a9f054c16c59439695d9f71df9d249d8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a9f054c16c59439695d9f71df9d249d8_JaffaCakes118
Size

763KB
MD5

a9f054c16c59439695d9f71df9d249d8
SHA1

a49a1ba0ee091fbefbd82d6912ea43300deb02d8
SHA256

6ce5d30c29a710aa0f458d779f4035479718f624967f25a6eafc94bf48c505d3
SHA512

bd209113ec781eb5add7c9ff2d734789a04ca2dd0311365e0ed665a41c1146e4af9e0c3401fd3b4401ec6957b67357eb34e7a8241733ae5779735426dc723f6a
SSDEEP

12288:FfNJLsP9aLcFNrfK1yMeuvVq1OfmzuAMViNGcllV:FHLsPsoFFK1C0q1wmy5iUcl

Score

1^/10

Malware Config

Signatures

Files

a9f054c16c59439695d9f71df9d249d8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

330d890062657094c93440173562a132

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:0d:05:62:da:54:3c:71:1b:ff:b9:03:17:90:10:27
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07/08/2007, 00:00

Not After

03/10/2010, 23:59

Subject

CN=Seekmo,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Seekmo,O=Seekmo,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

32:d8:ae:00:70:34:b1:1b:a5:14:d7:ee:ad:84:92:71:62:45:63:b7
Signer

Actual PE Digest

32:d8:ae:00:70:34:b1:1b:a5:14:d7:ee:ad:84:92:71:62:45:63:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\090316_150600_build_BECKS\Client_Build_BECKS_10.3.79.0\compile\source_sa\bin\Seekmo_Release\SeekmoSA.pdb

Imports

comctl32

ord17

kernel32

GlobalLock
GlobalAlloc
lstrlenW
MulDiv
GlobalDeleteAtom
GlobalGetAtomNameA
CreateProcessA
SetFileAttributesA
DeleteFileA
GetTempPathA
GetTempFileNameA
InterlockedExchange
GetVersion
CompareStringA
CompareStringW
OpenMutexA
ReleaseMutex
UnmapViewOfFile
OutputDebugStringA
GetCurrentProcessId
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
GetVersionExA
GetComputerNameExA
GetSystemDirectoryA
GetOEMCP
GetACP
GetThreadLocale
GetUserDefaultLangID
GetSystemDefaultLangID
DosDateTimeToFileTime
LocalAlloc
RemoveDirectoryA
GetFileAttributesA
GetPrivateProfileStringA
OpenFile
SetFilePointer
GetComputerNameA
GetDriveTypeA
GetVolumeInformationA
SetErrorMode
GetProcessHeap
HeapFree
HeapAlloc
WaitForMultipleObjects
OpenEventA
GlobalAddAtomA
CopyFileA
FreeResource
IsBadReadPtr
FileTimeToSystemTime
ResumeThread
SetThreadPriority
GetCurrentThread
FormatMessageA
GlobalFree
GlobalHandle
CompareFileTime
SystemTimeToFileTime
WritePrivateProfileStringA
GetTimeZoneInformation
GlobalUnlock
RaiseException
GetSystemTime
SetEnvironmentVariableA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetDateFormatA
GetTimeFormatA
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetStringTypeW
GetStringTypeA
ExitProcess
HeapCreate
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetLocaleInfoA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
FlushInstructionCache
GetCurrentProcess
GetModuleHandleA
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetEvent
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
GetShortPathNameA
MultiByteToWideChar
ResetEvent
Sleep
WriteFile
CreateFileA
GetFileSize
ReadFile
CreateDirectoryA
LocalFree
CreateThread
TerminateThread
CreateEventA
lstrlenA
lstrcpyA
lstrcpynA
lstrcmpA
LoadLibraryExA
CreateMutexA
GetLastError
CloseHandle
OpenProcess
GetTickCount
WaitForSingleObject
GetSystemTimeAsFileTime
GetModuleFileNameA

user32

IsWindowEnabled
EnumThreadWindows
CheckMenuItem
EnableMenuItem
DeleteMenu
InsertMenuA
CreateDialogIndirectParamA
SetActiveWindow
CharLowerBuffA
EnumWindows
SendMessageTimeoutA
UnregisterClassA
DrawAnimatedRects
GetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
EnableWindow
LoadMenuA
GetSubMenu
DestroyMenu
ModifyMenuA
SetMenuItemInfoA
TrackPopupMenu
FindWindowExA
SystemParametersInfoA
SetRect
EndDialog
DrawIcon
IsIconic
DialogBoxParamA
IsWindowVisible
DefWindowProcA
GetPropA
PostMessageA
IsWindow
GetClassInfoExA
LoadCursorA
DestroyWindow
PostThreadMessageA
RegisterClassExA
CreateWindowExA
GetThreadDesktop
DestroyIcon
LoadImageA
SetWindowPos
LoadBitmapA
PtInRect
CopyRect
LoadIconA
GetCursorPos
SetWindowRgn
PeekMessageA
MsgWaitForMultipleObjects
AdjustWindowRectEx
GetMenu
SetDlgItemTextA
CreateAcceleratorTableA
GetDesktopWindow
GetFocus
SetFocus
DestroyAcceleratorTable
BeginPaint
RemovePropA
SetWindowLongA
SetPropA
GetAncestor
SetForegroundWindow
GetSystemMetrics
GetWindowRect
FindWindowA
EndPaint
CallWindowProcA
FillRect
ReleaseCapture
GetClassNameA
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
CharNextA
GetSysColor
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
SendMessageA
SetWindowContextHelpId
GetWindow
SendDlgItemMessageA
MapDialogRect
KillTimer
SetTimer
GetWindowLongA
PostQuitMessage
MessageBoxA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow

gdi32

SelectClipRgn
StretchBlt
GetPixel
DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32A
GetDeviceCaps
CreateSolidBrush
GetObjectA
GetStockObject
CreateRectRgn
GetRgnBox
PtInRegion
CombineRgn
ExtCreateRegion
BitBlt
GetRegionData

advapi32

RegCreateKeyExA
CryptAcquireContextA
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptDeriveKey
CryptDestroyKey
CryptDecrypt
CryptHashData
RegDeleteKeyA
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegEnumKeyExA
RegQueryInfoKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA
LookupAccountNameA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegSetValueExA

shell32

Shell_NotifyIconA
SHAppBarMessage
ShellExecuteExA
ShellExecuteA

ole32

IIDFromString
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

SysStringLen
SysAllocStringLen
SysAllocString
SysStringByteLen
VariantInit
SystemTimeToVariantTime
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantCopy
VariantChangeType
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnlock
SafeArrayLock
SafeArrayCreate
SysAllocStringByteLen
VariantTimeToSystemTime
SysFreeString

shlwapi

StrToIntA
PathFileExistsA

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 570KB - Virtual size: 570KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

330d890062657094c93440173562a132

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

32:0d:05:62:da:54:3c:71:1b:ff:b9:03:17:90:10:27Certificate

Extended Key Usages

Key Usages

32:d8:ae:00:70:34:b1:1b:a5:14:d7:ee:ad:84:92:71:62:45:63:b7Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

rpcrt4

version

Sections

.text Size: 570KB - Virtual size: 570KB

.data Size: 29KB - Virtual size: 41KB

.rsrc Size: 158KB - Virtual size: 157KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

32:0d:05:62:da:54:3c:71:1b:ff:b9:03:17:90:10:27
Certificate

32:d8:ae:00:70:34:b1:1b:a5:14:d7:ee:ad:84:92:71:62:45:63:b7
Signer

.text
Size: 570KB - Virtual size: 570KB

.data
Size: 29KB - Virtual size: 41KB

.rsrc
Size: 158KB - Virtual size: 157KB