a116ac3771bc60a0310165d1d759e4fb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a116ac3771bc60a0310165d1d759e4fb_JaffaCakes118
Size

134KB
MD5

a116ac3771bc60a0310165d1d759e4fb
SHA1

652239f004a44c1c70b7d8258f590255a5ee93c7
SHA256

8ea226667db7f6ce168c840e8879fbecfe23b96dedbcfcc693f5f9daecb047b6
SHA512

74a18e3ec40887b4330ebff98f8892b9d1f85e40f5e65f1b51d24102009e831520ef39abe9621ded104628f0362c1080ce979f1fdcc9863113136d62ed97793a
SSDEEP

3072:EcmDFZC5EgIpZr4ySLApgvtsbd3dCU2Bs+4YUQ7y2bFVN5:EcmAEgIpZgMMsfC/K+yQ7y+D5

Score

1^/10

Malware Config

Signatures

Files

a116ac3771bc60a0310165d1d759e4fb_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

7e62333301cd02549753b9c93204faf8

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

Issuer

CN=Application Compatibility UI

Not Before

31/12/2008, 16:00

Not After

31/12/2014, 16:00

Subject

CN=Application Compatibility UI

Extended Key Usages

ExtKeyUsageCodeSigning

90:a3:79:95:f2:f8:a6:fd:9a:0f:e1:68:98:56:43:17:80:d6:bf:e3
Signer

Actual PE Digest

90:a3:79:95:f2:f8:a6:fd:9a:0f:e1:68:98:56:43:17:80:d6:bf:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType

advapi32

RegQueryValueExA

oleaut32

SysFreeString

gdi32

SetPixel

wsock32

WSACleanup

wininet

InternetReadFile

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
JumpHookOff
JumpHookOn

Sections

(
Size: - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

?
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

5
Size: - Virtual size: 6KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

*
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

+
Size: - Virtual size: 209B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

"
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

8
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

-
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

(
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

3
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e62333301cd02549753b9c93204faf8

Code Sign

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2Certificate

Extended Key Usages

90:a3:79:95:f2:f8:a6:fd:9a:0f:e1:68:98:56:43:17:80:d6:bf:e3Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

gdi32

wsock32

wininet

Exports

Exports

Sections

( Size: - Virtual size: 143KB

? Size: - Virtual size: 3KB

5 Size: - Virtual size: 6KB

* Size: - Virtual size: 3KB

+ Size: - Virtual size: 209B

" Size: - Virtual size: 10KB

8 Size: 512B - Virtual size: 4KB

- Size: - Virtual size: 21KB

( Size: 131KB - Virtual size: 131KB

3 Size: 512B - Virtual size: 120B

2f:6d:1b:0d:3e:bb:b8:8b:4a:0f:b2:46:69:8a:ad:c2
Certificate

90:a3:79:95:f2:f8:a6:fd:9a:0f:e1:68:98:56:43:17:80:d6:bf:e3
Signer

(
Size: - Virtual size: 143KB

?
Size: - Virtual size: 3KB

5
Size: - Virtual size: 6KB

*
Size: - Virtual size: 3KB

+
Size: - Virtual size: 209B

"
Size: - Virtual size: 10KB

8
Size: 512B - Virtual size: 4KB

-
Size: - Virtual size: 21KB

(
Size: 131KB - Virtual size: 131KB

3
Size: 512B - Virtual size: 120B