a892c51df3ed5dbe3cb70cfe2b7cee35_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a892c51df3ed5dbe3cb70cfe2b7cee35_JaffaCakes118
Size

876KB
MD5

a892c51df3ed5dbe3cb70cfe2b7cee35
SHA1

b3e7886bd19c1c3f72ced1a9ec297c852db8521f
SHA256

defb0b61482085f94cddf17a96e0248c0ae73cb4847d60d0781c9c235394d158
SHA512

d4734663ea670c1f9a2048741cc3dce0d040423c15d891d9346ab8a652faf348149e584d93390680d11ae3904e1ef340e0937f7f4cd9e310e758423456557da6
SSDEEP

12288:I/JlHEAnDmQRVnDZg9ltAuc51nADltzWTlEZch7AyVrUxh3/MNWHrSsZNMoGQ/Su:xkRPmHAz50IaZchMyVQX3/MV9Q/1z8I

Score

1^/10

Malware Config

Signatures

Files

a892c51df3ed5dbe3cb70cfe2b7cee35_JaffaCakes118
.exe windows:4 windows x86 arch:x86

07344e1f558f6d1d570b6ee851fa42a7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32Next
_llseek
IsBadHugeReadPtr
GetWindowsDirectoryA
GetCurrentDirectoryA
GetNamedPipeHandleStateA
CreateFileMappingA
GetProfileStringA
UnlockFileEx
SetTapeParameters
SetupComm
WaitNamedPipeA
CreateConsoleScreenBuffer
QueueUserAPC
LocalLock
DeleteAtom
GetLongPathNameA
LockFileEx
GetCPInfoExA
lstrcmpi
SetTimeZoneInformation
LocalFree
WriteConsoleOutputAttribute
SetConsoleWindowInfo
TransactNamedPipe
GetConsoleOutputCP
InterlockedIncrement
ReadProcessMemory
GetProcessAffinityMask
OutputDebugStringA
LoadLibraryA
WritePrivateProfileStringA
CreateDirectoryExA
InterlockedExchange
WaitForMultipleObjects
ReleaseSemaphore
Beep
SetCommMask
GetConsoleTitleA
GetPrivateProfileIntA
SetProcessShutdownParameters
FreeLibrary
GetProcessVersion
FlushInstructionCache
OpenProcess
GetTickCount
TlsFree
BackupSeek
UpdateResourceA
SetLocalTime
ReadFileEx
GetTimeZoneInformation
SetStdHandle
WriteProfileStringA
CloseHandle
LocalFileTimeToFileTime
VirtualFree
SetEnvironmentVariableA
SizeofResource
InitializeCriticalSection
DeleteFileA
TlsSetValue

shlwapi

PathStripToRootA
StrCSpnA
PathAppendA
SHDeleteValueA
SHRegWriteUSValueA
SHRegOpenUSKeyA
StrRChrIA
SHRegEnumUSKeyA
PathCommonPrefixA
UrlIsOpaqueA
PathQuoteSpacesA
StrChrIA
SHCreateStreamWrapper
PathSearchAndQualifyA
PathGetDriveNumberA
AssocQueryStringA
PathIsUNCA
PathIsFileSpecA
StrSpnA
PathFindOnPathA
PathFileExistsA
StrFormatByteSize64A
PathRemoveBlanksA
PathIsRelativeA
StrToIntExA
HashData
UrlGetLocationA
ColorHLSToRGB

advapi32

CryptEncrypt

Sections

.dcty
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qba
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.afsr
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ovkfc
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vgfkp
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.itkr
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ipk
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fsl
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tqnyp
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07344e1f558f6d1d570b6ee851fa42a7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

shlwapi

advapi32

Sections

.dcty Size: 638KB - Virtual size: 1.3MB

.qba Size: 6KB - Virtual size: 8KB

.afsr Size: 19KB - Virtual size: 27KB

.ovkfc Size: 512B - Virtual size: 21KB

.vgfkp Size: 6KB - Virtual size: 15KB

.itkr Size: 512B - Virtual size: 56B

.ipk Size: 512B - Virtual size: 24B

.fsl Size: 48KB - Virtual size: 77KB

.tqnyp Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.dcty
Size: 638KB - Virtual size: 1.3MB

.qba
Size: 6KB - Virtual size: 8KB

.afsr
Size: 19KB - Virtual size: 27KB

.ovkfc
Size: 512B - Virtual size: 21KB

.vgfkp
Size: 6KB - Virtual size: 15KB

.itkr
Size: 512B - Virtual size: 56B

.ipk
Size: 512B - Virtual size: 24B

.fsl
Size: 48KB - Virtual size: 77KB

.tqnyp
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB