ad4208a06a1acf4030b439159988dc54_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ad4208a06a1acf4030b439159988dc54_JaffaCakes118
Size

669KB
MD5

ad4208a06a1acf4030b439159988dc54
SHA1

df5ba57f7085b3474d7cd562b05e6c0f32dc2fe4
SHA256

f972d71a8b181f788094589768835e9da53efd777de229a5a053d376b8c06217
SHA512

de3f8e5481a4679847bf5f4fa214c13f309dde0febf22af4c1a9ac0856f934119968807b3a0961f4cb7ebd484ecd1595aab9b639b8fed4c6553096c9bebcc4e5
SSDEEP

12288:FMsSjzz6ecFXhgXSjvRak+LEe7Kfiq0frS1QwI7XHgZQKhJgeCm8Qj8G:FMsSjzz67gCjF+LXOl0TS1OLHgZpJEI

Score

1^/10

Malware Config

Signatures

Files

ad4208a06a1acf4030b439159988dc54_JaffaCakes118
.exe windows:4 windows x86 arch:x86

80d009a2872c8ea911107def4e55c922

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e5:23:c8:1e:3e:5d:2e:76:dc:97:01:05:8a:89:e7:34:f5:f9:23:c0
Signer

Actual PE Digest

e5:23:c8:1e:3e:5d:2e:76:dc:97:01:05:8a:89:e7:34:f5:f9:23:c0

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dw20.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
DeregisterEventSource
ReportEventA
RegisterEventSourceW
ReportEventW
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
GetUserNameA
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA
SetNamedSecurityInfoW
GetSecurityDescriptorDacl
RegDeleteValueA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegEnumValueW
RegQueryInfoKeyW
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
IsValidSid
CopySid
GetTokenInformation
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW

comctl32

ord17
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon

gdi32

SetTextColor
GetTextMetricsA
DeleteDC
RestoreDC
DeleteObject
GetTextFaceA
SelectObject
CreateFontA
GetDeviceCaps
SetMapMode
SaveDC
CreateFontIndirectW
GetObjectW
GetTextExtentPoint32W
SetTextAlign
CreateFontIndirectA
GetObjectA
SetBkMode
ExtTextOutW

kernel32

GetUserDefaultLangID
GetACP
GetSystemDefaultLCID
FreeLibrary
MultiByteToWideChar
GetProcAddress
GetVersionExW
GetVersionExA
GetModuleFileNameW
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
GetModuleHandleA
lstrcpynA
SetEvent
CreateProcessW
ExpandEnvironmentStringsW
CreateFileMappingA
GetFileSize
CreateFileA
UnmapViewOfFile
CreateFileW
GetTickCount
WideCharToMultiByte
WriteFile
SetFilePointer
GetTempPathW
GetFileAttributesW
SetEndOfFile
IsDBCSLeadByte
GetSystemDirectoryA
SetThreadPriority
CreateRemoteThread
GetSystemDefaultUILanguage
LoadLibraryExA
SetEnvironmentVariableA
CreateDirectoryW
ReadProcessMemory
VirtualQueryEx
GetSystemInfo
GetLocalTime
FindClose
FindNextFileW
FindFirstFileW
GetComputerNameA
SetPriorityClass
SuspendThread
ExitThread
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
LocalFree
GetSystemWindowsDirectoryW
MoveFileW
lstrcmpiW
GetLongPathNameW
GetSystemDefaultLangID
GlobalFree
GlobalAlloc
QueryPerformanceCounter
UnhandledExceptionFilter
GetCurrentThread
LocalAlloc
GetLocaleInfoA
GetVersion
GetShortPathNameA
OpenEventA
CreateEventA
OpenSemaphoreA
CreateSemaphoreA
OpenMutexA
CreateMutexA
GetProcessTimes
GetModuleHandleW
SetFileAttributesW
InterlockedExchange
InterlockedIncrement
InterlockedDecrement
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
VirtualAlloc
VirtualFree
GetUserDefaultLCID
CompareStringW
IsValidCodePage
GetStringTypeExW
IsValidLocale
DuplicateHandle
GetThreadSelectorEntry
TerminateThread
HeapCreate
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LoadLibraryW
GetPriorityClass
GetThreadPriority
GetThreadTimes
GetThreadContext
GetStartupInfoA
ResumeThread
GetCurrentThreadId
OutputDebugStringA
DebugBreak
LoadLibraryA
GetModuleFileNameA
MulDiv
SetLastError
SetUnhandledExceptionFilter
GetCurrentProcessId
GetLastError
CloseHandle
CreateThread
DeleteFileW
TerminateProcess
GetCurrentProcess
Sleep
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
WaitForSingleObject
ReleaseMutex
MapViewOfFile
GetCommandLineW
GetShortPathNameW
OpenProcess

oleacc

LresultFromObject
CreateStdAccessibleObject

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
StringFromIID
CoTaskMemFree

oleaut32

VariantTimeToDosDateTime
SysAllocString
SysFreeString
SystemTimeToVariantTime
SysStringLen

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
_controlfp
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
time
memmove
tolower
ceil
strchr
wcschr
_except_handler3

rpcrt4

UuidCreate

shell32

ShellExecuteExA
SHGetSpecialFolderPathW
ExtractIconExA

shlwapi

wnsprintfA
AssocQueryStringW
UrlGetPartA
wvnsprintfA
wnsprintfW

urlmon

CreateURLMoniker

user32

IsWindowVisible
GetDlgCtrlID
IsWindow
CreateDialogIndirectParamA
MapDialogRect
CallWindowProcA
CallWindowProcW
LoadBitmapA
EnumWindows
GetWindowThreadProcessId
IsIconic
GetWindowPlacement
DestroyIcon
GetForegroundWindow
FlashWindowEx
GetFocus
SetScrollInfo
SystemParametersInfoA
GetScrollInfo
SetDlgItemTextA
IsDlgButtonChecked
LoadStringA
SetFocus
CheckDlgButton
DestroyWindow
EndDialog
MoveWindow
GetSysColor
EnableWindow
GetWindow
PostMessageA
CreateDialogParamW
SetWindowTextA
GetDC
MapWindowPoints
GetSysColorBrush
FillRect
ReleaseDC
SetWindowLongA
LoadIconA
GetSystemMetrics
SetForegroundWindow
GetWindowLongA
GetWindowRect
SetWindowPos
DialogBoxParamA
RegisterClassExA
CreateWindowExA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
KillTimer
SetTimer
DefWindowProcA
SendMessageA
SetWindowTextW
DrawFocusRect
SetRectEmpty
DrawTextW
DrawTextA
GetWindowLongW
SendMessageW
IsWindowUnicode
GetClassNameA
GetParent
UpdateWindow
SendDlgItemMessageA
SendMessageTimeoutA
GetClientRect
SetCursor
InvalidateRect
LoadCursorA
ShowWindow
LoadStringW
DrawIconEx
GetDlgItem
EnumDisplayMonitors
DialogBoxParamW

version

VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW

wininet

InternetCloseHandle
HttpQueryInfoA
InternetReadFileExA
InternetWriteFile
HttpSendRequestExA
HttpOpenRequestA
InternetOpenA
InternetSetStatusCallback
InternetGetConnectedState
InternetCanonicalizeUrlA
InternetCrackUrlA
HttpEndRequestA
InternetConnectA

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 351KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

xvsaiql
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fkrkehd
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

80d009a2872c8ea911107def4e55c922

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

e5:23:c8:1e:3e:5d:2e:76:dc:97:01:05:8a:89:e7:34:f5:f9:23:c0Signer

Headers

File Characteristics

PDB Paths

Imports

advapi32

comctl32

gdi32

kernel32

oleacc

ole32

oleaut32

msvcrt

rpcrt4

shell32

shlwapi

urlmon

user32

version

wininet

Sections

.text Size: 387KB - Virtual size: 387KB

.data Size: 196KB - Virtual size: 351KB

.rsrc Size: 52KB - Virtual size: 53KB

xvsaiql Size: 31KB - Virtual size: 32KB

fkrkehd Size: - Virtual size: 4KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

e5:23:c8:1e:3e:5d:2e:76:dc:97:01:05:8a:89:e7:34:f5:f9:23:c0
Signer

.text
Size: 387KB - Virtual size: 387KB

.data
Size: 196KB - Virtual size: 351KB

.rsrc
Size: 52KB - Virtual size: 53KB

xvsaiql
Size: 31KB - Virtual size: 32KB

fkrkehd
Size: - Virtual size: 4KB