a024e8cdc632f6954227e1f0384a73dc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a024e8cdc632f6954227e1f0384a73dc_JaffaCakes118
Size

784KB
MD5

a024e8cdc632f6954227e1f0384a73dc
SHA1

4286d260c2a8b027239fd6c34381e1a505511368
SHA256

b47ec9db927b60897d01aefb7a1c5120501ef9ed7204590a0b9c5abc11970f6a
SHA512

28b7b9671f7836a4cb9a6dd7fc6756ba647c0b67087128792657fc287a7da564e2b699ba40039f3f69439fa33cf5664b981f1fd673966d107fb02f588844a2d9
SSDEEP

12288:F/V4izS2PPAs18mgDLlfueDVOol0VJhGAqIra+8cMPBVOS:F94GtHAjPRAoW/3qIra+BS

Score

1^/10

Malware Config

Signatures

Files

a024e8cdc632f6954227e1f0384a73dc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7e4670914fb3b16f3912e8a0ee36e55e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:52:12:f7:83:f4:d7:ab:a3:55:57:29:e9:9c:e0:65
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

16/02/2011, 23:59

Subject

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\SpamBuster\src\TMAS_OEImp\make\Release\TMAS_OEImp.pdb

Imports

kernel32

TlsFree
InterlockedIncrement
GetAtomNameA
FileTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
GetFileTime
SetErrorMode
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapAlloc
HeapFree
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
GetProcessHeap
GetStartupInfoA
SetStdHandle
LocalReAlloc
ExitProcess
HeapSize
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FatalAppExitA
VirtualFree
HeapDestroy
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetTickCount
SetConsoleCtrlHandler
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetCurrentProcessId
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
CreateFileA
GetShortPathNameA
GetFullPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
MoveFileA
GlobalFree
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
SearchPathW
FindResourceW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
GetVersionExW
GetLocaleInfoW
CreateFileW
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
FindResourceExW
SetLastError
LoadLibraryA
FreeLibrary
GetStringTypeExW
GetStringTypeExA
GetEnvironmentVariableW
GetEnvironmentVariableA
lstrlenA
lstrcmpiW
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetVersion
InterlockedExchange
Sleep
GetPrivateProfileIntA
FormatMessageA
DeleteCriticalSection
GetPrivateProfileStringA
GetModuleFileNameA
GetVersionExA
GetProcAddress
GetModuleHandleA
MultiByteToWideChar
EnterCriticalSection
GetCurrentThreadId
OutputDebugStringA
LeaveCriticalSection
GetLastError
LocalAlloc
LocalFree
CreateDirectoryA
GetFileAttributesA
SetFileAttributesA
RemoveDirectoryA
FindFirstFileA
CopyFileA
FindNextFileA
FindClose
DeleteFileA
InitializeCriticalSection
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
GetFileType
SizeofResource

user32

SetTimer
KillTimer
GetDCEx
LockWindowUpdate
TranslateAcceleratorA
DestroyIcon
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
GetDialogBaseUnits
DestroyMenu
GetMenuItemInfoA
InflateRect
UnregisterClassA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
DeleteMenu
LoadCursorA
GetSysColorBrush
GetWindowThreadProcessId
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
MapVirtualKeyA
GetKeyNameTextA
ReleaseDC
GetDC
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
RegisterWindowMessageA
LoadIconA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
SetRect
RemovePropA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
GetScrollPos
ShowScrollBar
IsWindowVisible
UpdateWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
CopyRect
GetScrollInfo
SetScrollInfo
PtInRect
SetWindowPlacement
DefWindowProcA
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
UnhookWindowsHookEx
GetWindowTextLengthA
GetWindowTextA
GetFocus
GetParent
SetWindowPos
ScrollWindowEx
SetFocus
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
IsWindow
SetWindowTextA
UnionRect
SetParent
GetSystemMenu
IsRectEmpty
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InvalidateRect
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
GetPropA
SetMenu
GetWindowLongA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
GetWindow
PostQuitMessage
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
FindWindowA
CharUpperW
CharUpperA
CharLowerW
CharLowerA
MessageBoxA
PostMessageA
SendMessageA
EnableWindow
SetForegroundWindow
SetActiveWindow
BringWindowToTop
GetSystemMetrics
SetScrollPos

gdi32

CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
BitBlt
CreateSolidBrush
CreateDIBPatternBrushPt
CreateFontIndirectA
ExtSelectClipRgn
GetTextMetricsA
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
CreateCompatibleBitmap
GetCharWidthA
CreateFontA
StretchDIBits
GetBkColor
CreateHatchBrush
DeleteDC
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
StartDocA
GetTextExtentPoint32A
GetDeviceCaps
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
PatBlt
CreateRectRgnIndirect
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetDCOrgEx
CreateDCA
CopyMetaFileA
GetPixel

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueA
RegOpenKeyExW
RegQueryValueExW
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCreateKeyA

shell32

DragQueryFileA
SHCreateDirectoryExA
SHGetSpecialFolderPathA
SHGetFileInfoA
ExtractIconA
ShellExecuteA
DragFinish

shlwapi

PathIsUNCA
PathFindExtensionA
PathRemoveExtensionA
PathStripToRootA
PathFindFileNameA

ole32

ReleaseStgMedium
CreateBindCtx
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
CoTaskMemAlloc
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
OleDuplicateData
CoDisconnectObject
StringFromGUID2
CLSIDFromString
WriteClassStg

oleaut32

VarBstrFromDate
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarDateFromStr
SysReAllocStringLen
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
SysStringLen
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound

wtsapi32

WTSTerminateProcess

Sections

.text
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e4670914fb3b16f3912e8a0ee36e55e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

64:52:12:f7:83:f4:d7:ab:a3:55:57:29:e9:9c:e0:65Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

wtsapi32

Sections

.text Size: 492KB - Virtual size: 491KB

.rdata Size: 116KB - Virtual size: 114KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

64:52:12:f7:83:f4:d7:ab:a3:55:57:29:e9:9c:e0:65
Certificate

.text
Size: 492KB - Virtual size: 491KB

.rdata
Size: 116KB - Virtual size: 114KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 1KB