a567f94bc1d91aa5c25950a033300505_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a567f94bc1d91aa5c25950a033300505_JaffaCakes118
Size

219KB
MD5

a567f94bc1d91aa5c25950a033300505
SHA1

b19e0a4d6745c6114650bd8a7ac3924e71bf0483
SHA256

a577ac2e5ed15dc3544eb2bf4e3d8089a987d042869b2c8cb69d28415b7c4fdb
SHA512

ec93103fd134f1e5c0ce029eb64b6821dca54788a640124bb5a49918c3e65f9a81acbd5c563239105d66e9301a99e0ed60f2d63f02343690285acc466d26a779
SSDEEP

768:PzQiW1X6h63rP1a1gFWsRBbJkG1tz+KyDWfYI+vE895S3LEbY:Pz/gX6h6Y1gFWs5KtifYI+vE+5S3UY

Score

1^/10

Malware Config

Signatures

Files

a567f94bc1d91aa5c25950a033300505_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8de7d5d8febe8226b1358154589388be

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

31:a4:e3:40:b4:70:b6:9b:40:99:8f:7d:c4:94:d9:97
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/11/2008, 00:00

Not After

06/01/2011, 23:59

Subject

CN=Trusteer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Trusteer,L=Tel-Aviv,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cd:77:a8:d2:37:d8:d3:b5:57:a5:6e:f3:12:48:03:8b:60:1a:f5:8b
Signer

Actual PE Digest

cd:77:a8:d2:37:d8:d3:b5:57:a5:6e:f3:12:48:03:8b:60:1a:f5:8b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
SetComputerNameA
GetShortPathNameA
EndUpdateResourceW
GetLocaleInfoA
GetExitCodeThread
GetCurrentProcessId
CreateSemaphoreW
MoveFileW
GlobalFindAtomW
GetLocaleInfoW
SetUnhandledExceptionFilter
IsBadStringPtrA
CreateEventW
GetCurrentThread
CreateMutexW
LoadLibraryA
EndUpdateResourceA
GetLogicalDriveStringsW
WaitForMultipleObjects
lstrcmpiW
FlushFileBuffers
GetProcAddress
CreateNamedPipeW
AddAtomW
GetSystemDefaultLangID
CreateMailslotW
GetEnvironmentVariableW
QueryPerformanceCounter
ReplaceFileA
GetCalendarInfoA
WaitForSingleObject
lstrcmpiA
EnumCalendarInfoA
SuspendThread
GetDiskFreeSpaceA
GetProcessHeap
HeapCreate
IsValidCodePage
GetFullPathNameA
GetTimeFormatA

user32

SendMessageA
LoadIconW
SetWindowLongW
DialogBoxIndirectParamA
GetMenuState
InsertMenuA
OffsetRect
ArrangeIconicWindows
EnumChildWindows
CharPrevW
WinHelpA
SendDlgItemMessageW
GetMenuItemInfoA
GetDlgItemTextW
GetTopWindow
DialogBoxParamW
wvsprintfA

gdi32

GetStretchBltMode
TranslateCharsetInfo
GetDCOrgEx
CreateDCW
GetTextExtentExPointI
CreatePatternBrush
SetMapperFlags
SetRectRgn
GetTextCharsetInfo
GetTextMetricsW
SetTextAlign
SetWindowOrgEx
SaveDC
DeleteObject

advapi32

RegDeleteValueW
RegEnumValueA
RegCreateKeyExA
RegRestoreKeyA
RegReplaceKeyW
RegSaveKeyA
RegQueryValueW
RegReplaceKeyA
RegOpenKeyW
RegRestoreKeyW
RegDeleteKeyA
RegOpenKeyW

shlwapi

PathUnquoteSpacesA
StrFromTimeIntervalW
wvnsprintfA
PathIsRelativeW
SHRegEnumUSKeyW
PathCompactPathW
SHDeleteOrphanKeyA
UrlCombineA
StrRetToBufA
StrRetToStrA
PathIsUNCServerW
PathBuildRootA
PathFindSuffixArrayW

comctl32

CreateMappedBitmap
ImageList_SetDragCursorImage
FlatSB_GetScrollInfo
FlatSB_SetScrollInfo
ImageList_SetFilter
AddMRUStringW
InitCommonControlsEx
ImageList_SetBkColor

comdlg32

PrintDlgA
GetFileTitleA
FindTextA
LoadAlterBitmap

wininet

InternetLockRequestFile
FtpCreateDirectoryW
InternetSetStatusCallback
GetUrlCacheEntryInfoW
HttpOpenRequestW
FtpPutFileEx
GetUrlCacheEntryInfoExA
SetUrlCacheGroupAttributeA
GetUrlCacheConfigInfoW
InternetTimeToSystemTime
DeleteUrlCacheEntry
DetectAutoProxyUrl
FindNextUrlCacheContainerA
InternetCreateUrlW
InternetSetStatusCallbackW
InternetConfirmZoneCrossing
DeleteUrlCacheContainerW
GopherGetAttributeA

inetcomm

EssContentHintDecodeEx
MimeOleGetInternat
MimeOleCreateByteStream

crypt32

CertEnumSystemStoreLocation
CryptVerifyDetachedMessageSignature
CertControlStore
CryptLoadSip
CertCompareCertificate
PFXVerifyPassword
CryptMsgDuplicate
CertFreeCertificateChain
CryptMsgCountersignEncoded
I_CryptRegisterSmartCardStore
CryptSIPGetSignedDataMsg
CertSetCertificateContextPropertiesFromCTLEntry
CertCreateSelfSignCertificate

Sections

.jmm
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Mffmm
Size: 1024B - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.cB
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Ytk
Size: 2KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.p
Size: 4KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 174KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ShT
Size: 6KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8de7d5d8febe8226b1358154589388be

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

31:a4:e3:40:b4:70:b6:9b:40:99:8f:7d:c4:94:d9:97Certificate

Extended Key Usages

Key Usages

cd:77:a8:d2:37:d8:d3:b5:57:a5:6e:f3:12:48:03:8b:60:1a:f5:8bSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shlwapi

comctl32

comdlg32

wininet

inetcomm

crypt32

Sections

.jmm Size: 5KB - Virtual size: 5KB

.Mffmm Size: 1024B - Virtual size: 287KB

.cB Size: 12KB - Virtual size: 12KB

.Ytk Size: 2KB - Virtual size: 84KB

.p Size: 4KB - Virtual size: 49KB

.data Size: 174KB - Virtual size: 502KB

.ShT Size: 6KB - Virtual size: 48KB

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 868B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

31:a4:e3:40:b4:70:b6:9b:40:99:8f:7d:c4:94:d9:97
Certificate

cd:77:a8:d2:37:d8:d3:b5:57:a5:6e:f3:12:48:03:8b:60:1a:f5:8b
Signer

.jmm
Size: 5KB - Virtual size: 5KB

.Mffmm
Size: 1024B - Virtual size: 287KB

.cB
Size: 12KB - Virtual size: 12KB

.Ytk
Size: 2KB - Virtual size: 84KB

.p
Size: 4KB - Virtual size: 49KB

.data
Size: 174KB - Virtual size: 502KB

.ShT
Size: 6KB - Virtual size: 48KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 868B