate

0a
Certificate

48:e7:89:ef:da:84:1b:09:84:1f:fd:f0:45:95:e4:ea
Certificate

c5:2e:06:c5:76:2e:29:07:b3:d6:5a:40:ff:83:d4:68:36:74:6d:f8
Signer

.text
Size: 116KB - Virtual size: 113KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 20KB - Virtual size: 203KB

.rsrc
Size: 4KB - Virtual size: 3KB