a904f2a0a3a579d3e496431351fa3fdb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a904f2a0a3a579d3e496431351fa3fdb_JaffaCakes118
Size

1.1MB
MD5

a904f2a0a3a579d3e496431351fa3fdb
SHA1

324ef2c1469bb2768606b5d55265a9e71a7475f9
SHA256

053d3864a56ad31ff589b849992173b9b82e66a90384733315c33d1365366aad
SHA512

b7ce56c773e415e686a891c3c0c73e52b42b397f278dc8799b1ad4af89f88bc1f4ec0a8236f4ac305798073fd2388495a5a22349a481503b3f9266aaf81c7473
SSDEEP

24576:m11pmVwM7pbGUeXFK7tzNNIwu4kIGgoPU19G3acd4T1IG66c:mBVK7tfIrT7M1o3a045Zc

Score

1^/10

Malware Config

Signatures

Files

a904f2a0a3a579d3e496431351fa3fdb_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

5af596e33214a9fd4a197c938e61cd06

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/10/2008, 00:00

Not After

07/10/2010, 23:59

Subject

CN=Smart Shopper Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Smart Shopper Inc,L=Wilmington,ST=Delaware,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ed:e0:54:18:52:53:bf:85:dc:96:cf:f0:35:5d:df:90:96:74:ab:0b
Signer

Actual PE Digest

ed:e0:54:18:52:53:bf:85:dc:96:cf:f0:35:5d:df:90:96:74:ab:0b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\091013_085056_build_SmartShopper_Build_SmartShopper_2.6.58.0\source\source_sms\bin\ShoppingReport.pdb

Imports

kernel32

HeapFree
GetCurrentProcess
SetLastError
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetCurrentProcessId
VirtualQuery
GetModuleFileNameA
HeapReAlloc
lstrlenA
WaitForSingleObject
GetSystemDirectoryA
LoadLibraryA
GetTickCount
LocalAlloc
LockResource
GetDriveTypeA
LoadResource
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetEnvironmentVariableA
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
UnhandledExceptionFilter
GetEnvironmentStrings
RaiseException
GetStartupInfoA
GetFileType
SizeofResource
SetHandleCount
LCMapStringA
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
QueryPerformanceCounter
FatalAppExitA
VirtualFree
HeapCreate
GetLocalTime
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
HeapSize
HeapDestroy
GetVersionExA
MoveFileExW
CreateFileA
DeleteFileA
GetSystemDefaultLangID
GlobalHandle
GlobalFree
PulseEvent
ReleaseSemaphore
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
GetFileSize
SetEndOfFile
CreateThread
TerminateThread
SetThreadPriority
ResumeThread
GetCurrentThread
IsBadWritePtr
SetUnhandledExceptionFilter
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileTime
SystemTimeToFileTime
SetFileTime
Sleep
FindClose
GetSystemTime
FileTimeToSystemTime
GetExitCodeProcess
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
ResetEvent
SetEvent
ReleaseMutex
CloseHandle
LocalFree
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetLastError
GetCurrentThreadId
HeapAlloc
GetStdHandle
GetProcessHeap
GetThreadLocale
GetLocaleInfoA
GetACP
FreeEnvironmentStringsA
InterlockedExchange
GetFullPathNameA

advapi32

GetSecurityDescriptorSacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorSacl
RegCloseKey

user32

InvalidateRgn
GetDesktopWindow
GetSysColor
EndPaint
BeginPaint
SetFocus
IsChild
GetFocus
GetDlgItem
RedrawWindow
TranslateMessage
MsgWaitForMultipleObjects
UpdateWindow
GetTopWindow
InvalidateRect
GetKeyState
SetWindowRgn
BringWindowToTop
MapWindowPoints
EnumChildWindows
OffsetRect
InflateRect
KillTimer
DestroyWindow
ReleaseDC
GetDC
ShowWindow
IsWindow
GetParent
GetClientRect
CopyRect
MoveWindow
EqualRect
GetWindowRect
IsIconic
IsWindowVisible
SetTimer
ReplyMessage
FillRect
SetCapture
ReleaseCapture
UnregisterClassA
EnumWindows
SetRectEmpty
GetSysColorBrush
DestroyAcceleratorTable
GetWindow
MapDialogRect
SetWindowContextHelpId
SetWindowPos

gdi32

DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
BitBlt
GetDeviceCaps
CreateSolidBrush
CreateRectRgn
CombineRgn
CreatePolygonRgn
CreateRoundRectRgn
OffsetRgn
FillRgn
SelectObject

sensapi

IsNetworkAlive

version

GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
GetFileVersionInfoA
VerQueryValueW
VerQueryValueA
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
StringFromCLSID
CoCreateGuid
CoCreateInstance
ProgIDFromCLSID
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
OleRun
CoUninitialize
CoInitialize
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CLSIDFromString

oleaut32

VarBstrCat
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VariantClear
DispCallFunc
VariantInit
VariantChangeType
UnRegisterTypeLi
RegisterTypeLi
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleCreateFontIndirect
VariantCopy
VarBstrCmp
SafeArrayLock
SafeArrayUnlock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
SafeArrayDestroy
SafeArrayCopy
SystemTimeToVariantTime
VariantTimeToSystemTime
VectorFromBstr
SafeArrayGetDim
SafeArrayGetElement
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayPutElement
VarUdateFromDate
SafeArrayGetVartype
BstrFromVector

shlwapi

StrToIntW
StrRChrW
PathFileExistsW
PathFindExtensionW

urlmon

CreateURLMoniker

ws2_32

inet_addr
WSAGetLastError
gethostbyname
inet_ntoa
htonl
getservbyname
htons
gethostbyaddr
ntohs
getservbyport
WSASetLastError
WSACleanup
WSACloseEvent
WSAEnumNetworkEvents
WSAConnect
WSAGetOverlappedResult
WSASend
WSAResetEvent
WSARecv
WSAEventSelect
WSASetEvent
WSACreateEvent
WSAStartup
closesocket
WSASocketW

comctl32

_TrackMouseEvent
ord17
ImageList_GetImageCount
ImageList_ReplaceIcon

crypt32

CryptMsgGetParam
CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CertFindCertificateInStore

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllSendIdsRequestAbort
DllSendIdsRequestAlreadyInstalled
DllSendIdsRequestCancel
DllSendIdsRequestInstalledOnVista
DllSendIdsRequestOk
DllSendUninstallReport
DllUnregisterServer

Sections

.text
Size: 760KB - Virtual size: 756KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5af596e33214a9fd4a197c938e61cd06

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6cCertificate

Extended Key Usages

Key Usages

ed:e0:54:18:52:53:bf:85:dc:96:cf:f0:35:5d:df:90:96:74:ab:0bSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

gdi32

sensapi

version

iphlpapi

ole32

oleaut32

shlwapi

urlmon

ws2_32

comctl32

crypt32

shell32

Exports

Exports

Sections

.text Size: 760KB - Virtual size: 756KB

.rdata Size: 204KB - Virtual size: 203KB

.data Size: 20KB - Virtual size: 31KB

.rsrc Size: 108KB - Virtual size: 106KB

.reloc Size: 56KB - Virtual size: 55KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

f0:eb:1a:47:87:27:d6:6b:ad:73:b5:86:0e:12:6c
Certificate

ed:e0:54:18:52:53:bf:85:dc:96:cf:f0:35:5d:df:90:96:74:ab:0b
Signer

.text
Size: 760KB - Virtual size: 756KB

.rdata
Size: 204KB - Virtual size: 203KB

.data
Size: 20KB - Virtual size: 31KB

.rsrc
Size: 108KB - Virtual size: 106KB

.reloc
Size: 56KB - Virtual size: 55KB