a148cad2fb750a7e033488fa1061317a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a148cad2fb750a7e033488fa1061317a_JaffaCakes118
Size

4.9MB
MD5

a148cad2fb750a7e033488fa1061317a
SHA1

d4b461a429a694f4c20c637bc20f2bb424422b09
SHA256

2e07f66128041c0f21118604ead81fcd0e7a9a51ccb5e985fdfb96302c563d46
SHA512

e28a0895aabb90ff613a889fb6166be2c56ef17ad23863199e7f97de12b7e267ec0f3c7d019f5bc7b8fefbf0f0e27fa337fa7d149fcc8dbf0345ba93d9434183
SSDEEP

98304:GwSnrq4JrXuKm38fnJEvRolxmGcogrckHo+NaNz72mLODRvSGrBcI:n+rq4ZXuKm3onJEvGlASgrc8o+QNz72N

Score

1^/10

Malware Config

Signatures

Files

a148cad2fb750a7e033488fa1061317a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c6adeb2583bac2ed1921e0c9979914c7

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:4b:07:d9:99:f4:37:3b:f8:b0:ed:4d:b5:f5:3b:c8
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

26/10/2006, 00:00

Not After

26/10/2007, 23:59

Subject

CN=MeMedia,OU=Secure Application Development,O=MeMedia,L=New York City,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\MeMedia\MeMediaInstallProject\MeMediaInstall\Release\MeMediaInstall.pdb

Imports

kernel32

SystemTimeToFileTime
FindResourceA
SizeofResource
LoadResource
LockResource
LoadLibraryA
FreeLibrary
GetTempPathA
GetFileAttributesA
GetWindowsDirectoryA
CreateDirectoryA
GetLastError
GetCurrentProcessId
DeleteFileA
GetProcAddress
WaitForSingleObject
CloseHandle
MultiByteToWideChar
CreateFileA
WriteFile
GetModuleFileNameA
GetTempFileNameA
GetShortPathNameA
CreateProcessA
SetThreadPriority
GetCurrentThread
SetPriorityClass
ResumeThread
FindResourceExA
WideCharToMultiByte
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
GetSystemDirectoryA
lstrcatA
OpenProcess
TerminateProcess
lstrlenW
RemoveDirectoryA
lstrcpynA
FileTimeToSystemTime
GetLocalTime
FlushFileBuffers
SetStdHandle
RtlUnwind
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
LCMapStringW
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
VirtualFree
HeapCreate
ExitProcess
GetStartupInfoA
GetModuleHandleA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapSize
HeapReAlloc
HeapDestroy
LocalAlloc
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
CompareStringA
lstrcmpiA
lstrcpyA
lstrlenA
RaiseException
GetVersionExA

user32

GetSysColor
GetFocus
FillRect
DrawFocusRect
UnregisterClassA
IsWindow
GetDlgItem
SendMessageA
FindWindowA
GetWindowThreadProcessId
SendMessageTimeoutA
IsWindowEnabled
ScreenToClient
GetCursorPos
SetFocus
InvalidateRect
PtInRect
ReleaseCapture
GetCapture
SetCapture
UpdateWindow
DialogBoxParamA
GetClassInfoExA
RegisterClassExA
GetSystemMetrics
GetActiveWindow
DestroyCursor
SetCursor
LoadCursorA
EndPaint
BeginPaint
GetDlgCtrlID
DestroyWindow
CallWindowProcA
DefWindowProcA
wsprintfA
PostQuitMessage
GetWindowLongA
SetWindowPos
CharNextA
CreateWindowExA
DrawTextA
OffsetRect
GetClientRect
GetWindowTextA
GetWindowTextLengthA
CreateCursor
SetWindowLongA
GetClassNameA
GetWindowRect
EndDialog
SetWindowTextA
GetDesktopWindow
GetWindow
MapWindowPoints
GetParent
ReleaseDC
GetDC
SystemParametersInfoA
SetRectEmpty

gdi32

SetTextColor
SetBkMode
SelectObject
GetStockObject
GetObjectA
DeleteObject
CreateFontIndirectA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey

shell32

ShellExecuteExA
ShellExecuteA
SHGetPathFromIDListA
SHFileOperationA
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
LoadTypeLi
VarR8FromStr
RegisterTypeLi
SysAllocStringLen

shlwapi

PathFindFileNameA
PathGetArgsA

comctl32

_TrackMouseEvent

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6adeb2583bac2ed1921e0c9979914c7

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

70:4b:07:d9:99:f4:37:3b:f8:b0:ed:4d:b5:f5:3b:c8Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

Sections

.text Size: 87KB - Virtual size: 86KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 4.8MB - Virtual size: 4.8MB

01
Certificate

0a
Certificate

70:4b:07:d9:99:f4:37:3b:f8:b0:ed:4d:b5:f5:3b:c8
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 87KB - Virtual size: 86KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 4.8MB - Virtual size: 4.8MB